Security of a educational institution

CCTV and other surveillance

The use of closed-circuit television (CCTV) in schools and colleges has increased rapidly in recent years. While the use of such surveillance may be perceived as a positive measure to help prevent vandalism and enhance security, CCTV cameras can also lead to a climate of paranoia among education staff. This guidance outlines the obligations on schools when operating CCTV systems and applies across the UK.

 

The aim of the guidance (and its accompanying policy) is to ensure that there is a full sharing of information between schools and their staff about the purpose of CCTV, and the extent of its usage. Only by a clear, open exchange of information will the current climate of potential mistrust on this issue be eased.

Legal requirements

There are a number of legal requirements with which every school installing CCTV has to comply. Firstly, schools have a statutory requirement to notify the Information Commissioner that they are installing CCTV and also to state clearly and precisely the purposes for which it is being employed, including the dissemination and distribution of all data collected. The Information Commissioner's Office (www.ico.gov.uk) is the UK's independent authority overseeing protection of personal information. Schools have to renew the notification annually as well as inform the Information Commissioner within 28 days if any changes are made to the use of CCTV.

The Information Commissioner must be informed of the identity of the data controller. The data controller is likely to be either the school (preferably a named employee) or the local authority - whoever is responsible for the CCTV systems. If there are two or more parties involved, as will often be the case, then all parties should be fully aware of their responsibilities and obligations.

 

The actual use of CCTV can be affected by statutory legislation, including the Data Protection Act 1998, the Human Rights Act 1998 and, on occasion, the Regulation of Investigatory Powers Act 2000. Schools must ensure that they not in possible breach of these regulations.

Assessing the impact of CCTV

When schools decide to use CCTV or are reviewing its continued use, they should take into account the benefits of using surveillance cameras. They must also consider whether better solutions exist, as well as the effect it may have on individuals within the school. The latter should form part of an assessment to determine whether CCTV is justified and its impact.

 

Sutra Communication has produced a model impact assessment form, which members should consider putting forward for the school to use. It is extremely important that schools seek the views of all those who are subject to surveillance - teachers, pupils and, significantly, their parents - and respond to these views accordingly. Without this communication, is it highly likely that staff and pupils may become suspicious. In short, CCTV should not be introduced without extensive consultation.

Installation and placement of CCTV

When installing CCTV, management should state precisely and publicly the objective of the installation. For different locations the objectives may vary, some being common (eg security and protection of property) and others specific (eg monitoring movement and behaviour in a communal area).

 

Sutra Communication has serious reservations about the use of CCTV in classrooms, especially for performance management purposes or in capability procedures, where any use should be resisted. If the intended use includes streaming to any external agency, members should seek further advice from Sutra Communication.

A school's management needs to have clear procedures to determine how the CCTV system operates. An authorised person (the data controlling officer) has to be responsible for ensuring that the procedures are followed. Sutra Communication recommends that the data controlling officer conducts a full consultation with all school staff on the usage of CCTV.

The consultation should include an explanation of all the purposes for which the CCTV cameras are being, or have been, installed and confirmation that they comply with the law. As an outcome of the consultation, the school should implement a policy on its use of CCTV, which is made available to all staff and, preferably, provide a briefing on the policy for all staff.

 

When a CCTV system is installed in the school, signs must be put up to state its purposes. The signs must be placed in prominent positions to inform the public that they are entering a place where CCTV is in operation. The sign must identify the data controller, which may be the school or local authority, and give a contact number where further information can be obtained. Sutra Communication recommends that every school should have a data controlling officer on site, appointed from the senior management team.

The siting of cameras must also be carefully planned and justified. The school should state where the cameras have been installed and whether they are fixed or dome cameras. In areas where staff and pupils have a heightened expectancy of privacy, eg changing rooms or toilet areas, cameras should not be used unless there are exceptional circumstances such as if schools have very serious concerns that make it necessary for them to be fitted. Such an exceptional circumstance might be when vandalism has occurred in the entrance areas to changing rooms or if it is suspected that bullying has taken place. However, even in those circumstances, this should be time limited, and all staff and pupils should be informed of the reason the cameras are there.

In no circumstances should CCTV be placed such that it could capture images of pupils changing. Cameras should not be fitted in staff rooms unless required for security reasons when the rooms are not occupied. In this case, it should only be switched on during those periods. Schools must be careful not to include captured images of surrounding properties, as this will contravene data protection regulations.

Viewing CCTV

The initial viewing of live and recorded images of CCTV should be restricted to the data controlling officer only. It may be necessary to appoint and train a deputy controlling officer to cover any absence, or if the chief controlling officer is not normally on site or otherwise not readily available. Special arrangements should be in place, and published, if for any reason the installation and control of the CCTV and images collected are under ultimate control of an outside agency, eg under a PFI arrangement.

