Loading

CLOSED-CIRCUIT TELEVISION (CCTV) POLICY

 

A. BACKGROUND

The Data Privacy Act of 2012 requires that individuals be informed and provide their consent to the processing of their personal information. Under National Privacy Commission (NPC) Circular No. 2024 – 02 (Guidelines on the Use of Closed-Circuit Television (CCTV) Systems), entities engaged in the processing of personal data through Closed-Circuit Television (CCTV) cameras are mandated to ensure that reasonable and appropriate safeguards are in place for the protection of personal data and adhere to the principles of transparency, legitimate purpose, and proportionality.

These guidelines are intended to address emerging privacy risks, and enable the University to properly manage personal data processing through CCTV systems.

 

B. DEFINITION OF TERMS

The following terms are defined as follows:

  1. Civil Security Office refers to the agency unit responsible for safeguarding the CCTV footage within the University and the processing of the Access Request Form in order to allow the data subject access to his/her information being requested.
  2. Closed-Circuit Television or “CCTV” refers to closed-circuit television or camera surveillance system in a fixed or stationary location that can capture images of individuals or other information relating to individuals;
  3. Data Subject refers to a person whose personal data is recorded on CCTV systems and has the right to reasonable access to the same pursuant to Section 16 of DPA and Section 34 of the IRR.

 

C. LEGITIMATE PURPOSE FOR PROCESSING

The safety and security of the campus and the members of the University community are of primary importance. Technological advances in safety and security include the use of closed-circuit television (CCTV) or camera surveillance systems.

The collection, use, disclosure, storage, and other processing of personal data by the CCTV system is for purposes of protecting of the security of University property and managing a safe environment for students, faculty, personnel and other individuals, including, without limitation:

  1. To aid in safety and security operations in campus;
  2. For surveillance in deterring crime and antisocial behavior;
  3. To capture information that could be used to investigate crimes, such as theft and vandalism;
  4. For dispute-resolution purposes where there is a dispute as to facts and the recordings may be capable of resolving that dispute;
  5. For the taking and defense of litigation;

 

D. OPERATIONAL DETAILS

  1. CCTV System Description

The cameras operate full time (24 hours a day, 7 days a week).

The cameras record movement detected in the area under surveillance as well as the time, date and location of the footage.

The cameras do not conduct sound recording.

  1. Location of Cameras. The placement or siting of CCTV cameras shall not unreasonably intrude on the privacy of individuals. The CCTV system provides coverage over the following areas
    • Gate entrances,
    • Building entrances/lobby, and
    • Other areas as required by the university operations.

All CCTV systems shall not infringe on private spaces (e.g., private backyards, through windows of private residences) and restricted areas (i.e. toilets/restrooms, lactation or breastfeeding rooms, and other similar places). Upon installation, all equipment shall be tested to ensure that only the designated areas are monitored. The Civil Security Office shall ensure full compliance with the foregoing and succeeding guidelines.

  1. Storage, Security and Maintenance

The Civil Security Office is the responsible unit in safeguarding the CCTV footage of the University, while a third party service provider shall be responsible for the proper installation, repair, and maintenance of the CCTV cameras being used. The Civil Security Office shall also be the responsible unit in conducting the regular Privacy Impact Assessment on the use of CCTV systems.

Footage recorded by our CCTV cameras must be encrypted and otherwise stored in a secure manner to protect their confidentiality, integrity and availability.

The CCTV monitoring and storing equipment must be kept in a segregated, secure restricted area to which only authorized personnel with security clearance are granted access.

All persons with authorized access to the CCTV system shall be under binding/contractual confidentiality commitments.

Upon installation, all equipment shall be tested by the Civil Security Office to ensure that suitable quality photos are available in live and play back mode. All CCTV equipment shall be maintained regularly.

 

E. NOTICE AND CONSENT

The consent of an individual must be obtained prior to or as soon as practicable after any footage is recorded. Prior to obtaining this consent, the individual must be informed of the purpose and retention duration of the CCTV recordings. CCTV Privacy Notice be posted in all the following: (1) entry points in and around the building; and (2) receiving areas where security guards require visitors to log their information.

The following privacy notice wording may be adopted:

Notice: CCTV in Operation

 

“Closed Circuit Television (CCTV) cameras monitor this property and the surrounding areas for security purposes. Relevant footage may be utilized to identify you, your actions and whereabouts. Footages are  typically recorded and kept for a period of 30 days or such longer duration and processed for matters involving security.”

“By entering this property, you consent to the capture, recording, processing, and sharing of any data that CCTV cameras may obtain, both directly and indirectly.”

In all receiving areas where visitors log their information, the following must be posted near or on the logbook:

Notice: CCTV in Operation

“By indicating your details in this logbook or entering these premises, you undertake to have read, understood, and consented to our CCTV Privacy Notice.”

 

F. LIMITED ACCESS

Footage captured and recorded by the University is accessible only to authorized personnel only through the issuance of a security clearance signed by both the Director of the Civil Security Office and the Chief Administrative Officer for Administration (main campus) or Campus Administrator (for campuses). A security clearance should only be issued to personnel whose access is indispensable to the security purpose of capturing and processing the CCTV footage. Copies of issued security clearances should be filed/reported with the University’s Data Protection Officer.

The University executes non-disclosure agreement, outsourcing agreement or data sharing agreement with third-party providers of CCTVs to ensure privacy, safety and security of the individuals, premises and/or the operation and maintenance of the University. Service providers may have access to footage only where strictly required to perform their tasks, and are prohibited from using the footage for any other purposes.

