CCTV PRIVACY NOTICE

22 October 2020

The Smart Mobility Living Lab(SMLL Ltd) is committed to protecting your information. We have created this Notice to help answer questions you may have about how we protect and use the information we gather. If you have any questions about our privacy practices or questions, requests or concerns regarding your information, please contact us via email to DPO@smartmobility.london.

SMLL Ltd is the Data Controller for the purposes of the Data Protection Act 2018 and the General Data Protection Regulation (Regulation (EU) 2016/679).SMLL Ltd is a subsidiary of TRL Ltd.

You may contact our Compliance Team via email to DPO@smartmobility.london.Alternatively you may write to:

Compliance Team

1 Purpose

2 Legal basis for using your information

3 Information we collect

4 Special categories of personal data

5 How long we store data

6 Data recipients

7 Where we store personal data

8 How we keep information secure

9 Access to your information (Data Subject Rights)

10 Changes to our Notice

11 Contact

Purpose

SMLL’s goal is to facilitate the safe development of future mobility technologies and related services for the benefit of all our stakeholders including their ultimate users amongst the general public. We have equipment installed in roadside public spaces around the Queen Elizabeth Olympic Park (QEOP) and the Royal Borough of Greenwich (RBG). This includes observation cameras monitoring roadways and footways. Monitoring and recording with these cameras allows SMLL customers and partners to gain insights into the effectiveness of new technologies and related services so that they can be improved before they reach the marketplace. In addition,

our testing activities allow the wider public to receive early exposure to innovative technologies and services in a safe and controlled manner.

2. LEGAL BASIS FOR USING YOUR INFORMATION

Under privacy and data protection legislation, the SMLL is only allowed to use personal information if we have a proper reason or 'legal basis' to do so. SMLL, its customers and its partners have a “Legitimate Interest” in observing how innovative technologies such as Connected and Automated Vehicles (CAVs)perform, are responded to, and can be best implemented in a real-world city environment. This will help maximise future success, safety and utility for their end users in society. We may process your personal data in this way where your interests and fundamental rights do not override our legitimate business interests.

3. INFORMATION WE COLLECT

SMLL is using video cameras mounted at the roadside in order to observe the technologies and services it is testing and their interactions with other road users. These cameras will capture some personal data as a result of their monitoring. The personal data collected are:

· live-streamed and recorded video of individuals moving through the observation area.

· live-streamed and recorded video of number plates of vehicles moving through the observation area.

The live-streaming and recording of vehicle number plates may not constitute personal data as we are not likely to be able to identify an individual from the number plate, taking into account all objective factors. We have included it for completeness only.

The video equipment used provides both a live stream and recording of footage. Information will only be held for a limited period allowing for it to be analysed and anonymised. Personal data will not be retained long-term.

Data will only be captured from public areas on and around the highway. Fixed roadside cameras will be subject to privacy masking to ensure no data is captured from private premises adjacent to the highway. This will be applied in-camera to block pre-determined areas of the field of view. This means that images of these private premises will never be captured by these units.

In order to minimise data capture, the cameras will only be operational during defined testing, commissioning and maintenance activities in the relevant observation area. In addition, the roadside cameras will not be used to record any sound.

4. SPECIAL CATEGORIES OF PERSONAL DATA

We do not intentionally collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). However, we may process Special Categories of Personal Data where it is publicly visible and picked up by the equipment we use.

5. HOW LONG WE STORE DATA

Data will be stored only for as long as it is relevant to the purposes above. Roadside camera footage that may contain personal data will be retained for up to 3 months. This is to allow enough time for us to analyse the footage to generate useful insights. Any footage that is retained longer term will be anonymised to remove personal data.

6. DATA RECIPIENTS

Data is accessed when relevant to the purposes above.

The live-streamed footage is only accessed within an SMLL Control Room by employees of Data Controller and Processor organisations who have received appropriate training and committed to our CCTV Operator Code of Practice.

Recorded footage is shared with Data Processor organisations for them to conduct analysis on our behalf. This is subject to data sharing agreements that ensure they use the data solely for our purpose, do not share it any further, and delete it once analysis has been completed.

Any footage shared more widely will have been anonymised to remove any personal data.

For some testing activities, a customer or partner organisation may be the joint or sole Data Controller. Separate Privacy Notices detail our approach to Data Protection for these activities. Links to these are included further down this page

7. WHERE WE STORE PERSONAL DATA

All information we gather is stored in our secure servers in the United Kingdom. At no point will any personal data be transferred outside the United Kingdom or European Union.

8. HOW WE KEEP INFORMATION SECURE

We have implemented administrative, technical, and physical security measures to help prevent unauthorised access to the data we hold. This includes the use of encryption to protect personal data contained within the live-streamed footage for the short period it is being stored, communicated and viewed.

We restrict access to information to only those employees of the Data Controller and Processor organisations, who need such access in order to operate, develop, improve, or deliver our programs, products, and services. These employees receive appropriate training and are committed to our CCTV Operator Code of Practice

9. ACCESS TO YOUR INFORMATION (DATA SUBJECT RIGHTS)

You have the following rights regarding your personal data:

1. Right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Notice.

2. Right of access

You have the right to obtain access to your personal data (if we are processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you are aware and can check that we are using your personal data in accordance with data protection law.

3. Right to rectification

You are entitled to have your personal data corrected if it is inaccurate or incomplete.

4. Right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

5. Right to restrict processing

You have the right to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further. We keep lists of people who have asked for further use of their personal data to be ‘blocked’ to make sure the restriction is respected in future.

6. Right to data portability

You have the right to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.

7. Right to object to processing

You have the right to object to us processing your personal data for our legitimate business interests or for direct marketing purposes (including in each case any related profiling).

8. Right to make a complaint to the data protection authorities

You have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your personal data or believe our processing of your personal data does not comply with data protection law.

If you wish to exercise any of your legal rights, please contact our Compliance Team, by writing to the address at the top of this Notice or by emailing us at DPO@smartmobility.london. We may require you to prove your identity with approved identification before fulfilling your request.

10. CHANGES TO OUR NOTICE

Any changes we make to our Notice in the future will be posted on our website. Please check our website frequently to see any updates or changes to our Notice.

11. CONTACT

Questions, comments and requests regarding this Notice are welcomed and should be addressed to our Compliance Team, by writing to the address at the top of this Notice, or by emailing us at DPO@smartmobility.london.