1. Purpose of processing
PwC Belgium cvba (‘PwC’) collects data through the CCTV system for various reasons:
- To control access to the building and to ensure the security of the building, the safety of PwC staff and visitors, as well as property and information located or stored on the premises;
- To prevent, deter, and if necessary, investigate unauthorised physical access, including unauthorised access to secure premises and protected rooms, IT infrastructure, or operational information;
- To prevent, detect and investigate a theft of equipment or assets owned by PwC, visitors or staff, or threats to the safety of personnel working at the office (e.g. fire, physical assault).
The CCTV system is not used for any other purpose, such as to monitor the work of employees or their attendance. It’s important to note that the location and positioning of the video cameras is not intended to cover the surrounding public space.
The cameras are aimed to give a general overview of what's happening in certain places, but the purpose is not to recognise people unless a security or data protection incident is involved. Nor is the system used as an investigative tool or to obtain evidence in internal investigations or disciplinary procedures unless a security or data protection incident is involved. (In exceptional circumstances, the data may be transferred to internal (e.g. ISAB, Data Protection Officer) and external (e.g. police forces, the Data Protection Authority) compliance, security or investigatory bodies in the framework of data protection compliance, a formal disciplinary or criminal investigation).
The CCTV cameras are installed (i) at the building entrances, (ii) at the parking entrance and parking lots, (iii) inside the PwC building and are placed and focused in a way that only people who want to access the site or the annexed facilities including parking areas are filmed. The CCTV system covers the area of entry and exit points of the building, entry points inside the building, delivery, garage (e.g. ANPR Camera) and the outer area of the building. The ANPR camera at the garage entrance and exit aims at filming the licence plates of the cars entering the parking lot.
2. Legal grounds
PwC uses video surveillance equipment for the legitimate interest of PwC for security and access control purposes, which is necessary for the management and functioning of PwC.
Therefore, the processing is lawful under Article 6.1.f of the General Data Protection Regulation.
In addition, where cameras are used, there’s one clearly visible, on-the-spot sign with the contact information of the controller, the Data Protection Officer (DPO) and a QR code with url link leading to the CCTV Privacy Notice with more information on video surveillance activities.
3. The following information may be collected from you by PwC
PwC only collects images caught on camera, no sound or voice is recorded.
4. Who is responsible for processing your personal data?
The controller is responsible for the processing of your personal information. The controller is PwC Belgium bcvba (‘PwC’).
Contact details of the controller:
PwC Belgium cvba
Woluwedal, Woluwe Garden 18
1932 Sint-Stevens Woluwe
Phone: +32 (0)2 710 4211
5. Recipients of the personal data
Who has access to CCTV images and streaming?
The video images and streaming can be accessed only by the dedicated General Service Security staff of PwC Belgium and by the contracted security company.
Access to the hard-disk video recorder is highly limited, being protected by a password. The data cannot be accessed without the authorisation of the Head of General Services.
6. Data Transfers
PwC member firms do not sell or otherwise disclose your personal data collected for this purpose to third parties. Only government officials (police, fire department, judicial department, the Belgian data protection authority, etc.) can - only when required by law - request and receive access to the data footage.
We retain the personal data processed no longer than necessary for the purpose for which it was collected (including as required by applicable law or regulation).
The recorded data is in principle erased automatically after a period of maximum 30 days when it’s automatically overwritten by new video footage.
8. Individuals’ rights and how to exercise them
As a data subject, you have certain rights over your personal data and data controllers are responsible for fulfilling these rights.
Access to personal data
You have a right of access to personal data held by us as a data controller. This right may be exercised by emailing us at email@example.com. We’ll aim to respond to any requests for information promptly, and in any event within the legally required time limits (currently 30 days).
To update personal data submitted to us, you may email us at firstname.lastname@example.org or, where appropriate, contact us via the relevant website registration page or by amending the personal details held on relevant applications with which you registered.
Amendment of personal data
Can I modify my data? Modifying the CCTV footage is not allowed. However, you can modify the report written by the security staff in connection with a security incident, if applicable in your case.
Other data subject rights
You have the right to block the processing of your personal data at any time by sending an email request to email@example.com when you contest the accuracy of your personal data or when PwC no longer needs the data for completing its tasks. You can also block the processing activity when the operation is unlawful, and you oppose to the erasure of the data. However, blocking is not possible in case of an official investigation.
You have the right to delete your data at any time by sending an email request to firstname.lastname@example.org when the processing activity is unlawful.
You have the right to object at any time by sending an email request to email@example.com when you have legitimate reasons relating to your particular situation. Moreover, you’ll be informed before your information is disclosed for the first time to third parties, or before it’s used on their behalf. PwC will address your requests within 30 days from the receipt of the request.
This privacy statement is intended to provide information about what personal data we collect about you and how it’s used. As well as the rights of access and amendments referred to above, individuals also have other rights in relation to the personal data we hold, such as a right to erasure/deletion, to restrict or object to our processing of personal data and the right to data portability.
If you wish to exercise any of these rights, please send an email to firstname.lastname@example.org.
We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to PwC’s data protection officer:
PwC Belgium, Data Protection Officer
Woluwe Garden, Woluwedal 18
1932 Sint-Stevens Woluwe
Phone: 02/710 4211
You also have the right to lodge a complaint with the Belgian Data Protection Authority: www.gegevensbeschermingsautoriteit.be
9. When will PwC start the processing operation?
We will start the processing operation when you’re visiting PwC`s premises.
10. Security of personal data
PwC is committed to protecting the security of your personal data. Therefore, we use several security technologies and procedures to help us protect your personal data from unauthorised access, use or disclosure. We keep your data on video and computer systems that are limited in access and are in controlled facilities.
11. Regular updates of the CCTV Privacy Notice
This Privacy Notice will be regularly updated.