CCTV Privacy Policy

Welcome to the Blanchardstown Centre CCTV Privacy Notice. To protect our visitors and our tenants, Blanchardstown Centre operates a 24/7 CCTV and bodycam system (the “Security System”). The purpose of this Privacy Notice is to inform you as to how we look after your personal data when you visit Blanchardstown Centre.

This Privacy Notice is provided in a layered format so you can click through to the specific areas set out below.

1. IMPORTANT INFORMATION AND WHO WE ARE
2. THE DATA WE COLLECT ABOUT YOU
3. HOW IS YOUR PERSONAL DATA COLLECTED?
4. HOW WE USE YOUR PERSONAL DATA
5. DISCLOSURES OF YOUR PERSONAL DATA
6. INTERNATIONAL TRANSFERS
7. DATA SECURITY
8. DATA RETENTION
9. YOUR LEGAL RIGHTS

1. Important information and who we are

1.1 Controller
This Privacy Notice is issued by Falcon AM Limited for and on behalf of Blanchardstown Centre as the data controller responsible for processing your data. When we mention “Blanchardstown Centre”, “we”, “us” or “our” in this Privacy Notice, we are referring to Blanchardstown Centre. If you have any questions about this Privacy Notice, including any requests to exercise your rights, please contact us at datacontroller@blanchardstowncentre.com.
You have the right to make a complaint to a data protection supervisory authority at any time. The Data Protection Commission (“DPC”) is the Irish supervisory authority and can be contacted at info@dataprotection.ie. We would, however, appreciate the chance to deal with your concerns before you approach the DPC or another data protection supervisory authority so please contact us in the first instance.
1.2 Changes to this Privacy Notice
We keep our Privacy Notice under regular review and we will place any updates on this web page. We advise you to review this page regularly to stay informed and to make sure that you are happy with any changes. This Privacy Notice was last updated on 2 February 2023 and is published in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. The data we collect about you

The Security System consists of 235 internal and external cameras on the premises which are operational 24 hours a day, seven days a week, and six dormant bodycams which are operated by security officers in aggressive situations.
We have grouped the categories of personal data collected, used, stored and transferred through the Security System as follows:
• CCTV Data: The Security System captures video images from 235 internal and external CCTV cameras on the premises. CCTV cameras are located on the malls, service corridors, service yards, car parks, retail parks and roads. CCTV cameras are not located in any public toilets, staff toilets, locker rooms, canteens or management offices. The CCTV system is operational 24 hours a day, seven days a week, and collects still images and video recordings only. No audio is ever recorded.
• Bodycam Data: The Security System includes six bodycams operated by security officers. Bodycams are usually dormant (i.e. not recording any personal data), however they may be deployed in the event that a security officer is called to an aggressive situation, or when a situation becomes aggressive either verbally or physically. Bodycams capture both video and audio recordings.
The Security System does not include any specific technical features, such as the use of facial recognition software, which involve the processing of biometric data, or the processing of any other personal data considered to fall within the Special Categories of Personal Data under Article 9 GDPR.

3. How is your personal data collected?

CCTV Data will be collected directly when you enter any area of the premises covered by the Security System, such as the malls, service corridors, service yards, car parks, retail parks and roads.
Bodycam Data will be collected only when the bodycam is deployed by a security officer. Your personal data will only be collected by the bodycam if you are involved in or in close proximity to an aggressive situation. Security officers will always warn individuals when the bodycam is about to be switched on, and once again when the bodycam has begun recording.

