VeriFi EIDOS

18. VeriFi SAR Procedure

Where VeriFI provide a managed subject access request service the following procedures apply.

IMPORTANT

For the purpose of account management all correspondence is to be made using the dedicated email address SAR@verifi-fms.com

  1. On receipt of an application VeriFi will email to applicant as follows and copy the data controller’s nominated manager.

Dear [Applicant Name]

Thank you for your request for CCTV footage from the following site:

[Data Controller]

[Address]

Unless you have already made your application or intend to do so in a different format, please complete and return the attached form supplying the required documentation (see section 5).

Once we have received the completed documentation we will process your request within one month unless we inform you to the contrary.

Kind regards,

2 . On receipt of the application VeriFi will open a file and the following email will be sent to the applicant by VeriFi. A copy to be sent to the data controller with copy of the application attached including photo ID and other identifying documentation for approval

Dear [Applicant Name]

Subject SAR

Reference [Number]

Applicant [Name]

We received your request on [DATE] and this is now being processed.

Kind regards

3. On receipt of the copy of the application the data controller will:-

i – save a copy of the requested footage; and

ii – complete the application form indicating the application is either approved or disapproved and email a scanned copy to VeriFi.

4. If the footage is found to contain only recognisable images of the applicant the data controller will download the footage to a DVD and complete a data release log and email the applicant as below with a copy to VeriFi who will then close the case file and destroy it in its entirety together with any retained footage.

Dear [Applicant Name]

Subject SAR

Reference [Number]

Applicant [Name]

The CCTV footage you requested is now ready for collection at [address] please phone [ name / position] to arrange a convenient date and time.

Kind regards

VeriFi will email the applicant;

Subject SAR

Reference [Number]

Applicant [Name]

I confirm that this case is now closed and our file has been destroyed in its entirety. [name of data controller] will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log that you signed as receipt of the requested data this may be retained in a secure archive for 6 years

OR

If the footage contains images of other persons the data controller can email VeriFi requesting redaction editing as follows;

Subject SAR

Reference [Number]

Applicant [Name]

Please set up a Dropbox account to enable us to forward footage for redaction editing.

Subject to the application having been previously approved VeriFi will review the footage and, if in their opinion redaction is required, will quote for the redaction process and subject to receipt of a purchase order will complete the editing and send the edited footage back to the data controller within 5 working days:-

Dear [Applicant Name]

Subject SAR

Reference [Number]

Applicant [Name]

The CCTV footage you requested is now ready for collection at [address] please phone [ name / position] to arrange a convenient date and time.

Regards

If the scope of the application is complex or unusually large VeriFi will inform the applicant and copy the data controller within the 5 working days as follows;

Dear [Applicant Name]

Subject SAR

Reference [Number]

Applicant [Name]

I regret that due to [state reason] we may be unable to process this within the normal 30 day time window due to the man hours involved.

We are giving this project a high priority and will keep you informed, our current best estimate is that we will have the data available for collection from [data controller] within the next [state] working days.

Kind regards

5. The applicant will be informed by the data controller when and where the requested footage will be ready for collection in person. The data controllers nominated representative will compare the file copy of the ID Photo with the applicant. Provided this is confirmed, section 9 of the Subject Access Request form must be completed, the CCTV footage will be handed over to the applicant who must sign a Data Release Log signifying receipt, a copy of this to be handed to the applicant

6. The data controller will email VeriFi as follows;

Subject SAR

Reference [Number]

Applicant [Name]

This case is now closed please destroy your file in its entirety.

7. VeriFi will email the applicant;

Subject SAR]

Reference [Number]

Applicant [Name]

I confirm that this case is now closed and our file has been destroyed in its entirety. [name of data controller] will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log that you signed as receipt of the requested data this may be retained in a secure archive for 6 years.

8. The data controller will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log signed as receipt of the requested data this may be retained in a secure archive for 6 years.

9. VeriFi will retain the case file in its entirety for 12 months from the date of handover of the edited material to the data controller. On expiry of the retention period VeriFi will email the data controller;

Dear (data controller contact name)

Subject; Subject Access Request

Reference Number

The 12 month retention period for this case has now expired and we will now securely destroy the file in its entirety unless we hear from you to the contrary within the next 10 days.