 

G. RETENTION

CCTV footage shall be retained only for as long as necessary to fulfill the purpose for which the CCTV footage was obtained and shall be destroyed once it is no longer needed for its declared and specified purpose. Standard retention period of CCTV footage captured by the University is thirty (30) days after which the file is deleted from the records of the University.

 

H. REQUEST FOR ACCESS

1. Requirements. Individuals who request access to CCTV footage must submit this formally in writing through the completion of Access Request Form and submission of other pertinent documents in order to provide sufficient details to identify the section of footage with which they are concerned and to enable the University to determine that the person making the request is the data subject of that specific recording or his/her authorized representative.

The request is considered submitted at the time the requesting party complies with the applicable requirements stated in the Access Request Form.

Upon receipt of the request, security clearance must be processed by the attending personnel and signed by the Director Civil Security Office and Chief Administrative Officer for Administration (main campus) or Campus Administrator (for campuses) with a copy forwarded to the Data Protection Team. Access requests on CCTV recordings must essentially contain when, where and by whom the data will be used.

A request is deemed abandoned when the requesting party has not fulfilled the aforesaid requirements within thirty (30) days from initially informing CvSU of the intention to either view or obtain a copy of the CCTV footage.

2. Period for Complying with the Request.

  1. The processing of request for viewing purposes must be made within five (5) working days from receipt of request. The period shall not exceed fifteen (15) working days from the receipt of the request when the request involves obtaining a copy of the CCTV footage.
  2. If a request is complex or involves numerous footages, whether for viewing or obtaining a copy of the CCTV footage, the period to comply with such request may be extended for an additional period not exceeding fifteen (15) working days with notice to the requesting party.

 

3. Response Procedure.

a. Viewing. If the request for viewing purposes is granted, requesting party may be allowed a reasonable opportunity to view the requested footage, subject to the following conditions:

    1. CCTV footage shall be viewed in an authorized and secure area;
    2. Only the requesting party and the authorized personnel of CvSU shall be allowed to view such footage; and
    3. Other security measures to ensure confidentiality of the footage to be viewed shall be implemented, such as signing of non-disclosure agreements or prohibiting the capture of the footage through mobile phones and other devices, where appropriate.

b. Obtaining a copy of the CCTV footage. In case of request for a copy of the CCTV footage, the copying of footage must be made in a secure manner that maintains the integrity of the footage and any associated metadata. In circumstances where there is technical difficulty in providing a copy of the footage in video format, still images may be provided as an alternative, subject to reasonable charges, whenever necessary to cover administrative costs.

 

4. Authorized Disclosures. Subject to the criteria provided for the lawful processing of personal data under the  Data Privacy Act of 2012, CCTV footage may also be disclosed in the following instances:

a. Law enforcement and criminal investigation. With respect to requests for CCTV footage to be disclosed in relation to a criminal investigation, CvSU may allow appropriate disclosure of CCTV footage to the authorized law enforcement agencies in connection with the latter’s constitutional or statutory function, subject to the following:

    1. Law enforcement officers must provide a written statement, affirmative declaration, or equivalent to establish the lawfulness of the request; and
    2. The request for CCTV footage must be made following, and with strict adherence to, existing standard operating procedures in the conduct of an investigation and law enforcement operation as stated in the applicable rules and regulations of law enforcement agencies and other pertinent public authorities.

b. Court Order. Requests for disclosure and use of CCTV footage and images by virtue of a lawful order of a court of competent authority may be granted provided there is a proper subpoena issued by the Court.

c. Administrative investigations. The use of CCTV footage for purposes of an administrative investigation shall be allowed provided that the requesting party submits sufficient proof of the investigation being conducted or the pending complaint before an administrative body.

d. Request from the media. The use of CCTV footage by the media shall only be allowed if there is lawful basis for processing under Sections 12 or 13 of the DPA or processing under a special case, specifically Section 4 (d) of the DPA. Written consent of the data subject/s must be obtained prior to disclosure.

 

5. Denial of request. Requests for access to CCTV footage may be denied upon appropriate evaluation.

a. The following are grounds for denial:

    1. Incomplete information regarding the requested CCTV footage, provided, that the data subject, their authorized representative, or third party is first given a reasonable opportunity to amend the request and provide complete information;
    2. The access request is frivolous or vexatious. The determination of what constitutes frivolous or vexatious may be made on the basis of the particular circumstances of the request;
    3. The purpose for and manner of viewing or obtaining a copy of the footage is contrary to law, morals, or public policy;
    4. The request to obtain a copy of the CCTV footage is disproportionate to the purpose stated by the requesting party;
    5. The burden or expense of providing access would be unreasonable or involve disproportionate effort on the part of the University;
    6. The footage has already been deleted by the time the University received the request pursuant to its documented retention policy; and
    7. If disclosure of the footage could put an ongoing criminal investigation at risk as determined by the appropriate public authority. For this purpose, the University should provide written proof of this determination.

b. The University may only deny a request after giving the data subject or third party a reasonable opportunity to amend the request. Should the University deny a request for CCTV access, it shall provide the requesting party with the reason for the denial within five (5) working days from receipt of the request: provided, that the denial shall not serve as a bar for future requests by the same data subject or third party which complies with the requirements on the sufficiency of details on the requested footage.

The determination of the reasonableness of the denial of a request shall be made upon the initiation of an investigation by the NPC or upon the filing of a complaint, pursuant to the NPC’s Rules of Procedure.