SPAR Scotland | /cctv.aspx
Type ID:
Type ID:
Type: ID:

CCTV Policy


C J Lang recognises that the General Data Protection Regulation (GDPR) and the current Data Protection Act (DPA) regulate CCTV and the images they capture as well as other electronic and manual data/records. The purpose of this policy is to put measures in place to ensure that legislative compliance is maintained with respect to CCTV and that the Company complies with the current Information Commissioner’s Office (ICO) Code of Practice.


The Company has a General Data Protection Policy but given the specialist nature of CCTV this addendum Policy has been created to ensure clarity on how our Company will treat CCTV images.

The policy, which takes effect from the 25th May 2018, is to ensure that the Company meets legislative compliance in its obtaining, collecting, storing, sharing, updating, analysing, handling, retaining and deleting of personal data through CCTV.


The Company employs closed circuit television (CCTV) cameras to provide a safe and secure environment for employees, customers, contractors and suppliers who visit the Company’s Head Office, Distribution Operations and SPAR stores (those which are directly operated by the Company)  and to protect the Company’s property and assets. C J Lang & Son Limited is the Data Controller.

Images are recorded for the purposes of:

•    Prevention, investigation and detection of crime
•    Assisting in the identification and prosecution of offenders
•    Monitoring the security of C J Lang’s business premises
•    Public and employee health and safety
•    Compliance with legal and regulatory requirements
•    Employee training, productivity and quality control purposes

The Company’s CCTV cameras record images only.  There is no audio recording i.e. conversations are not recorded on CCTV.

In terms of marketing images such as photos or video footage these will be taken into consideration under the General Data Protection Policy.

Policy Implementation

The Data Protection Officer has overall responsibility for the Company’s data standards. However, given the nature of CCTV as specialist area, the Company’s Security Manager is delegated to implement this specific policy to ensure compliance with both legislative requirements and our CCTV policy. The Security Manager will monitor the secure operation of all CCTV systems and will conduct a regular review of the equipment, camera siting and operational efficiencies. Administration and documentation standards connected with effective CCTV operation will be regularly audited by the Security Manager and he will recommend and implement improvements where necessary.

Lawful basis for processing

The Company has legitimate interests in capturing CTTV images to protect its customers, suppliers, and importantly, our employees as well as protecting its premises, stock and equipment. There are also legal obligations in terms of health and safety, licensing, environment, community safety etc. Additionally, the Company and its employees have joint responsibility to ensure that contract of employment obligations around honesty, integrity, trustworthiness, keeping themselves safe and others, etc. are maintained.

Who is responsible for each premises’ CCTV operation?

The person responsible for the CCTV system is the manager in charge of the premises. For example, in  C J Lang directly operated SPAR stores it will be the Store Manager. They are known as the Data Processors since on C J Lang’s behalf they will decide on how to process CCTV data.

Location of cameras

Cameras are located at strategic points throughout C J Lang’s Distribution Centre premises, at the goods-in/out areas, within the warehouse and transport operations and also at vehicular and pedestrian exit and entrance points. Cameras are also externally and internally positioned within our directly operated SPAR store operations.  The Company has sited the cameras so that they only cover communal or public areas on the Company’s business premises and they have been sited so that they provide clear images.  No camera focuses, or will focus, on toilets, shower facilities, changing rooms, in staff kitchen areas or in staff break rooms. They will focus on the external of the stores, front store customer areas including the tills’ area, stockrooms and also the Store Managers’ Office which contains safes (these will covered by CCTV for the clear security reasons of protecting stock and cash).

All cameras (with the exception of any that may be temporarily set up for covert recording- see later on) will be clearly visible.

CCTV signage

In accordance with legislation clear and prominent signs, usually at or near the entrance doors to the directly owned SPAR premises let employees, customers, suppliers, contractors, passer-by’s know that CCTV is in operation. These signs highlight to those individuals who come into our premises and those who walk or drive past our stores that CCTV surveillance is being carried out. Similarly, our Distribution Centre/Head Office will have signs prominently displayed.

Integrity of CCTV images

The integrity of the CCTV image (s) is critical so it is important that any recorded material is safely and securely stored. This ensures that the rights of employees and other individuals are protected.

Retention of Images

Images will be recorded in constant real-time (24 hours a day throughout the year). As the recording systems record digital images, any CCTV images that are  held  on the hard drive of the designated PC will be deleted and overwritten on a recycling basis and, in any event, are not held for more than 6 months. Once a hard drive has reached the end of its use, it will be erased prior to disposal.

Images that are stored on, or transferred onto, removable media will be erased or destroyed once the purpose of the recording is no longer relevant. Where enforcing authorities are investigating a crime or there is a connection to a health and safety incident/accident, or indeed a disciplinary matter involving an employee, the Company will retain the data/images.

CCTV maintenance and system integrity

The routine management of the CCTV system is the responsibility of the Store Manager, who would also have alcohol licensing obligations as the Designated Premises Manager.  They should regularly check the equipment and quality of images being recorded. Time and date displays must be accurate and any faults on the system reported to Security department who will organise repairs or replacements to the equipment.

The Company’s Security Manager, through Security Co-ordinators’ audits, will ensure that CCTV systems and the recording of high quality images are maintained.

Covert cameras

In exceptional circumstances, covert cameras may be used. The written authorisation of the Company’s Security Manager ( or the Company Secretary in their absence) must be obtained where there is good cause to suspect that criminal activity or equivalent malpractice is taking, or is about to take, place and informing the individuals concerned that the recording is taking place would seriously prejudice its prevention or detection.

