Waterford City and County Council - October 2020

• Year: 2020
• Date: 21 October 2020
• Section: Decisions made under data protection act 2018

1

Decision of the Data Protection Commission under Sections 111 and 124

of the Data Protection Act 2018 in the Case of 04/SIU/2018 relating to:

Waterford City and County Council

Own-Volition Inquiry under Sections 110 and 123 Data Protection Act,

2018

on foot of Data Protection Audit Conducted under

Section 136 of the Data Protection Act regarding

The Surveillance of citizens by the State for

Law Enforcement Purposes

Commission Decision-Maker:

Helen Dixon (Commissioner for Data Protection), sole member of the

Commission

Date of Decision: 21st October 2020

2

Contents

1. Purpose of this Document ............................................................................................................. 3

2. Background ..................................................................................................................................... 3

3. Topics arising in this Decision ........................................................................................................ 5

4. Legal regimes pertaining to the inquiry and the Decision ............................................................ 6

5. Materials considered .................................................................................................................... 12

6. Data controller ............................................................................................................................. 13

7. Personal Data ............................................................................................................................... 13

8. Analysis and findings .................................................................................................................... 13

A. Body Worn Cameras: Lawful Basis & Accountability ............................................ 14

B. Lawful Basis: Dash Cams, Drones and Covert Cameras ...................................... 19

C. Lawful Basis: CCTV Cameras at Poleberry Walkway ............................................. 24

D. Lawful Basis: CCTV Camera at Williamstown Municipal Golf Course .............. 25

E. Use of drones: Demonstrating Lawfulness................................................................... 26

F. Use of Drones: Appropriate Technical and Organisation Measures in the Final

Policy ............................................................................................................................................... 27

G. CCTV Live Feed to Ballybricken Garda Station ....................................................... 29

H. CCTV: Access Logs for Remote Access ................................................................... 31

I. CCTV: Secondary Processor at Poleberry Walkway .................................................. 32

J. Transparency: CCTV, Drones and Dash Cams ............................................................ 34

K. Data Protection Policies: CCTV, Drones, Dash Cams, Body Worn Cameras and

Covert Cameras ............................................................................................................................ 36

9. Corrective measures ..................................................................................................................... 38

10. Right of appeal ......................................................................................................................... 46

3

1. Purpose of this Document

1.1 This document is the decision (the ‘Decision’) of the Data Protection

Commission (the ‘DPC’) in accordance with Sections 111 and 124 of the Data

Protection Act 2018 (the ‘2018 Act’). I make this Decision having considered the

information obtained in the separate own volition inquiry conducted by

Authorised Officers of the Data Protection Commission (the ‘Authorised

Officers’). The Authorised Officers who conducted the inquiry provided

Waterford City and County Council (the ‘Council’) with the draft Inquiry Report

and the final Inquiry Report. The Decision is being provided to the Council

pursuant to Sections 116(1)(a) and 126(a) of the 2018 Act in order to give the

Council notice of the Decision and the reasons for it, and the corrective powers

that I have decided to exercise.

1.2 This Decision contains a list of corrective powers under Sections 115 and 127 of

the Data Protection Act 2018 arising from the infringements which have been

identified herein by the Decision Maker. The Council is required to comply with

these corrective powers and it is open to this office to serve an enforcement

notice on the Council in accordance with Section 133 of the Data Protection Act

2018.

2. Background

2.1 The Authorised Officers were authorised on 14 June 2018 to conduct a

connected series of own-volition inquiries under Sections 110 and 123 of the

2018 Act into a broad range of issues pertaining to surveillance technologies

deployed by State authorities, in particular the various local authorities and An

Garda Síochána. In initiating the inquiries, the DPC wished:

i To establish whether any data processing that takes place in this

context is in compliance with relevant data protection laws, and

ii To ensure that full accountability measures for the collection and

processing of personal data are in place in advance of further

investment and deployment of newer surveillance technologies.

2.2 The inquiry leading to this Decision (the ‘inquiry’) was conducted initially by

means of an audit under Section 136 of the 2018 Act. This facilitated the

Authorised Officers in compiling facts in relation to the deployment of surveillance

technologies by the Council. The Authorised Officers sent a questionnaire to the

Council for the purpose of the opening phase of the audit on 25 June 2018. The

Council responded with the completed questionnaire and a number of

attachments.