1. Introduction
Closed-Circuit Television (CCTV) Monitoring Equipment is used by Portomaso Casino and Oracle Casino for a number of purposes and will be used in accordance with the terms set out in this document. This use may involve the surveillance of individuals, the recording of personal data of individuals, including their recognisable images.Recognisable images captured by CCTV systems are personal data and are therefore subject to the provisions of the General Data Protection Regulation (GDPR) and the Data Protection Acts Chapter 586 of the Laws of Malta, [hereafter referred to as “data protection legislation”].
2. Purpose
Tumas Gaming has developed a number of general policies and procedures to protect personal data. Provisions contained in these documents apply to the operation of the CCTV systems by Tumas Gaming The purpose of this policy is to support these documents by outlining specific provisions to assist Tumas Gaming to fulfil its legal obligations regarding the operation of CCTV systems including, but not limited to, arrangements relating to the location, control and security of CCTV systems, recording by CCTV systems and access to their recordings.
The aim is to ensure that CCTV is used transparently and proportionately in accordance with data protection legislation, the Group’s Data Protection Policy and guidance provided by the Data Protection Commission.
3. Scope
This policy relates directly to the location and use of CCTV and the monitoring, recording and subsequent use of such recorded material This policy applies to:
• All use of CCTV that involve the recording of personal data;
• All employees of Tumas Gaming;
• All CCTV service providers contracted by Tumas Gaming.
The Controller of the data for the purposes of this policy is Tumas Gaming.
4. Legal Ground
We are processing CCTV data generally without your consent in pursuit of our legal obligation and legitimate interests to provide such a service and to protect the general interests and wellbeing of our data subjects.
5. Definitions
In this policy, the following words shall have the following meanings:
“Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
“the Data Protection Regulations” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“the Law” means all or any of:
(a) the Data Protection Regulation,
(b) Directive. (c) Chapter 586 of the Data Protection Act of Malta
“data controller”, “data processor”, “data subjects”, “personal data”, “process”, “processed”
and “processing” shall have the meanings respectively, as defined in the GDPR.
Note that “process” and “processing” are defined to include simple events like receiving data into our system or storing it. Processing is not limited to “doing something with it”.
“Casinos” means the casinos of Tumas Gaming, namely Portomaso Casino, located at Portomaso Casino, Level -1 Portomaso Business Tower, St. Julians, STJ4011 Malta, And Oracle Casino located at Oracle Casino, Isle Promenade, Qawra, SPB 2508, Malta.
6. Purpose of CCTV
Data obtained through the use of CCTV systems shall be limited and proportionate to the purposes for which it was obtained.
The company uses CCTV for the following purposes.
• Safeguarding of all persons and property located on company premises and its environs.
• Assist in the prevention and detection of crime or disorder;
• Reduce the fear of crime or disorder;
• CCTV footage may be used in the context of disciplinary proceedings involving employees (to protect the vital interests of Tumas Gaming, employees, customers and affected individuals);
• Securing public order and safety by facilitating the deterrence and detection of anti-social behavior.
CCTV footage is not disclosed to third parties except where disclosure is required by law (such as for the purpose of preventing, detecting or investigating alleged offences) and in such instance’s disclosure is based on a valid request.
CCTV will not be used by Tumas Gaming for any other purposes other than those outlined inthis policy document.
7. CCTV Locations
CCTV will be deployed on gaming devices and access points and on the areas which is directly connected to them within the area of the Casinos.
CCTV will not be deployed where persons have a reasonable expectation of privacy.
Cameras shall be positioned in such a way as to prevent or minimise recordings of persons or property other than those that are intended to be covered by the CCTV system.
8. CCTV Signage
Signage indicating that CCTV is in use is displayed prominently throughout the property and includes the following information:
• Notice that CCTV is in operation.
• Details of who to contact regarding the CCTV system.
9. CCTV Retention
Data recorded on CCTV systems shall be kept for no longer than is considered necessary.
Normally data recorded on CCTV systems will not be retained by the Company beyond a maximum of 30 days in case of gaming devices and access points. Data recorded on the other areas which fall out of the scope of the gaming laws will be retained no longer than 14 days after the time of recording.
After this time, they are safely deleted. When footage is used in conjunction with an investigation or as evidence, recordings may be retained by request specifically in that context until the issue is resolved. After this period, images are safely deleted.
10. Security Arrangements for CCTV
For reasons of security and confidentiality, access to the CCTV Monitoring equipment is restricted. Only those members of employees, who are trained to it will be allowed to operate any of the equipment.
Employees will be specifically selected for the role and will be trained in the use of the equipment. Each employee will be personally issued with a copy of this policy. They will be fully conversant with the contents of this document, which may be updated from time to time, and which he/she will be expected to comply with at all times. Surveillance shall be conducted by a trained employee. An authorised employee will be present at all times when the monitoring equipment is in use. Camera operators shall act with utmost probity at all times and be mindful of exercising prejudices which may lead to complaints of the system being used for purposes other than those for which it is intended. Footage shall not be copied (e.g. by using a mobile phone).
Unauthorised access by employees is prohibited. Managers should enforce this requirement at all times and with due care.
Public access to the designated location of the CCTV surveillance equipment will be prohibited except for lawful, proper and sufficient reasons and only with the authority of a Manager.