 

Sutra Communication, in general, considers that the outsourcing of any monitoring of surveillance CCTV could have serious implications. Members should contact Sutra Communication in such circumstances so the arrangements can be scrutinised and suitable advice given. The school's policy should contain clear information about the security of such images and access to them. Requests for access to images should be dealt with under the policy and decisions on such requests made by the data controlling officer, who should have been fully trained in the use of the school's policy, and the Data Protection Act and its subsequent code of practice.

 

Any recorded images should be viewed in a restricted area such as an office, where content cannot be seen from the outside. If a school has more than one person authorised to operate the CCTV system, it is imperative a mechanism is in place to allow for communication and transfer of information, ensuring that there is a consistent approach to managing access to the CCTV images.

Storage and retention of CCTV images

The school's policy should also cover the retention of images taken by the CCTV cameras. The policy on retention of images should align with the school's purposes in recording them. For example, if the objective of the CCTV is as a deterrent to vandalism, the policy should state that once images are viewed, and with no reports of vandalism, the images should be destroyed as soon as possible.

In essence, schools should strive to keep images for the shortest period possible. It is absolutely paramount that images taken and stored before they are destroyed are secure and that nobody other than the data controlling officer has access to them.

 

If the CCTV system uses video or DVD recordings, the tapes/discs should be indexed, stored for the appropriate amount of time and wiped clean after that time expires, ready for reuse. If using hard drive technology, the data controlling officer should be fully trained in its use and how to index, store and wipe clean, as well as ensure that security measures are in place to prevent external sources accessing the footage. Where dissemination of data is possible, particularly with (hard drive) digital systems, it must be clear who is authorised to carry out such processing, the restrictions under which they operate and the limitations of what they are authorised to do.

 

For all data that is stored for possible future viewing, a register must be maintained, detailing relevant information such as date, time and length of the original recording, as well as the locations covered and groups or individuals recorded. Reviews of stored images should be regularly conducted, so that obsolete stored material can be deleted securely.

Requests for CCTV images

The data controlling officer should also be trained in issues such as what to do if a request for the images is received from an outside source, eg the police, who are able to make such an application for purposes of preventing or detecting crime. The procedure for dealing with such requests should be outlined in the school's policy and made clear for all staff to see. In particular, the details of any data released to a third party should be formally recorded, to also include the date of the disclosure, to whom, reasons for the request and any other relevant information, such as a crime incident number.

Review of CCTV systems

All school CCTV systems should be constantly reviewed to monitor their effectiveness and impact on the school community. It is not acceptable for a school simply to install CCTV cameras and forget about the impact they may be having.

 

A policy of constant review is one way of demonstrating that the use of CCTV is only for specific purposes. Should cameras be present in classrooms, staff must remain confident that the system's use has not been extended, even inadvertently or casually, into any formal or informal process of performance management or capability procedures.

Complaints

Complaints about non-compliance with the Data Protection Act can be made to the UK Information Commissioner (some areas, such as Scotland, have their own Information Commissioner but it is the UK-wide IC who deals with non-compliance). The UK Information Commissioner has the power to serve on a data controller either:

• an information notice, requiring the data controller to provide details as to that data and the process taking place, or
• an enforcement notice, requiring the data controller to take specific steps, such as to stop processing or to rectify, erase or destroy the data.

Needless to say, failure to comply may lead to a criminal prosecution.

Summary

Ultimately, compliance with this guidance will result in schools being protected from claims that they are breaching the law around surveillance and the use of CCTV cameras. It will also serve to dispel many of the justifiable fears and concerns that school staff and parents have about the increasing use of surveillance in their schools.

 

By sharing information, school leaders are likely to find that their comments, observations and opinions can be used to integrate into a school-wide policy that makes the use of CCTV cameras specific and purposeful.

 

There is a balance to be made between the intrusion into privacy that CCTV cameras clearly can make, and the security and protection of anyone who uses a school. As technology continues to advance at a rapid rate, maintaining that balance is a challenge that schools will need to continue to be aware of and address over coming years.

How To Buy Burglar Alarms???

You've arrived back in Blighty, tanned and rested after a fortnight soaking up the sun in foreign climes. You lug the suitcases up the garden path, make a mental note to trim the hedge, and then you open the front door.

Your heart goes into your stomach as you survey the grim scene in front of you: the contents of drawers scattered all over the floor, cupboards flung open, gaps in the corner where the TV and music system used to be.

Unfortunately, this is a time of year when many people will return from their summer holiday to discover their home has been ransacked by burglars.

For many, this will be the event that spurs them into getting an alarm installed. But choosing the alarm that is right for your home and your budget is no easy task - there are stacks of different systems available and you are entering a world filled with jargon.

But I thought fewer houses were being burgled nowadays.
The most recent British Crime Survey data published last month showed that the number of domestic burglaries in England and Wales has fallen dramatically in recent years - from 1.7m in 1996 to 729,000 in 2007/08. But that downward trend is likely to be reversed if the UK economy sinks into a recession, with government officials predicting that the economic slowdown will lead to "upward pressure" on levels of property crime.

