Under GDPR, you have a right to be told whether any personal data is held about you, as per our Customer Privacy Notice.
You also have a right to a copy of that information in a permanent form except where the supply of such a copy is not possible or would involve disproportionate effort, or if you agree otherwise.
We will only give access to information if it is satisfied as to your identity.
If release of the information will disclose information relating to another individual(s), who can be identified from that information, then we are not obliged to comply with an access request unless:
• The other individual(s) has consented to the disclosure of information through the formal Subject
Access Request process, or
• It is reasonable in all circumstances to comply with the request without consent of the other individual(s)
Subject Access Request Form
To request CCTV footage use the Subject Access Request form available for download here (PDF).
We will provide a response to the access request with any requested information within 30 days of receiving the request after verification of I.D., or if we need more time to satisfy the request or no longer have the footage then you’ll be notified before the 30 days are up.
Cameras and Recording Equipment
Cameras are sited so that they capture images that are relevant to Lothian Buses or our subsidiary companies. The images recorded by our CCTV System are of a high resolution, colour digital format, with audio in certain areas, recorded onto a hard drive.
The systems in use on board buses work on a looped recording basis capable of storing 1 week or more of data, depending on the equipment in the bus, thus images or events recorded will not be available after the files have been overwritten, unless the images have been recovered by the CCTV Manager prior to being overwritten.
The systems in use in our buildings and Travelshops work on a looped recording basis capable of storing approximately 1 month of data, thus images or events recorded will not be available after the files have been overwritten, unless the images have been recovered by the CCTV Manager prior to being overwritten.
Please see Data for more information.
Signs
Signs are displayed on the inside of our public Travelshop premises and vehicles fitted with CCTV.
Data
Access, security and disclosure of the images are strictly controlled in accordance with the General Data Protection Regulation.
Personal data will be processed fairly, lawfully and in a transparent manner in relation to individuals.
Data will only be collected and used for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
We process personal data for the following purposes:
• The prevention or detection of crime.
• The apprehension or prosecution of offenders.
• Including but not limited to reviews of; events, driving standards, insurance purposes and customer support incidents.
Data Retention
We have a Data Protection regime in place to oversee the effective and secure processing of personal data.
Stored recorded incidents, i.e. images of events or incidents recovered by the CCTV Manager, are retained for a period of 5 years after which they are securely destroyed. Incidents not recorded are overwritten through the looped recording process outlined in the Cameras and Recording Equipment section of this policy.
Complaints
If for any reason you are not happy with the response you receive regarding your Subject Access Request, please contact our Data Protection Officer who will respond to your complaint in writing.
They can be contacted at [email protected]
In providing CCTV cover for our staff and customers, we hope to deter crime and provide a safer, more secure working and travelling environment for both staff and customers.
Police requesting CCTV footage may do so in accordance with the Lothian Buses/Police Scotland CCTV Protocol by sending an email to the CCTV Manager.