4. How we use your personal data

We will only use your personal data when the law allows us to. We collect, store, use and transfer CCTV Data and Bodycam Data for the following purposes:
• Assisting in the prevention and reduction of potential fraud, crime, public disorder, and anti-social behaviour on the grounds of Blanchardstown Centre.
• Assisting in the identification of victims and witnesses of potential anti-social or criminal behaviour on the grounds of Blanchardstown Centre.
• Assisting in the identification of victims and witnesses of potential accidents and incidents for the purpose of defending Blanchardstown Centre against public liability / personal injury claims.
• Supporting and assisting in the management and safety of Blanchardstown Centre’s retailers, visitors, employees, support staff, etc.
• Supporting and assisting in the management and safety of public events in Blanchardstown Centre.
• Protecting Blanchardstown Centre’s buildings and internal infrastructure.
In all cases, we rely on our legitimate interests in securing our premises, supporting workplace safety management, and aiding in the prevention and detection of crime as our legal basis for processing your personal data through the Security System, except where we are required to share such data to comply with a legal obligation, such as responding to a subpoena, search warrant or court order, or a request from An Garda Síochána pursuant to Section 41(b) of the Data Protection Act 2018. Please contact us if you want further information on the specific legal obligations which it is necessary for us to process your personal data in connection with.

5. Disclosures of your personal data

Access by Blanchardstown Centre Personnel. We only allow authorised employees to access personal data collected by the Security System, and only where there is a lawful purpose for accessing the information. All such authorised employees are trained in how to appropriately handle personal data.
Access by other third parties. Our contracts with third party providers only allow use of your information to provide their services and require that they not disclose it unless required in certain situations. We review the security policies and practices of our third-party service providers as appropriate as part of our own efforts to maintain the security of your information. We may store your information with or allow access to your information to the following third parties who provide us with certain services:
• Blanchardstown Centre’s insurers, who will receive copies of data relating to serious incidents which have occurred on the premises. All non-relevant images and individuals are redacted in the data provided to the insurers.
• Komp.ly, Blanchardstown Centre’s third-party data processor which redacts CCTV footage on behalf of Blanchardstown Centre where required, or any future replacement of Komp.ly which provides such services to Blanchardstown Centre.
• Solicitors who request information related to an accident or incident for the purpose of pursuing a legal case. Correspondence from solicitors received by Blanchardstown Centre is automatically forwarded to its insurers who are responsible for handling communication with solicitors. Any subsequent requests for CCTV footage will then come to Blanchardstown Centre via the insurers.

Law Enforcement, Court Orders and Protection of Our Rights. We may disclose data collected through the Security System to government officials as necessary to comply with applicable laws and orders, or where we consider it necessary in our or a third party’s legitimate interests. If we receive a request to disclose any such information, we may do so if we believe in our reasonable discretion that such request is lawful and that disclosure is reasonably necessary to comply. We may also disclose your personal data to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. In the event that we are legally compelled to disclose your personally identifiable information to a third party, we will attempt to notify you unless doing so would violate the law, court order or government instruction.

6. International transfers

Blanchardstown Centre does not transfer any personal data collected through the Security System outside of the European Economic Area.

7. Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those authorised employees and third-party processors who have a business need-to-know. Our authorised employees and third-party processors will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We use industry-standard measures to safeguard all data and have a continuous process in place to test the effectiveness of these measures and to review the threat landscape and new tools available. All CCTV Data, Bodycam Data, and bodycam devices (except when the bodycam is issued to a security officer on duty) are stored in Blanchardstown Centre’s control room, which can only be accessed by authorised employees by keypad, or by third parties through a sign-in system controlled by Blanchardstown Centre.

8. Data retention

We and our third-party processors will keep personal data in our active operating systems only for as long as necessary to fulfil the purposes we collected it for. We retain CCTV Data for 30 days, after which it is automatically deleted from the system unless it is requested by an authorised employee or member of An Garda Síochána in pursuance of a criminal or civil investigation. Bodycam Data is deleted routinely unless it relates to an incident which has the potential to become litigious. Such Bodycam Data is generally retained for no more than 30 days; however such information may be retained for up to 7 years where the incident has the potential to result in a legal claim.

9. Your legal rights

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
• If you want us to establish the data’s accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Please note that Blanchardstown Centre does not rely on consent or performance of a contract with you as its legal bases for processing personal data in the context of the Security System.

Withdraw consent at any time where we are relying on consent to process your personal data. Please note, however, that Blanchardstown Centre does not rely on consent as its legal basis for processing personal data in the context of the Security System.

Contact Us If you would like to exercise any of the above rights, please contact us at datacontroller@blanchardstowncentre.com with your request. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.