Helping heads to make sure school CCTV is compliant

Closed-circuit television (CCTV) cameras are increasingly used in schools across Ireland, aiming to enhance the safety and security of students, staff and visitors. However, CCTV footage also contains personal data that needs to be handled in compliance with privacy legislation, including the EU’s General Data Protection Regulation (GDPR).

Indeed, given the nature of what they are recording, schools arguably have unique responsibilities when it comes to managing CCTV footage, but the right partnership can keep schools data compliant.

Orla Cafferty, chief executive officer of Datascan Redaction Services, said that her company offers a service to principals when a data access request comes in.

“Our biggest group of customers at the moment is secondary schools. It might be two lads fighting in the corridor, perhaps pushing and shoving,” she said.

This is a key difference in what CCTV is used for, and how it must be approached. As a result, Datascan offers a special redaction service to keep schools in compliance with all relevant regulations.

“We have been working with educational institutions for some time now and have noticed a key difference between commercial and educational data access requests,” Cafferty said.

“Generally, in say retail premises, shopping centres and hospitality venues, requests for access to CCTV footage relate to personal injury claims, or claims relating to harassment or discrimination of some nature due to refusal of entry to a venue,” she said.

In this context, CCTV can provide vital protection for the school, its staff and its pupils.

“In a convenience store or hotel, people might injure themselves or be accused of stealing – those would be typical requests in those environments. In a school, however, we have yet to really see that. It tends to be about bullying or harassment,” she said.

Any footage of an incident must be redacted or pixelated in two different versions, with each set of parents only receiving the footage showing their own teenager.

Recent news stories demonstrate that school principals and boards of management will need to be prepared to be more frequently asked to provide footage of incidents taking place on the school premises. Key to this, however, is properly redacting the footage.

“The school will contact the parent and say, ‘Johnny was fighting with Tommy.’ There will then be two versions of the footage, one for each family, with the other child, and any bystanders, blurred out,” Cafferty said.

From the school’s point of view, the process is automated and does not require a visit from Datascan.

“It’s a completely digital process: the school principal is generally the data controller and they will contact us, and upload the footage into an encrypted cloud, and we work on it to show the parents, the board of management, or the courts if necessary,” she said.

Cafferty said that, as a rule, schools were well aware of their responsibilities. Indeed, since the implementation of the GDPR in 2018 many organisations such as schools and colleges have become more conscious of handling requests for access to CCTV footage in a compliant manner.

“Schools are pretty good at understanding GDPR. In fact, people are more and more aware of it. Generally, anyone who is putting in CCTV should be up to date on GDPR. The big concern out there is the retention of the data,” she said.

A typical CCTV system will be on a 30-day rolling retention period, continually recording and feeding back information until it gets overwritten, she said, so as a result, requests have to be made in a timely manner.

The bigger picture, however, is that schools are doing more and more to be safe environments for everyone in them and, at the same time, are faced with new challenges.

“Schools are more and more aware of the need to tackle bullying,” Cafferty said.

Recent outbreaks of bullying made it into national news via social media, and while filming is often by students using mobile phones, it has made both parents and schools more aware of what is at stake.

One issue that has come to Datascan over the last while is the temptation for the school to refuse access to the CCTV footage, but this is another approach that could put school management on the wrong side of the GDPR: it is important that a school responds to a Subject Data Access request for CCTV footage within the 30 days mandated by the regulation.

“There was a lot of talk asking, ‘Why didn't the school handle this?’ There’s a lot of handling of video footage, but there will be more and more pressure on principals to provide any footage they have,” Cafferty said.

This is where Datascan can step in with its compliant redaction service and protect all parties involved.

“We can give support to the principals to, ultimately, support the students, staff and parents,” she said.