London Business School CCTV policy

1.1 This policy sets out the purpose, use and management of closed-circuit television (CCTV) and body-worn cameras (BWC) at London Business School (the ‘School’/’LBS’).

1.2 The purposes of the CCTV installations and BWC are to::

• Ensure the safety, wellbeing and security the employees, Faculty, students, alumni, contractors (LBS Community), visitors and members of the public,

• Deter, prevent and detect anti-social behaviour, crime or misconduct

• Apprehend and prosecute offenders, using images, recordings and/or data as evidence in criminal or civil proceedings)

• Assist in the investigation of actual or suspected security incidents and complaints or support LBS disciplinary or legal proceedings.

• Monitor of the security of the premises

• Monitor and enforce traffic-related matters

• Protect School property and the property of third parties working on behalf of the School.

• Provide accountability and transparency around security staff actions and interactions with the LBS-community, visitors and members of the public.

1.3 The principles of this policy are that:

• Individuals' rights are respected and protected,

• CCTV installations and BWC are operated fairly and within the law,

• CCTV system and BWC are operated for the purposes for which they were set up,

• Images and recordings/data stored is fairly and lawfully processed

• Images and recordings/data is adequate, relevant and not excessive for the purposes

• Images and recordings/data is accurate, securely stored, and not kept for longer than is necessary

1.4 This policy and its operations will be subject to regular reviews, no less than every three years.

1.5 CCTV and body-worn camera images and recordings that show a recognisable person are considered personal data and are protected by UK Data Protection law. This Policy is linked to the London Business School Data Protection Policy, which must always be followed.

1.6 The School’s CCTV system and BWC are necessary to pursue the legitimate interests of the School or third parties working with the School.

1.7 This policy does not cover the use of conventional cameras, video and audio streaming devices, including mobile devices, laptops etc used for the purposes of teaching and/or learning (i.e. the recording of lectures, training programmes or workshops), communication or research activities.

1.8 The School Head of Security is responsible for the daily operation of the system and body-worn cameras and ensuring compliance with this policy.

1.9 In using and managing the use of CCTV and BWC, the School will have due regard to relevant UK data protection and privacy laws including: Assimilated Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) (together referred to as the ‘Data Protection Law’), and related laws including but not limited to the Human Rights Act 1998.

1.10 For the purpose of this policy a ‘live security incident’ refers to an ongoing or active event that threatens the safety and security of physical assets, facilities, or personnel. This can include unauthorised access, theft, vandalism, or any other situation that requires immediate response to protect people and property

2.1    The CCTV system includes approximately 275 cameras distributed across 18 buildings. The system installation comprises fixed position cameras; pan tilt and zoom cameras; monitors; multiplexers; digital recorders and public information signs and any ancillary equipment required for the operation of the installation (e.g. cabling, printers, power supplies).

2.2    The CCTV system is operated 24 hours a day, 7 days a week. 365 days per year. CCTV cameras are located at strategic points on School premises, principally at the entrance and exit point of buildings and along corridors.

2.3    The BWC equipment comprises approximately 7 portable high-definition recording camera devices which can record both footage and audio.  It includes secure cloud data storage, charging stations, and replaying equipment.

2.4    BWC are assigned to members of the School’s contracted security personnel who patrol strategic points on School premises, including entrances, exits, and high-traffic areas. 

2.5    BWCs will only be activated by security personnel during a live security incident, or similar situation. Security personnel will give prior warning to individuals before switching on the device to document the situation and ensure proper response and assistance.  This warning is: “I am wearing a body camera and I am now recording video and audio”.

2.6   Although every effort has been made to ensure the maximum effectiveness of the CCTV installation and BWC, it is not possible to guarantee that they will detect every live security incident taking place within the area of coverage.

2.7   The School’s contracted security company has authority to operate the CCTV installations and BWC equipment and will ensure compliance with this policy and the Data Protection Act 2018.

3.1 The CCTV system and BWC are owned by the School.

3.2 The Head of Campus Services is responsible for the management and operation of the system. The Head of Security (or other nominated individual determined by the Head of Campus Services’) is authorised to manage day-to-day operations and ensure strict compliance with this policy.

3.3 The School’s DPO has ensured this policy complies with the Data Protection Act 2018. For any Data Protection queries please email: dpo@london.edu.

4.1 Monitoring Images and recordings captured by the School’s CCTV and BWC will not be monitored on continuously. These monitors are located within the security office in the North Building and at the Sammy Ofer Centre. These monitors will be positioned so that they are only viewable by members of the security team.

