Data privacy notice on Video surveillance

Data controller

University of Oulu
Pentti Kaiterankatu 1
P. O. Box 8000, 90014 OULU

Contact information of the responsible unit:
Security Manager Jukka-Pekka Matero
jukka-pekka.matero(at)oulu.fi

University Data Protection Officer: dpo(at)oulu.fi

Purpose of processing personal data and legal basis for processing personal data

The processing of personal data is based on legislation concerning the University of Oulu and the university's legitimate interests. The purpose of camera surveillance is to prevent crimes and damages affecting the university's property in its public, teaching and equipment facilities, to investigate the liability for the damage caused, and to prevent and investigate other violations. The purpose of the surveillance is also to monitor the safety of the premises and maintain order, thus ensuring and increasing the safety of staff and students as well as persons visiting or working at the university's premises. Therefore, the legitimate interest is balanced for all parties.

Personal data to be processed

Basic information that includes a video recording of persons moving in sight of the camera area and a timestamp.

Recipients or categories of recipients of personal data

The video can only be viewed by the employees of the university and the partner providing security services whose duties include monitoring the security of the property and the system administrators for installation, maintenance and research purposes.

Access to the recordings is restricted and can only be viewed by the system administrator and their deputies, the University of Oulu security team and the employees of the security services; when separately agreed, the representatives of the units of the University of Oulu can also access the video. For other persons, the person responsible for the register determines on a case-by-case basis who the recording can be displayed to.

Information may be disclosed to authorities (the police) to the extent deemed necessary if the information is or is suspected to be related to vandalism or a criminal offence.

Data transfers

Data are not transferred outside the EU and EEA or to an international organisation.

Principles of protection of personal data during processing and the retention period

Personal data in digital format (on a computer or hard disk of similar equipment)
is password protected. Each person entitled to the processing of personal data has been given a unique password, the use of which can be monitored.

The retention period for the video recording is basically thirty (30) days after the data is collected. Data is destroyed by storing new data on top of it. Data is accessed by printing from a hard disk. If, during the retention period, a notification of damage, other offence or infringement is received, the record is kept for the time that is needed to investigate the incident. If the information is or is suspected to be related to an offence, vandalism or infringement, it is kept for the time that is needed to resolve the incident.

Data subject rights

The data subject may have a limited right of access to their own data if this right can be exercised reasonably and without jeopardising the confidentiality of security arrangements and the rights of others. Furthermore, in order to exercise the right, the data subject must provide additional information (time/place) so that they can be unambiguously identified in the record.
You may also have the following rights as a data subject:

• Right to rectify incorrect information
• Right to have data erased ("right to be forgotten")
• Right to restriction of processing
• Right to object to processing

Please note that the applicability and scope of the above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation and that you do not have the above-mentioned rights in all cases.
If you wish to exercise the right mentioned in this section, please contact kirjaamo@oulu.fi

If you have any questions about your rights, you can communicate with the University's Data Privacy Officer or the contact person of the responsible unit.

If you want to use the above-mentioned rights, please send a request to the University’s registry office: kirjaamo(at)oulu.fi, where you will get the necessary additional instructions.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.