CCTV system

What personal data are processed by the CCTV system and for what purpose? And what is the legal basis for this processing?

A CCTV system is installed within the internal and external premises of our organisation. In total, 18 outdoor and 45 indoor cameras are installed, which, due to their location, occupy the space in which patients, people close to patients, contractors and other third parties move. The areas occupied by the camera system are always properly and clearly marked. The cameras operate in a continuous mode.
Within the CCTV system we may process the following personal data: your appearance, gender, approximate age.
The reason for the processing of this personal data is our legitimate interest in protecting our rights and legitimate interests, in particular the protection of life and health of patients (e.g. falls), employees, as well as the public entering the premises of the Institute for the Protection of Human Rights, the protection of our property and yours, and the prevention of vandalism.

Who can see this footage and is it possible to transmit it abroad?

As a matter of principle, we manage your personal data from the CCTV system within the organisation. We only transfer data outside the organisation if required by law or if such transfer is necessary to investigate or prove incidents or violations that have occurred. In accordance with the previous sentence, camera footage may thus be transferred in particular to law enforcement authorities, administrative authorities or courts. In other cases, we will only pass on the data on the basis of your express consent.

How long and in what form do we keep the camera recordings?

Within the CCTV system, long-term and continuous recording of footage is also carried out. This footage is kept for a period of 5 days. It is then automatically overwritten by new footage and cannot be retrieved in any way. We only make a copy of the footage if it records an event that we need to investigate. We will keep this copy secure for as long as necessary to properly investigate such an event and, if legal proceedings are initiated in the matter, for the duration of such proceedings. We keep records in electronic form.

What rights do you have in relation to your personal data?

As a data subject, the law gives you a number of rights. As a subject who may be intercepted, you have a range of rights.

Right of access to personal data

You obviously have the right to know what data is being processed about you, for what purpose, for how long, where we obtained the data, whether and to whom we are transferring it. You also have the right to be informed of other rights relating to this data. This document is mainly intended to inform you, however, we are ready to provide you with confirmation or clarification on any point of this information.
If you ask us to do so, we will also provide you with a copy of the personal data processed without undue delay. We are entitled to charge a reasonable fee for this copy, particularly if it is requested repeatedly, in relation to administrative costs. If you make this request in electronic form, we will automatically assume that you are also interested in receiving the information in electronic form. However, you have the option to request it in another way. Please note that the right to obtain a copy of the personal data processed cannot adversely affect the rights of other persons. This includes the rights of persons who are captured in the same record.
Please also note that CCTV footage is only kept for 5 days. After that, they are deleted and your later request for a copy of the footage cannot be granted.

Right to rectification of personal data

In general, if you discover that the personal data we process about you is inaccurate or incomplete, you have the right to request that we complete or correct it without undue delay. However, it is not possible to comply with this right in relation to CCTV footage as it is technically impossible.

Right to restriction of processing of personal data

This right allows you to request, in certain cases, that certain of your personal data be marked and not further processed for a certain period of time. This is not the same as the right to erasure, as the restriction of processing is not permanent. You have the right to have us restrict the processing of your personal data if:

• you contest the accuracy of the data we process about you for the time necessary to verify its accuracy,
• the processing is without legal basis (e.g. beyond the data we are entitled to process) but you prefer to restrict the processing instead of erasing it, for example because you expect to provide us with the data in the future anyway,
• we no longer need to process your personal data but you require it for the establishment, exercise or defence of legal claims,
• you object to the processing (see the next point in the notice for this right).

If processing is restricted, the data may only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, whether natural or legal, or for reasons of important public interest.
Please note that the applicability of the right to restriction of processing is limited in relation to CCTV footage, in particular by the short-term processing.

Right to object to the processing of personal data

You can only exercise your right to object to the processing of personal data if we would process some of your personal data in the public interest or on the basis of our legitimate interest. If this happens, we will only continue to process your personal data if we can demonstrate compelling legitimate grounds for doing so (in particular, if we need it to establish, exercise or defend legal claims).
Please note that the applicability of the right to restriction of processing is limited in relation to CCTV footage, in particular by the short-term processing of CCTV footage.

Right to complain to a supervisory authority

The exercise of the rights set out so far is without prejudice to your right to lodge a complaint with the Data Protection Authority using the contact details set out at the beginning of this document. You can file a complaint at any time when you have doubts about whether your personal data is being processed as it should be, i.e. unlawfully or in breach of the law.

Right to erasure

In some cases, as a data subject, you also have the right to have your personal data erased. We generally delete your personal data when we no longer need it and have no legal basis for processing it. After exercising your right, the video recording will be deleted unless there is an overriding legitimate interest on our part, consisting in particular in the establishment, exercise or defence of legal claims.

How can I exercise individual rights?

For all matters relating to the processing of your personal data, whether it is an enquiry, exercising a right, making a complaint or otherwise, you can contact our Data Protection Officer in the following ways:

• by post or in person at U Nemocnice 1, 128 00 Prague 2,
• by e-mail at poverenec@uhkt.cz,

We will process your request without undue delay, but within a maximum of one month. In exceptional cases, in particular due to the complexity of your request, we are entitled to extend this period by a further two months. We will, of course, inform you of any such extension and the reasons for it.