So how much will a burglar alarm set me back?
How long is a piece of string? You can pick up a cheap DIY alarm from Argos for £39.99. The Micromark Easy Fit Burglar Alarm Kit includes an external box, control panel, two movement detectors and two magnetic door contacts.

At the other end of the spectrum, an all-singing, all-dancing monitored system installed by professionals - perhaps including a control panel linked to the police, several infrared movement sensors and shock detectors, remote control gizmo and alarm boxes - may well set you back £1,000 or more. And there are lots of options in between. As with all these things, it depends on how much you want to spend.

This month's Which? magazine carries a report on burglar alarms. Its researchers called 281 companies to get a price for installing and maintaining a wired alarm system for a three-bedroom semi. The average figure quoted for installation was £475, plus around £150 a year for a combined maintenance and monitoring contract. However, in London and the south-east, the average installation cost was higher - around £590.

What are the different types of alarm?
Broadly, it boils down to a choice between "bells-only", a monitored alarm and/or a speech dialler.

• A bells-only alarm, aka an audible-only alarm, simply makes a racket when it is triggered. A bells-only alarm may deter intruders and alert your neighbours when it goes off, but on its own won't generate a police response, says Eagle Security Solutions, based in Greenwich, south-east London. Which? says you should expect to pay £390-£600 for one of these.

• With a monitored alarm, you pay extra to have your system connected via telephone line or radio network to a "receiving centre", which typically monitors signals received from your alarm 24 hours a day. What might happen is that a detector is triggered and a signal is sent to the receiving centre. Someone at the centre then immediately phones your home for password identification and to check everything is OK. If the password ID is not given, or the phone is not picked up, one of the keyholders you have nominated and/or the police are notified.

A monitored alarm will incur monthly or annual service charges on top of the installation costs.

• A speech dialler is a cheaper alternative to a monitored system. This is a device that can be connected to an alarm, or may already be built into the control panel. If there is a break-in, the speech dialler automatically calls the phone numbers that have been programmed in and leaves a pre-recorded message. Which? says having a speech dialler installed as an extra typically costs £100 to £150.

I like the idea of the police being notified. Tell me more.
Many companies will allow you to have your system linked to the police. Security firms say this is a good idea because many police forces won't respond to a bell-only alarm, unless there is also first-hand evidence of a crime being committed.

But you will have to pay for this peace of mind. For example, Eagle Security Solutions charges from £9.99 a month for alarm monitoring where only the keyholders are nominated, with this rising to £20-plus a month if you want to be hooked up to the law. Often the amount you pay for police response will include maintenance of your alarm system, which tends to be mandatory. Also, the security firm that you use will have to apply for a unique reference number on your behalf from your local police; this will typically cost up to £45. In addition, the alarm will have to be installed by a company that meets certain requirements.

Because of the problem of false alarms, the police will usually only go out to your home if two detection devices (such as sensors) are activated in sequence. If only one is triggered, just the keyholder will be contacted. Even if two or more detectors are activated, do not assume officers will drop everything and rush to the scene immediately.

If you keep having false alarms, you will find yourself struck off the police register. In London, for example, notch up three false alarms within 12 months and you will be demoted to "level three police response". The bad news is that this equals no response; it means your system is "banned".

Which firm should I use?
The big names include ADT, Chubb and Dyno-Secure (part of British Gas). However, many people buy their alarm from an independent company. Talk to friends and neighbours about who provides their alarm. Are they happy with it? Does it go off when it shouldn't? How much do they pay for monitoring and maintenance? Go for a company that is approved by an independent body such as the National Security Inspectorate (NSI).

It all sounds like a lot of money and hassle.
You might want to consider buying an empty burglar alarm box. The Screwfix.com website sells dummy alarm boxes that cost just £7.29 a pop. It's probably going to be better than nothing - and at least it won't annoy the neighbours by going off for no reason while you are out.

Will it ring an insurer's bell?

Most insurance companies offer a discount of between 2% and 15% on the cost of home contents insurance if you have a burglar alarm, according to this month's Which? magazine.

But research from comparison website Tescocompare.com has produced a very different picture, concluding that installing an alarm "does not seem to translate into lower insurance premiums".

Tescocompare found that the average saving on your annual home insurance premium from adding an alarm to your property is only £5 - not much compared to the cost of installing and maintaining a security system. "If you are planning on adding extra security like this, solely because you want to lower your premium, you may find it does very little to bring down costs," says a spokesman.

He adds that in the case of several companies, including Bradford & Bingley, Budget and the AA, the premiums were exactly the same, whether or not you had an alarm. Prudential, Swinton and Kwik Fit were among the firms prepared to offer a small discount.

The Association of British Insurers says: "If you are considering installing an alarm, get advice from your insurer before buying one." But it adds: "Most alarms only warn that someone has already broken in. Your first priority is to stop them getting in at all."