GMCA Tootal Buildings CCTV Privacy Notice

The purpose of this Privacy Notice is to explain how and for what purposes we process your personal data. It applies to Greater Manchester Combined Authority (“GMCA”) employees; employees of other organisations based in the GMCA’s Tootal Buildings offices; and any guests or visitors to the offices.

For further information on how the GMCA use personal data please visit:

Privacy Policy and Data Protection

Information collected and why

The Greater Manchester Combined Authority (GMCA) has installed CCTV cameras at the entrances and exits of its offices at the Tootal Buildings, 56 Oxford Street, Manchester M1 6EU. These cameras have been installed for security purposes, to provide a safer environment for people who work at and visit these offices. These purposes include:

• The prevention and reduction of crime and disorder
• The detection and investigation of crime
• The identification, apprehension and prosecution of offenders
• Accident and incident investigation and reporting

The CCTV cameras collect:

• Live video recordings (24 hours a day)
• These recordings contain visual images of employees and visitors going about their daily business, as well as any offenders or individuals who access the offices without authorisation
• Recordings of incidents and accidents

The GMCA is the Data Controller of any personal data collected via these CCTV cameras (ICO registration reference: Z5119967)

Signs are displayed at each entrance notifying staff and visitors that CCTV is in operation, its purpose, and to provide contact details for further information about the scheme.

We will not:

• Provide recordings to any third parties unless for the purposes outlined above and in compliance with relevant legislation
• Provide recordings to members of the public or third-party organisations for profit, gain or commercial exploitation
• Make decisions about you using automated decisions

Lawfulness of processing

Data is collected and processed in compliance with all applicable laws, including but not limited to the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The legal basis we rely on for processing your personal information is:

GDPR Article 6(1)(e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; including our duties under the Health and Safety at Work Regulations.

The below is a non-exhaustive list of additional legislation which applies to our use of CCTV footage:

• Protection of Freedoms Act 2012
• Human Rights Act 1998 (HRA)
• Freedom of Information Act 2000 (FOIA)

Who your information will be shared with 

• Authorised GMCA employees, who have access to live and recorded images (including designated staff from our ICT, Land & Property, and Security & Reception teams).
• Police and other law enforcement agencies, in relation to the prevention or detection of crime and/or the apprehension and prosecution of offenders. Law enforcement agencies are required to submit a written request and footage will only be disclosed (or access granted) if their request is justified and proportionate.
• We may share footage with other agencies where legally required. For example, in response to a court order.
• In emergency situations, information may be shared with other agencies such as the fire service, ambulance and other relevant agencies as required.
• We may also share footage of accidents and incidents internally with relevant teams and externally with insurance companies, where necessary for the establishment, exercise or defence of legal claims.

How long will we hold your data for

CCTV footage is stored for c. 90 days. After this it is automatically deleted from our systems.

Footage that is required for any of the purposes outlined in this Privacy Notice will be downloaded. These images will be retained for as long as they are needed for the given purpose, in line with the GMCA’s Retention Schedule.

How we keep your data secure

The GMCA is committed to the security of your personal information. We aim to ensure that we have appropriate physical, technical, and organisational controls in place to protect all personal data we collect or receive. For example, ensuring our network is protected and monitored. All our employees receive training on how to handle personal data securely.

Your rights

The GDPR gives you certain rights over your information, including but not limited to:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure

For further information on your information rights please see the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/

To exercise any of your information rights, please contact us at:

Please note that:

• Requests to access or erase footage will be considered alongside the rights of any other individuals who may be captured in the same footage. We may not fulfill requests if we have concerns about risks to other individuals.
• You may be required to provide copies of photo identification (e.g. passport or driving license) so we can verify your request.

If you are not satisfied with how the GMCA is using the information we hold about you, or how we have handled your information rights request(s), please:

Email our Data Protection Officer 

If you are still not satisfied with the response from us, you can complain to the Information Commissioner’s Office at:

Last updated: 10/10/2022