18. VeriFi DSAR Procedure
Where VeriFi provide a managed data subject access request service the following procedures apply.
IMPORTANT
For the purpose of account management all correspondence is to be made using the dedicated email address SAR@verifi-eidos.co.uk
1. On receipt of a data subject access request for footage, VeriFi will email the applicant as follows and copy the data controller’s nominated manager.
Dear [Applicant Name]
Thank you for your request for CCTV footage from the following site:
[Data Controller]
[Address]
Unless you have already made your application or intend to do so in a different format, please complete and return the attached form supplying the required documentation (see section 5).
Once we have received the completed documentation we will process your request within one month unless we inform you to the contrary.
Kind regards,
2. On receipt of the completed application form, VeriFi will open a file and the following email will be sent to the applicant by VeriFi. A copy to be sent to the data controller with a copy of the application attached including photo ID and other identifying documentation for approval.
Dear [Applicant Name]
Subject DSAR
Reference [Number]
Applicant [Name]
We received your request on [DATE] and this is now being processed.
Kind regards,
3. On receipt of the copy of the application the data controller will:
- i – save a copy of the requested footage; and
- ii – complete sections 6-8 of the data subject access request form, indicating whether the application is either approved or denied and email a scanned copy to VeriFi.
4. If the footage is found to contain only recognisable images of the applicant, the data controller will download the footage to a DVD and complete a data release log and email the applicant as below with a copy to VeriFi. VeriFi will then close the case file and destroy it in its entirety together with any retained footage.
Dear [Applicant Name]
Subject DSAR
Reference [Number]
Applicant [Name]
The CCTV footage you requested is now ready for collection at [address] please phone [ name / position] to arrange a convenient date and time.
Kind regards,
VeriFi will email the applicant:
Subject DSAR
Reference [Number]
Applicant [Name]
I confirm that this case is now closed and our file has been destroyed in its entirety. [name of data controller] will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log signed by you as receipt of the requested data. This may be retained in a secure archive for 7 years.
OR
If the footage contains images of other persons the data controller can email VeriFi requesting redaction editing as follows:
Subject DSAR
Reference [Number]
Applicant [Name]
Please set up a Dropbox account to enable us to forward footage for redaction editing.
Subject to the application having been previously approved VeriFi will review the footage and, if in their opinion redaction is required, will quote for the redaction process. Subject to receipt of a purchase order, VeriFi will complete the editing and send the edited footage back to the data controller within 5 working days:
Dear [Applicant Name]
Subject DSAR
Reference [Number]
Applicant [Name]
The CCTV footage you requested is now ready for collection at [address] please phone [ name / position] to arrange a convenient date and time.
Kind regards,
If the scope of the application is complex or unusually large VeriFi will inform the applicant and copy the data controller within the 5 working days as follows:
Dear [Applicant Name]
Subject DSAR
Reference [Number]
Applicant [Name]
I regret that due to [state reason] we may be unable to process this within the normal 30 day time window (according to the GDPR regulations) due to the man hours involved.
We are giving this project a high priority and will keep you informed, our current best estimate is that we will have the data available for collection from [data controller] within the next [state] working days.
Kind regards,
5. The applicant will be informed by the data controller when and where the requested footage will be ready for collection in person. The data controllers nominated representative will compare the file copy of the ID Photo with the applicant. Provided this is confirmed, section 9 of the Data Subject Access Request form must be completed, the CCTV footage will be handed over to the applicant who must sign a Data Release Log signifying receipt. A copy of this should be handed to the applicant.
6. The data controller will email VeriFi as follows:
Subject DSAR
Reference [Number]
Applicant [Name]
This case is now closed please destroy your file in its entirety.
7. VeriFi will email the applicant:
Subject DSAR
Reference [Number]
Applicant [Name]
I confirm that this case is now closed and our file has been destroyed in its entirety. [name of data controller] will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log signed by you as receipt of the requested data. This may be retained in a secure archive for 6 years.
8. The data controller will retain a file copy of all correspondence and recordings for 30 days before destroying the file (including any retained footage) in its entirety other than the Data Release Log signed as receipt of the requested data. This may be retained in a secure archive for 6 years.
9. VeriFi will retain the case file in its entirety for 12 months from the date of handover of the edited material to the data controller. On expiry of the retention period VeriFi will email the data controller:
Dear (data controller contact name)
Subject; Data Subject Access Request
Reference Number
The 12 month retention period for this case has now expired and we will now securely destroy the file in its entirety unless we hear from you to the contrary within the next 10 days.
