CCTV and other surveillance systems installed on our property, serve a crucial role in ensuring the safety and security of our guests, staff, and visitors. While we acknowledge the importance of these systems, we also understand that the images captured by surveillance cameras constitute personal data that must be handled in compliance with data protection laws.
We are committed to complying with our legal obligations and ensuring that the legal rights of both guests and staff, in relation to their personal data, are acknowledged and respected. This policy is designed to address these concerns and prioritize data protection.
For the purposes of this policy all capitalised terms shall have the meaning attributed to them by the Data Protection Act (Chapter 586 of the Laws of Malta). The Data Controller of all personal data gathered using CCTV within these premises is THE WATERFRONT HOTEL, a registered company regulated by Maltese law and residing at The Strand, Sliema. GZR1028, Malta.
ABOUT THIS POLICY
We currently use CCTV cameras to view and record guests, staff and visitors on and around our establishment. This policy outlines why we use CCTV, how we will use recorded CCTV footage and how we will process data recorded by CCTV cameras to ensure that we are always compliant with data protection law and best practice. This policy also explains the procedure to be followed for the submission of a data subject access request in respect of personal data captured by the CCTV surveillance systems operated by THE WATERFRONT HOTEL.
The policy applies to all guests staying at THE WATERFRONT HOTEL, staff and employees as well as on all other persons who may, from time to time, and for whatever purpose, enter the property for any reason whatsoever. The legal basis for our CCTV surveillance systems is the safeguarding of the legitimate interests of WATERFRONT HOTEL, its personnel and its property.
REASONS FOR THE USE OF CCTV
The key objectives of our CCTV surveillance systems are:
- To detect, prevent and reduce the incidence of crime or unwanted behaviour on our premises;
- To reduce and/or intercept incidences of vandalism and damage to the Premises or personal property;
- To enhance the feeling of personal safety and security;
- To enable the identification and subsequent apprehension and prosecution of offenders in relation to any crimes committed within the proximity of our premises.
RESPONSIBILITIES
It is the responsibility of THE WATERFRONT HOTEL:
- To ensure compliance with this Policy.
- To ensure that the operating procedures for all cameras are always complied with.
- To ensure that the purposes and objectives of all schemes are fulfilled.
- To coordinate the installation of the necessary signage to indicate that the property is under CCTV surveillance and that a CCTV scheme is in operation.
- To facilitate formal subject access requests of any images captured under the terms of the GDPR and Data Protection Act and other relevant legislation.
- To provide copies of this Policy when required to do so.
MONITORING
CCTV monitors are operated 24 hours a day and this data is continuously recorded. Camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring.
CCTV OPERATION
We ensure that signs are prominently always displayed in each surveillance zone on the property to notify individuals that their image may be recorded. These signs will include information about the Data Controller, the purpose of the surveillance system, and contact details for further information, especially if these details are not readily apparent to those being monitored.
Furthermore, we ensure that live feeds from cameras and recorded images are only accessed by authorised staff members whose responsibilities necessitate access to such data. This may involve senior management, security personnel, and HR staff involved in disciplinary or grievance procedures. Recorded images will only be viewed in designated, secure offices to maintain confidentiality and security.
DATA SUBJECT ACCESS REQUESTS
Data subjects may make a subject access request for CCTV images/recordings/information by applying in writing to the Data Protection Officer at dpo@water.mizzi.com.mt and must provide the following information:
- The date and time of the incident or their visit to the property, along with details relating to the specific location
- Proof of identity (containing a photograph).
THE WATERFRONT HOTEL will aim to provide access to CCTV images as soon as possible but will ensure it is provided within one month from receiving the written request.
THE WATERFRONT HOTEL will provide the information in a clear format that is easily understood and suitable for the requester’s needs.
THE WATERFRONT HOTEL may request further details to clarify the exact requirements prior to the start of the one-month period.
THE WATERFRONT HOTEL has the right to refuse a request for a copy of the data particularly where such access could prejudice the prevention or detection of crime or the apprehension or prosecution of offenders. If it is decided that a data subject access request is to be refused, the reasons will be fully documented, and the data subject informed in writing, stating the reasons within one month of the receipt of the request.
CCTV footage will be accessible by a restricted number of THE WATERFRONT HOTEL staff identified for this purpose.
CCTV footage will not be disclosed to any third party other than law enforcement authorities should this be required. No other third parties should have access to such data, unless with the express permission of the Data Protection Officer.
Use of CCTV systems for any reason other than that authorised in accordance with this policy is not permissible at any time or circumstance due to Data Protection purposes.
Furthermore, a data subject has the right to request THE WATERFRONT HOTEL to erase personal data or restrict processing, object to processing and the right to data portability by applying in writing to THE WATERFRONT HOTEL Data Protection Officer at dpo@water.mizzi.com.mt
RETENTION OF CCTV FOOTAGE
CCTV footage shall be retained for 7 days. In certain circumstances it may be considered appropriate to retain data for a longer period, a full risk assessment must be taken before deciding for a longer retention period.
COMPLAINTS PROCEDURE
Grievances and complaints regarding the operation of THE WATERFRONT HOTEL CCTV system must be made in writing and addressed to the Data Protection Officer at dpo@water.mizzi.com.mt.
Furthermore, a data subject has the right to complain to the Data Protection Commissioner about our processing activities, using the following contact details:
Office of the Information and Data Protection Commissioner
Floor 2,
Airways House,
High Street,
Sliema SLM 1549
Phone: (+356) 2328 7100
ONGOING REVIEW OF CCTV USE
We will ensure that the ongoing use of existing CCTV cameras in the workplace is reviewed periodically to ensure that their use remains necessary and appropriate, and whether such surveillance systems continue to address the needs that justified their introduction.