Requests to restrict or object to the processing of personal data captured by CCTV and/or BWC, which may be deemed to cause substantial and unwarranted damage to an individual, must be made to the Senior Data Privacy Manager (in the first instance) or the School’s DPO. The Senior Data Privacy Manager (or the DPO) will liaise with the Head of Security to determine whether the request should be complied with.

4.2 Employee Training The Head of Security will ensure that contracted security personnel and any nominated LBS employees handling CCTV and/or BWC images or recordings receive training on the operation and administration of the CCTV installation and BWC equipment.

4.3 Covert Recording The School will only undertake covert recording with the written authorisation of the School’s DPO and School Secretary, where:

• Informing the individual(s) concerned that the recording is taking place would seriously prejudice the reason for making the recording.

• There is good cause to suspect that an illegal or unauthorised action(s) is/are taking place or about to take place.

Any such monitoring will only be carried out for a limited and reasonable amount of time consistent with the objectives of the monitoring, and only for a specific unauthorised activity.

All such occasions will be fully documented showing who made the decision to use covert monitoring and why.

4.4 Maintenance and Quality of Images The CCTV system and BWC will be regularly checked to ensure that they meet their original purposes for use.. Images and/or recordings produced by the recording equipment must be as clear as possible in order that they are effective for the purpose for which they are intended and the date and time stamp recorded on the images is accurate.

4.5 Images and Recording Usage, Retention and Disposal All images and recordings will be held securely on the School’s network and can only be accessed by the Head of Security (or their nominated individual).

Recordings from BWC devices will be downloaded from the portable device at the end of each shift. No recordings are left on any BWC device after they are downloaded.

Unless required for evidential purposes or the investigation of crime or otherwise required by law, recorded images and/or footage will be retained for no longer than 30 days from the date of recording. If images or recordings are requested to be retained for a longer period of time they will be stored securely in a restricted area in the Security Teams S Drive or Sharepoint site until needed and then erased once the request has been dealt with.

After 30 days (or at the end of their useful life if images and recordings are retained for longer than the retention period identified above) all footage held on separate devices for evidential purposes will be erased and securely disposed of.

4.6 Signage The public and School community will be made aware of the presence of the CCTV and BWC by appropriate signage and which sets out the purposes for processing the CCTV and BWC images and recordings and identifies the School as the party responsible for processing those images and/or recordings.

4.7 Breaches Any breaches of this code by employees monitoring the system or who have access to the monitored images may constitute matters of discipline under the relevant conditions of employment.

5.1 Personal access Data Protection law gives individuals the right to access personal information about themselves, including access to CCTV and BWC recorded material, including footage, images and/or audio. They also have the right to request that their personal data is erased without undue delay in certain circumstances.

5.2 Third Party Access Disclosure of recorded material will only be made to third parties when accompanied by proof of identity and in strict accordance with the purposes of the system and is limited to the following:

• Police and other law enforcement agencies where the images recorded could assist in a specific criminal enquiry and / or the prevention of terrorism and disorder

• Prosecution agencies

• Appropriate employees of the School in the course of employee, student or alumni disciplinary proceedings (including prospective proceedings) or investigations to ensure compliance with the School’s regulations and policies as determined by the School Secretary or their nominated representative

• Appropriate legal representatives as determined by the School Secretary or their nominated representative

5.3 Requests Any requests, by individuals or third-parties, for access to or copies of images and/or recordings must be made in writing and addressed to the Senior Data Privacy Manager at dpo@london.edu who will process the request in accordance with the procedure contained within the School’s Data Protection Policy.

The request must detail the following:

1. The Requester Information:

• Name:

• Contact Number:

• Email Address:

2. Incident Details:

• Date of Incident:

• Time(s) of Incident:

• Location of Incident:

• Description of Incident:

3. Purpose of Request: the reasons for the request

4. Additional Information: any additional information to assist the security team identify the right recording.

5. Access to Information

• Who needs to view footage, if external, their full name and contact details are required.

All requests should be made as soon as practically possible to ensure images and recordings are not erased in line with the retention schedule (see section 4.5 above). If these images or recordings have been retained a copy (or a viewing) will be made available.

For further information relating to the processing of CCTV and/or BWC images and recorded material by London Business School, please contact:

Senior Data Privacy Manager London Business School Regent's Park London NW1 4SA

Email: dpo@london.edu

For further information about individuals' rights in respect of the protection of personal data please contact the Information Commissioner’s Office (ICO):

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113 Email options: www.ico.org.uk/global/contact-us/

Website: www.ico.org.uk/

We may change this policy from time to time. If there are any significant changes to the way we manage your data, we will notify you.

This policy was last updated on 24 March 2025