The Data Protection Act, Subject Access Requests and Your Rights
Subject to certain exemptions, you have a right to be told whether any personal data is held about you.
You also have a right to a copy of that information in a permanent form except where the supply of such a copy is not possible or would involve disproportionate effort, or if you agree otherwise.
Lothian Buses Limited will only give access to information if it is satisfied as to your identity.
If release of the information will disclose information relating to another individual(s), who can be identified from that information, then Lothian Buses is not obliged to comply with an access request unless:
- The other individual(s) has consented to the disclosure of information through the formal Subject Access Request process, or
- It is reasonable in all circumstances to comply with the request without consent of the other individual(s)
Subject Access Request Fees
A fee of £10 is payable for each Subject Access Request.
Cheques should be made payable to Lothian Buses Limited.
Subject Access Request forms are available for download here (PDF).
Lothian Buses will provide a written response to the access request within 40 days of receiving the request.
Lothian Buses Limited’s Rights
Lothian Buses may deny access to information where the Data Protection Act allows. The main exemptions in relation to information held on the CCTV System are where the information may be held for:
- Prevention and detection of crime
- Apprehension and prosecution of offenders
and giving you the information may be likely to prejudice any of these purposes.
Cameras and Recording Equipment
Cameras are sited so that they capture images that are relevant to Lothian Buses. The images recorded by our CCTV System are of a high resolution, colour digital format, in most cases with audio, recorded onto a hard drive.
The systems in use on board buses work on a looped recording basis capable of storing 1 week or more of data, depending on the equipment in the bus, thus images or events recorded will not be available after the files have been overwritten, unless the images have been recovered by the CCTV Manager prior to being overwritten.
The systems in use in our buildings and Travelshops work on a looped recording basis capable of storing approximately 1 month of data, thus images or events recorded will not be available after the files have been overwritten, unless the images have been recovered by the CCTV Manager prior to being overwritten.
Please see Data for more information.
Signs are displayed on the inside of our public Travelshop premises and vehicles fitted with CCTV.
Access, security and disclosure of the images are strictly controlled in accordance with the Data Protection Act 1998.
All personal data will be obtained and processed fairly.
Personal data will be held only for the purposes specified and used only for the purposes, and disclosed only to the persons relevant to its processing. It will not be held longer than is necessary.
Personal data processed for the following purposes:
- The prevention or detection of crime
- The apprehension or prosecution of offenders
are exempt from the Subject Access Request provision.
CCTV image data is regularly stored for Lothian Buses’ own internal purposes including but not limited to reviews of; events, driving standards and customer services incidents.
Whilst you as a customer, passenger or employee may be present in recovered images, Lothian Buses will only use the data for its own internal staff training, disciplinary, customer services and insurance purposes or for the purposes of the prevention and detection of crime and the apprehension or prosecution of offenders.
Stored recorded incidents, i.e. images of events or incidents recovered by the CCTV Manager, are retained for a period of 5 years after which they are securely destroyed.
Incidents not recorded are overwritten through the looped recording process outlined in the Cameras and Recording Equipment section of this policy.
If for any reason you are not happy with the response you receive regarding your Subject Access Request, please contact Lothian Buses’ Data Controller who will respond to your complaint in writing.
In providing CCTV cover for our staff and customers, we hope to deter crime and provide a safer, more secure working and travelling environment for both staff and customers.
Any request from an individual for personal data will be directed in the first instance to the Data Controller who will then follow procedures laid out in the NCT Code of Practice.
Police requesting CCTV footage may do so in accordance with the Lothian Buses/Police Scotland CCTV Protocol by sending an email to the CCTV Manager.