Welsh Ambulance Services University NHS Trust operates overt closed-circuit television (CCTV) in and around Trust’s sites and on our vehicles. The Trust is the data controller for the personal information captured through its CCTV systems.
This privacy notice explains how and why the Trust collects, uses, stores and shares personal information captured by CCTV.
This notice applies to anyone who may be captured by Trust CCTV, including:
Depending on the system, camera location and circumstances, CCTV may capture:
Although CCTV is not ordinarily intended to collect special category personal data, images may reveal information about an individual’s health, disability, racial or ethnic origin or religious beliefs. Vehicle CCTV may also incidentally capture a patient receiving assessment or treatment. Audio recording is not enabled.
Cameras are positioned around the exterior of the vehicle, together with a camera in the patient saloon. External cameras record during vehicle operation. The internal saloon camera is configured to record when activated through the vehicle’s panic strip.
Please note: the surveillance cameras inside our vehicles are only activated by the crew should they feel there is a risk to safety. Should the CCTV be activated, you will be advised by the crew (and/or an audio message will be played for CCTV whilst inside the vehicle).
CCTV cameras are located across Trust premises and ambulance stations. Some CCTV monitors may be available to authorised staff for safety-monitoring purposes.
Some Trust premises are shared with other emergency services. Police or Fire and Rescue Service personnel may therefore have access to CCTV at certain shared locations, depending on the ownership and operation of the system. Signs will be displayed where CCTV is in operation, including details of the organisation responsible for the CCTV.
The Trust may use CCTV where this is necessary and proportionate for the following purposes:
CCTV footage is accessed only where there is an authorised, necessary and proportionate reason connected to one of the defined purposes.
The Trust relies on Article 6(1)(e) of the UK General Data Protection Regulation, as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Trust. This includes the provision and effective management of ambulance services, the protection of public safety and the investigation of serious incidents.
Where footage incidentally captures special category personal data, the Trust relies on Article 9(2)(g) of the UK GDPR, as processing may be necessary for reasons of substantial public interest. Depending on the circumstances, the relevant conditions in Schedule 1, Part 2 of the Data Protection Act 2018 may include:
The condition relied upon will be considered in the context of the specific access, use or disclosure of the footage.
CCTV footage is held electronically. Depending on the system, footage may be stored:
Access is restricted to authorised personnel with a legitimate need to carry out their role. Controls include individual user accounts, role-based access permissions, physical security, secure storage and audit logging.
Access may be provided on a need-to-know basis to authorised staff. Upon receiving an official request to provide surveillance camera evidence, the Records Team and/or the Legal Services Team would facilitate access to the relevant files and download the requested footage. This would then be passed to relevant parties who have a legitimate reason to review it.
Suppliers may provide hosting, maintenance or technical support. Vue Ltd acts as a data processor in relation to the primary Fleet CCTV system. Supplier access to footage is not permitted unless expressly authorised by the Trust for a defined purpose, such as retrieving footage that the Trust is unable to access directly.
Where it is lawful, necessary and proportionate, relevant footage may be shared with:
All requests are considered individually. The Trust will assess the purpose, lawful basis, necessity and proportionality of a proposed disclosure before releasing footage. Disclosures must be authorised, documented and made through an appropriately secure method.
Where footage contains information about other people, the Trust may need to redact, obscure or withhold parts of the footage to protect their rights and confidentiality.
Routine vehicle-based CCTV footage is normally retained for no longer than 28 days, after which it is automatically overwritten on a rolling basis.
Relevant footage may be extracted and retained for longer where this is necessary, including for investigations, legal proceedings, or another authorised purpose permitted by law.
Footage shared for law-enforcement purposes may be retained for up to 3 years. Footage required for an internal investigation, litigation or legal proceedings may be retained for the duration of the matter and, following conclusion, for a further period of 10 years.
Depending on the circumstances, you may have the right to:
These rights are not absolute. For example, the Trust may need to retain or withhold footage where this is necessary for public safety, the prevention or detection of crime, legal proceedings, safeguarding, the rights of other people or another overriding legal obligation. Requests will be considered individually under applicable data protection legislation.
You can ask whether the Trust holds CCTV footage containing your image and request a copy by submitting a subject access request.
To help us locate relevant footage, you should provide as much information as possible, including:
Requests for CCTV footage are managed by the Trust’s Records Services and Archives Team under the Trust’s Subject Access Request Procedure. The Trust will request evidence of identity and may need to obscure images of other identifiable people before footage can be released.
Requests can be submitted by visiting: Requests for Records - Welsh Ambulance Services University NHS Trust.
If you have a concern about CCTV or how the Trust has handled your personal information, please contact:
Data Protection Officer
Welsh Ambulance Services University NHS Trust
Email: amb_infogovernance@wales.nhs.uk
Address: Tŷ Elwy, Richard Davies Road, St Asaph, Denbighshire, LL17 0LJ
You also have the right to complain to the Information Commissioner’s Office if you are dissatisfied with the Trust’s response. Information about raising a complaint is available from the Information Commissioner’s Office.