11. Rights of Data Subject
Data subjects have the right:
• where applicable, to request access to their personal data relating to them as well as the right
• where applicable, erase any inaccurate, incomplete or immaterial personal data;
• to request restriction of processing;
• to object against processing and
• to request data portability for the data held by Tumas Gaming.
If you consider that the processing of your personal data is carried out in an unlawful manner, you may lodge a complaint with the Information and Data Protection Commissioner.
12. Access by Data Subjects
Data protection legislation provides data subjects with a right to access their personal data. This includes their recognisable images and other personal data captured by CCTV recordings. Access requests are required to be submitted in writing in physical or electronic format e.g. by letter or e-mail and will be processed in accordance with provisions contained in corresponding procedures of Tumas Gaming. Requests must include the date, time and location where the CCTV image was recorded. ID may be required. Where it is deemed necessary or appropriate Tumas Gaming may request the provision of additional information to confirm the identity of person submitting a data subject access request. The CCTV administrator aims to respond promptly and at the latest within one month of receiving a valid request.
It would not suffice for a data subject to make a general access request for a copy of CCTV recordings. Instead, it will be necessary that data subjects specify that they are seeking to access a copy of CCTV recordings that have captured their recognisable images and/or other personal data between specified dates, at certain times and at specific areas.
The provision of access to a data subject to CCTV recordings of his/her recognisable images and/or other personal data will normally involve providing a copy of the recording in video format. In circumstances where the recording is technically incapable of being copied, or in other exceptional circumstances, stills may be provided as an alternative to video footage.
Where recognisable images and/or other personal data of other parties other than the data subject appear on the CCTV recordings, footage can only be provided to data subjects in case it is pixelated or otherwise redacted on any copies. Alternatively, unedited copies of the CCTV recordings may be released provided consent is obtained from those other parties whose recognisable images and/or other personal data appear on the CCTV recordings.
If the CCTV recording is of such poor quality as to not clearly identify recognisable images and/or other personal data relating to the data subject, then the recording will not be considered as personal data and may not be released by Tumas Gaming.
If the CCTV recording no longer exists on the date when Tumas Gaming receives an access request, it will not be possible to provide access to a data subject. CCTV recordings are usually deleted in accordance with provisions contained in this policy.
Concerns regarding access to one’s own personal data in CCTV footage can be raised with the Data Protection Officer (provacy@tumasgaming.com). Individuals also have the right to submit a complaint to the Information and Data Protection Commission.
13. Access by authorised employees of Tumas Gaming
There is a distinction between a request to view CCTV recordings and to obtain copies thereof. In general, a request made by the authorized employee to simply view CCTV recordings should be accommodated as it does not raise any concerns from a data protection perspective.
In order to expedite a request in urgent situations, a verbal request from the Surveillance manager for copies of CCTV recordings will suffice. However, such a verbal request must be followed up with a formal written request from the Surveillance manager.
14. Access by Other Third Parties
Access by third parties such as public bodies, private organisations and individuals other than the data subject to CCTV recordings will only be provided in circumstances that are permitted by data protection legislation.
14.1 Requests by the Police
Access requests by the law enforcement shall be processed where such processing is necessary and proportionate for preventing, detecting, investigating or prosecuting criminal offences. Requests are handled by the CCTV administrator. Verbal requests are sufficient to allow for the viewing of the footage, however, copies of footage must always be given against a formal written request by the Police.
A log is maintained of all requests by the CCTV Administrator.
14.2 Other Third-Party Access
Disclosure of information to other third parties is made in strict accordance with the purposes of the system and is limited to the following authorities:
- CCTV administrators and specific Management in Buildings & Estates
- Members of Senior Management involved with corporate grievance, disciplinary or dignity at work procedures
- Legal or insurance representatives of data subjects (with written consent of data subjects)
- Insurers/assessors
- In exceptional cases, to others to assist in the identification of a victim, witness or perpetrator in relation to a criminal incident
- CCTV companies for service/repair and to pixelate images
15. Access Log
An Access Log shall be maintained by the Casinos. This log shall maintain a record of all requests made by the following to view/obtain copies of CCTV recordings and the outcome of such requests:
• Data Subjects;
• Authorized employees of Tumas Gaming;
• Other Third Parties.
16. Data Protection Impact Assessment
A Data Protection Impact Assessment shall be carried out, in accordance with data protection legislative requirements, before any installation of a new CCTV system or an upgrade to an existing CCTV system if, in the opinion of Tumas Gaming, the installation or upgrade is likely to result in a high risk to the rights and freedoms of individuals.
Supporting Policies, Procedures & Guidelines
The company shall adhere to all relevant CCTV Guidelines/Codes of Practice issued by the Information and Data Protection Commissioner and/or other statutory bodies.
Monitoring and Review
Provisions contained in this policy document shall be subject to on-going monitoring and review.
Complaints to the Information and Data Protection Commissioner
Data subjects may make a complaint to the Information and Data Protection Commissioner in the following circumstances:
If they experience a delay outside of the prescribed timeframe for making a decision on an access request or if they are dissatisfied with a decision by the Casinos on their access request.
If they consider that Tumas Gaming`s processing of their personal data is contrary to their data protection rights.
Address:
Triq Il-Kbira, Tas-Sliema SLM 1549, Malta. +356 2328 7100 · idpc.info@idpc.org.mt.
