Code of Practice

A. Signage

The presence of CCTV on Campus will be brought to the notice of the University community and the public by prominent and appropriate signage.

CCTV Privacy Notice should be posted in a prominent public place, including entry points and receiving areas.

CCTV Consent Notice should be posted to all receiving areas near or on the logbook or e-logbook where visitors log their information with a security guard or receptionist.

B. Recording, storage, and retention of images

Recording system records digital images, any CCTV Images and Video recordings recorded at CMU are stored digitally in CMU Data Center. CCTV images that are held on the hard drive of a PC or server are deleted and overwritten on a recycling basis and, in any event, are not held for more than 30 days. Once a hard drive has reached the end of its use, it will be securely erased prior to disposal.

C. Access to monitors, control room, and monitoring equipment

Monitors may be used in public display areas for notification that the area is under CCTV surveillance and as a deterrent. Unless specifically designed for the foregoing purposes, access to monitors will be restricted to persons authorized to view those images.

All CCTV recording equipment will be located within the secured area and not accessible to unauthorized personnel.

Access to the Security Control Room will be restricted to authorized persons.

D. Access to and disclosure of images/footage

Disclosure to the third parties is prohibited, unless, otherwise, the disclosure conforms to Section 12 (Criteria for Lawful Processing of Personal Information) of the Data Privacy Act of 2012.

Access to the CCTV System and to the captured Images and Video recordings will be restricted to the University President, Vice President for Administration and authorized staff involved in monitoring or investigation.

Viewing or disclosure of footages of particular incidents based on the legitimate interest of the third party should be limited to the following:

1. The specific date of the incident;
2. Particular time and duration of stay of the data subject in the establishment;
3. If there are several CCTV cameras being operated, viewing only of the camera positioned at the precise location of the data subject during the incident;
4. Viewing only by the data subject, and other persons permitted by the data subject.

Images and Video recordings were taken from the CCTV system will be fully documented in a register and securely stored.