Millom Town Council
Policies
CCTV Policy for Millom Park
Adopted: 27th May 2026 Review Date: May 2027
1. Purpose of the Policy
Millom Town Council (the “Council”) operates a CCTV system in Millom Park to:
- Enhance public safety and security;
- Prevent and deter crime and antisocial behaviour;
- Support law enforcement agencies;
- Protect Council-owned assets and facilities.
2. Legal Framework
The CCTV system will be operated in accordance with:
- UK General Data Protection Regulation (UK GDPR);
- Data Protection Act 2018;
- Data (Use and Access) Act 2025;
- Freedom of Information Act 2000;
- The ICO’s Video Surveillance Guidance, which the Council voluntarily follows as the authoritative guidance for CCTV operators under UK GDPR;
- Human Rights Act 1998 (Article 8 – Right to Privacy);
3. Scope of the System
- CCTV cameras are installed at key locations within Millom Park, such as entrances, play areas, pathways and public facilities;
- Cameras are positioned to minimise intrusion into private property and residential areas;
- Audio is not recorded.
The Council maintains a list of CCTV camera locations within Millom Park, which is available on request from the Clerk.
4. Principles of Operation
The Council will ensure:
- CCTV is used lawfully, fairly and transparently;
- Surveillance is operated only where it is necessary and proportionate to its purpose;
- Measures are in place to avoid excessive monitoring;
- Clear signage informs the public that CCTV is in operation.
5. Data Collection and Use
- CCTV footage constitutes personal data where individuals can be identified;
- Images are recorded digitally and stored securely;
- Footage is only used for the purposes stated in this policy.
6. Data Retention
- Recorded footage will be retained for a maximum of 30 days unless required longer for:
- Ongoing investigations;
- Legal proceedings.
After this period, footage will be automatically overwritten or securely deleted.
7. Access to Footage
Access is strictly controlled:
- Only authorised personnel (such as Council staff or designated operators) may view footage;
- Access is logged and auditable;
- Footage may be shared with:
- Police or law enforcement agencies;
- Insurance companies or legal representatives, where the Council determines that disclosure is necessary in connection with a legal claim or potential claim affecting the Council and a clear lawful basis under UK GDPR exists.
Footage will not be shared with third parties unless legally required.
8. Subject Access Requests (SARs)
- Individuals have the right to request access to their personal data.
- Requests must be made in writing to the Council;
- Proof of identity will be required;
- Responses will be provided within one month of receipt of a valid request, in line with Article 12 UK GDPR.
Where a request is complex, or where the Council receives a number of requests from the same individual, that period may be extended by a further two months, in which case the Council will inform the individual of the extension and the reasons for it within the original one-month period;
Where other individuals appear in the footage, images may be redacted.
9. Security of Data
The Council will ensure:
- Secure storage of recorded footage;
- Password-protected systems and restricted access;
- Protection against unauthorised viewing, copying or deletion;
- Regular system maintenance and updates.
Any actual or suspected breach of personal data is handled under the Council’s Data Breach Policy. Where required, breaches are notified to the Information Commissioner’s Office (or its statutory successor) within 72 hours, in accordance with Article 33 UK GDPR.
10. Signage
Clear and visible signage will be displayed throughout Millom Park stating:
- CCTV is in operation;
- The purpose of surveillance;
- Contact details for Millom Town Council.
11. Monitoring and Review
- The CCTV system and this policy will be reviewed annually or as required;
- Effectiveness, necessity and proportionality will be assessed;
- Any changes to legislation will be incorporated promptly.
12. Complaints
Any complaints regarding the CCTV system should be directed to:
Clerk to Millom Town Council, 6 Newton Street, Millom, LA18 4DR – Telephone: 01229 772340 – Email: theclerk@millomtowncouncil.co.uk
If unresolved, complaints may be referred to the Information Commissioner’s Office (ICO).
13. Responsibilities
The Council is the Data Controller.
A designated officer (the Town Clerk) is responsible for:
- Day-to-day system management;
- Ensuring compliance with this policy;
- Handling data requests (including Subject Access Requests).
Appendix A – Data Protection Impact Assessment (DPIA)
CCTV at Millom Park
1. Overview of Processing
Millom Town Council operates a CCTV system within Millom Park to monitor public areas for safety and security purposes. The system captures and records video images of individuals within the park. No audio is recorded.
2. Purpose of the Processing
The CCTV system is used to:
- Deter crime, vandalism and antisocial behaviour;
- Protect Park users, staff and Council assets;
- Assist police and law enforcement investigations;
- Improve public confidence and safety in the park.
3. Lawful Basis
Processing is carried out under:
- Article 6(1)(e) UK GDPR – Public Task (task carried out in the public interest or under official authority).
- Article 6(1)(f) UK GDPR (legitimate interests) is not relied upon. As confirmed by Article 6(1) UK GDPR itself, the legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks.
4. Nature of Personal Data
The CCTV system collects:
- Video footage of individuals;
- Clothing, behaviour and physical characteristics;
- Date, time and location of recordings.
No special category data is intentionally collected.
5. Necessity and Proportionality
The Council has determined that CCTV is necessary because:
- Previous or potential incidents justify enhanced monitoring;
- Alternative measures (such as lighting, signage and patrols) are insufficient on their own;
- Cameras are limited to key public areas only.
The system is proportionate because:
- It does not monitor private property;
- It avoids excessive or intrusive coverage;
- It is used only for defined purposes.
6. Privacy Risks Identified
- Intrusion into personal privacy – individuals may feel constantly monitored;
- Misuse of footage – risk of unauthorised viewing or sharing;
- Excessive data capture – recording beyond what is necessary;
- Data breach – loss, theft or unauthorised access to footage.
7. Measures to Mitigate Risks
To reduce risks, the Council will implement:
- Clear signage at park entrances and key points;
- Restricted access to authorised personnel only;
- Password-protected and secure systems;
- Retention limit of 30 days (unless required for investigation);
- Careful camera positioning to avoid homes and private spaces;
- Staff training on data protection and CCTV use;
- Audit logs of access and disclosures.
8. Data Sharing
CCTV footage may be disclosed only:
- To police or law enforcement agencies;
- For legal proceedings;
- To insurers where relevant.
All disclosures will be recorded and justified.
9. Retention and Disposal
- Footage will be automatically deleted after 30 days;
- Longer retention only where required for investigation;
- Secure deletion processes will be followed.
10. Individual Rights
Individuals have the right to:
- Request access to their data (Subject Access Request);
- Request erasure where applicable;
- Object to processing.
Requests will be handled within one month of receipt of a valid request, with identity verification required before any personal data is disclosed.
11. Consultation and Transparency
The Council will:
- Provide public signage explaining CCTV use;
- Make this policy and DPIA available on request;
- Provide contact details for queries and complaints.
12. Residual Risk Assessment
- After safeguards are applied:
- Residual risk is assessed as low to medium;
- The benefits to public safety outweigh privacy risks.