It will normally be used if it is part of a specific investigation into suspected criminal activity or a health and safety or environmental issue.  It may be linked to employees carrying out a Gross Misconduct type criminal activity or putting themselves or others health and safety at risk.
The employee, or other individual, will be unaware that their images are being recorded on CCTV. However, if such activity is confirmed then these images will be revealed to the affected employee, a right to access given and consequent action to follow.

If the criminal activity or putting others at risk is being carried out by an individual who is not an employee it will be referred to the Police.

Please note that once the monitoring has taken place for a reasonable and limited amount of time Security Department will remove all covert cameras. All other information collected in the course of covert monitoring will be deleted or destroyed unless it reveals information which the Company cannot reasonably be expected to ignore.

Access to images

Access to images recorded on CCTV is restricted. This ensures that the rights of individuals are maintained. Images can only be disclosed in accordance with the purposes for which they were originally retained (please refer to the Scope, Paragraph Three for the relevant purposes).

Viewing of live images is required by all staff within our directly operated SPAR stores. As we operate a one to one system in some stores, when one member of staff is taking a break they are able to monitor live CCTV in the shop area for health and safety purposes (victim of crime, accident or taken unwell). In addition they can respond to customer service needs when the shop is busy.

Only trained staff with a user code and PIN will be able to access recorded data on the CCTV systems. These persons will be able to view and transfer recoded or still images to portable media such as a
CD/DVD/USB/Pen drive or portable hard disk. If media, on which images are recorded, is removed for viewing purposes this will be duly documented by the issuing manager or security.

Our security personnel will view live and recorded images but this will be restricted to viewing within a designated secure office to which other employees will not have access to when the viewing is occurring. Otherwise only authorised line management may have access to images but they will follow the restrictions outlined within this paragraph.

CCTV images and third parties    

Where a crime needs to be investigated by Law Enforcement Representatives such as the Police, Procurator Fiscal, Prosecuting or Defence Solicitors, Court Authorities, Company Solicitors, they will be provided with a copy of the CCTV images on appropriate portable media to assist their enquiries.

The Company’s Security Manager (or the Company Secretary acting in their absence) is the only person who is permitted to authorise disclosure to third parties in terms of the Distribution Centre. In terms of directly operated SPAR Stores the Security Manager and the authorised Premises/Store Manager (or their designated deputy) can authorise this action.

The authorised third party being provided with the images should sign for the portable media being provided confirming their name, job title, signature and date as per the CCTV log book along with the reasons why they are required.

N.B. Under no circumstances should members of the public be given access to CCTV images.

Misuse by employees of CCTV  

Employees misusing CCTV images against this policy will be breaching the General Data Protection Regulations (GDPR) and may be subject to criminal investigation and the Company’s Disciplinary Procedures.

N.B. Please note it is a term and condition of employment for all employees that all such data is treated as confidential. Unless they are authorised, the employee must not disclose CCTV images to any third party.

Staff training

The Company will ensure that all employees handling CCTV images or recordings are trained in the operation and administration of the CCTV system, issued the relevant user ID and PIN and the impact of the GDPR and current Data Protection Act with regard to that system. They should also be informed and trained in the Company’s policies on Data Protection.

Subject access requests

This is covered in the General Data Protection Policy but for ease of accessibility it is restated in the Addendum- CCTV and Images. Similar to other personal identifiable information/data, individuals whose information is recorded have a right to be provided with that information or, if they consent to it to view that information.

GDPR/DPA gives an individual the right to find out what information is held about them by C J Lang. The individual can also verify the lawfulness of the processing. This process of data access is described as “Data Subject Access Request”. The applicable procedure that applies is as follows:

Any request must be submitted by the individual either electronically or in writing and should be accompanied by information to the company that confirms the individual’s identity before we take action to comply with your request. You can do this by providing a copy of your passport or photo card driving licence. The request and accompanying detail should be sent to the:

Data Protection Officer
C J Lang & Son Limited
Head Office
78 Longtown Road

Or by email to:

The Company will provide the requested information within one month of receipt of the original request. There is no charge for a reasonable request. However, where the request is complex or numerous, the Company will extend the period of compliance by a further two months. If this is the case, C J Lang will inform you within one month of receipt of the original request and explain why the extension is necessary.

For requests that are manifestly unfounded or excessive, the Company will charge a reasonable fee, taking into account administrative costs incurred or refuse to respond but explain at the latest within one month why to you and inform you of your right to complain to a supervisory authority such as the Information Commissioners Office (ICO) and to judicial remedy without undue delay.

Where C J Lang processes a large quantity of information about an individual and the request is for a large amount of personal data GDPR/DPA permits the Company to ask an individual to specify the information that the request relates to.

Before any Data Subject Access request is processed the Company must verify the identity of the person making the request. If the ID of the requester cannot be verified, the Company will not comply with the request.

If the request is made in writing, the Company will provide the information on portable media using a commonly used electronic format and send the information by mail to the individual’s request address.

Upon receipt of the data you may request to have the personal data rectified, particularly if it is inaccurate or incomplete. Where there is no compelling reason for data’s continued processing, you can request deletion or removal. You also have the right to request “blocking or suppressing processing of personal data.

In the case of CCTV the individual must  provide details which are sufficient to allow identification of them as the subject of the image (date and time they visited premises, a physical description of themselves,  a photograph of themselves-wearing same clothes as they were wearing at the time, if possible) and in order to locate the images on the system.

The Data Protection Officer will request the Company’s Security Manager to provide the images within one month of receiving such a request.


In the event of any complaint around the Company’s handling of CCTV Images please refer to the General Data Protection Policy to be found on the C J Lang website:


The policy will be reviewed annually.


©SPAR Scotland • All Rights Reserved • Website presented on Big RedLog in