This procedure aims to outline and clarify the obligations of the Data Controller regarding the processing of personal data through video recordings obtained from surveillance systems, in compliance with the requirements of the General Data Protection Regulation (GDPR). The document contains the general rules for collecting personal data through video surveillance, applicable to St. George International School and Preschool which acts as a Data Controller under the meaning of Regulation (EU) 2016/679 on the protection of personal data. Data from video recordings constitutes personal data under the meaning of the GDPR, with St. George International School and Preschool acting as the Data Controller, and the physical individuals as Data Subjects. The activity is carried out by the Security Manager in their capacity as the Data Processor for the Controller.
RESPONSIBILITIES
The accountability for the processing of personal data in relation to video surveillance, including activities to ensure transparency in processing and compliance with other GDPR requirements, lies with George International School and Preschool. This responsibility is overseen by the Data Protection Officer (DPO) of St. George International School and Preschool, with the assistance of individuals who have access to the camera recordings. In cases of a complex structure with multiple sources of video surveillance within the organisation, additional employees with appropriate job qualifications may be designated to assist the activities of the Data Protection Officer.
PROCEDURE PROGRESSION
1. Video Surveillance as an Activity for Processing Personal Data
1.1. St. George International School and Preschool acknowledges that video recordings obtained from surveillance systems constitute a personal data processing activity, as such recordings contain information capable of identifying the physical identity of the recorded individuals, as per the GDPR. Video surveillance represents a technical method of processing personal data, requiring adherence to GDPR provisions related to personal data processing.
1.2. In this regard, personal data stored in recordings generated by surveillance systems are documented and included in the personal data processing activity registers within the organization of St. George International School and Preschool, under the category “Video Surveillance.”
1.3. The basis for processing personal data is the legitimate interest of St. George International School and Preschool to protect its employees and assets, as well as to prevent, deter, manage, and investigate security-related incidents, unauthorized access, attacks, or other threats, and to safeguard the lives and health of students and individuals present on the school premises.
1.4. St. George International School and Preschool employs a local video surveillance system. The system operates continuously, 24/7. In most cases, the image quality allows for the identification of individuals within the camera's range. The system records digitally and includes motion detectors. No high-tech or intelligent surveillance systems with enhanced identification and data recording capabilities are used.
1.5. Cameras are installed at various locations on the premises of the Data Controller – St. George International School and Preschool. The placement of the cameras is carefully assessed to ensure that areas irrelevant to the intended purposes are minimally covered.
1.6. Access to the data is limited to specific employees performing their official duties and the Data Protection Officer (DPO). Access is restricted to a small number of designated individuals based on the “need-to-know” principle. These individuals include the Security Manager, the DPO, the CEO, the Head of School, Head of Primary, Head of Secondary, Stage Liders, and class teachers. All employees with authorised access, including outsourced security personnel, undergo safeguarding and data protection training. Training is provided for new employees and through periodic seminars or workshops.
1.7. In certain cases, collected data, including video recordings, may be disclosed to third parties. Such disclosure may occur in the following scenarios:
(1) To legal advisors and other partners of St. George International School and Preschool in relation to the protection of the company’s legal claims.
(2) To competent state authorities for investigations, inspections, or other overriding public interests.
(3) In cases of mergers or acquisitions, where data may be shared with the new owner(s).
In all cases, personal data will not be shared with third parties located outside the European Economic Area (EEA).
2. Notification of Individuals Regarding Video Surveillance
2.1. In compliance with the right of individuals to be informed about the processing of their personal data, St. George International School and Preschool undertakes to notify individuals about the purposes of video surveillance, the retention period of the recordings, the intended use of the data, who will have access, the third parties to whom data may be disclosed, as well as the individuals’ rights to access recordings related to them and to object to the processing of their data.
2.2. Since video surveillance may involve the processing of personal data from an indeterminate group of individuals, the aforementioned obligations are fulfilled through information boards displayed prominently on the premises of the School.
3. Rights of Data Subjects in Connection with the Collection of Personal Data Through Video Surveillance Systems
3.1. St. George International School and Preschool ensures that data subjects whose personal data has been collected through the video surveillance system are informed of their data protection rights, which include:
The right to information; The right to a copy of their data (right of access to personal data relating to them); The right to rectification of personal data; The right to erasure (the right to be forgotten); The right to object to the Controller; The right to lodge a complaint with the supervisory authority for data protection (the Commission for Personal Data Protection) if they believe their rights have been violated; The right to object to the processing of their data through video surveillance. 3.3. Any information regarding their rights or other issues related to personal data protection can be obtained by contacting the Data Controller.
The contact details for St. George International School and Preschool are as follows:
Address: 47 Nikola Vaptsarov Blvd., Sofia, Bulgaria
Phone: +359 899 992 866
Email: gdpr@stgeorgeschool.eu.bg
Website: www.stgeorgeschool.bg
The contact details for the Data Protection Officer (DPO) are as follows:
Address: 47 Nikola Vaptsarov Blvd., Sofia, Bulgaria
Contact Phone: +359 899 992 866
Email: gdpr@stgeorgeschool.eu
Contact Person: Nadezhda Shemshirova
The contact details for the Commission for Personal Data Protection (CPDP) are as follows:
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Information and Contact Center Phone: +359 2 91-53-518
Email: kzld@cpdp.bg
Website: www.cpdp.bg
4. Technical and Organisational Measures
4.1. St. George International School and Preschool,undertakes the obligation under Article 32 of the GDPR to implement adequate technical and organizational measures to protect the processed data from accidental or unlawful destruction, accidental loss, unauthorised access, alteration, dissemination, and other unlawful forms of processing.
4.2. To this end, an analysis is carried out following these steps:
Determining the necessity for video surveillance. Considering the requirement to minimize the collection of personal data and the high likelihood of collecting sensitive personal data through video surveillance systems, the controller must first assess whether the collection of personal data through such technical means is necessary.
Defining the scope of camera recordings and the types of data subjects affected.
Evaluating existing technical and organizational measures. Assessing the measures currently in place at St. George International School and Preschool to protect personal data and determining whether and to what extent they meet the requirements of the regulation.
Identifying individuals with access to the recordings.
5. Retention Periods
5.1. Video surveillance recordings are retained for a period of up to 14 days. Upon expiration of this period, the images are deleted in the same order in which they were recorded in the system. In the event of a security-related incident, the relevant recording may be retained beyond the usual retention period for as long as necessary to conduct further investigations of the incident.
This procedure is part of the internal documentation of St. George International School and Preschool.
In accordance with the requirements of the GDPR, St. George International School and Preschool employs other policies, procedures, and documents alongside this procedure to ensure the security and protection of personal data in its activities.
