1. Name of Register
Turun Seudun Vesi Oy’s CCTV register description
2. Controller
Turun Seudun Vesi Oy
Business ID: 0141915-3
Maariankatu 1, FI-20100 Turku, Finland
turunseudunvesi@turunseudunvesi.fi
3. Contact Persons for the Register
Joni Pirttisalo, Supervisor
Maria Nordström, Communications Specialist
Email: firstname.lastname@turunseudunvesi.fi
4. Content of Personal Data, Purpose and Legal Basis of Processing
4.1 Processed Data
The CCTV register description comprises CCTV recordings.
4.2 Purpose of Processing
The purpose of CCTV and the related register description is to protect property, prevent crimes and assist with the investigation of crimes that have already occurred.
CCTV is used to let employees work in peace, protect others present on the premises of Turun Seudun Vesi due to a customer or service relationship, improve occupational safety as well as guide and monitor the movements of employees and others on the site.
CCTV is also used for monitoring production processes, work spaces and equipment in order to ensure the smooth operation, safety and quality of processes.
4.3 Legal Basis
Pursuant to the GDPR, article 6, personal data may be legally processed only on the bases referred to within the article. The legitimacy of the security network’s personal data register is based on the aforementioned article, sections A and/or B (data subject’s consent and/or agreement).
4.3.1 Data Subject’s Consent
The data subjects or the representative of an external operator shall be notified of the existence of personal data registers as well as their purpose of use. New employees and external operators shall be notified of the registers at the latest during induction. Data subjects may grant their consent for registration either verbally or in writing.
4.3.2 Agreement
CCTV, the related register and the use of them are part of the company’s normal operations. By signing an employment contract, an employee is considered to have consented to being entered in the CCTV-related register and the register being used as described in this register description.
5. Personal Data Processors
Personal data is processed by the company’s own employees, provided that it is part of their job description, and the third party who maintains and services the system. As an exception, the data may also be processed by a government authority with the need and statutory right to do so.
As a rule, personal data is not disclosed or transferred outside the EU or EEA.
5.1 Own Personnel
The personal data is processed by the employees and supervisors of the control room of Turun Seudun Vesi as part of the surveillance and process monitoring included in their duties. In addition, the CCTV recordings may be processed by the company’s senior management, for instance, when investigating process deviations, accidents or near misses, vandalism or other crimes where there are legitimate grounds for processing.
5.2 External Party
The CCTV system is repaired, serviced and maintained by an external service provider. The employees of said service provider may process personal data, if it is necessary in order to perform the above tasks. For example, if the camera is damaged, the recording may help pinpoint the time it occurred.
The personal data may only be processed on the premises or server of Turun Seudun Vesi. The external party does not transfer or copy the data.
5.3 Authorities
The authorities, such as the police, may have a legal right to process personal data. The personal data in the CCTV system may be handed over to the police for a criminal investigation, for example.
6. Storage Period and Erasure of Personal Data
The CCTV recordings are stored for a maximum period of 90 days, unless there is a specific reason to do otherwise. Examples of specific reasons include retaining a recording as evidence in the case of a suspected crime or retaining a recording of a process for training or operational development purposes.
The data is erased by recording new data over it. Due to the structure of the CCTV system, the recording times vary.
7. Rights of Data Subjects
Data subjects have the right to view their personal data and request the immediate rectification of erroneous data. The request must be submitted to the contact person indicated in this register description or their deputy.
The data subject may make the request verbally, in writing or using some other suitable method. The controller shall have the right to request the data subject to issue the request in writing, such as in an email.
8. Right to File a Complaint with the Supervisory Authority
If the data subject considers the processing of their personal data to be in breach of local or EU laws or regulations, the data subject has the right to file a complaint with the local supervisory authority, such as the data protection ombudsman in Finland.
9. Principles of Securing the Register
All of the registers referred to in this description are stored on Turun Seudun Vesi’s own server. The server operates in a closed network and it can only be accessed from the locked and monitored premises of Turun Seudun Vesi.
The register can only be accessed by persons who need to process the data for work reasons.
The system is protected with a username and password. The control room and the operators working there use shared credentials; others use personal credentials. Exporting a recording from the system requires personal credentials.