Surveillance privacy notice

Network Rail takes your right to privacy seriously and want you to feel comfortable when using our premises. Information by which you can be identified will only be used in accordance with this privacy notice and only for the reasons you are aware of.

Personal information in the context of surveillance systems is an image, audio or other information from which a living individual can be identified where:

• The individual is the focus of the image
• The image contains or shows significant information about that individual
• The audio commentary identifies the individual  
• The processing of the image/audio affects the individual’s privacy

1. What personal information do Network Rail hold about you on our surveillance systems?

The personal information we may collect includes visual imagery and audio commentary from our surveillance systems (including CCTV, high resolution cameras, Body Worn Cameras etc. please refer to Appendix 1) across our infrastructure (managed stations, level crossings, corporate sites, bridges), Network Rail maintenance trains, level crossing maintenance vans and occasionally on our assets and temporary worksites for short-term security where necessary.

From 2022 Network Rail will be running trials with camera systems with analytical capabilities at a number of managed stations plus Marsden, Dawlish, and Dawlish Warren.

2 .Who is responsible for the personal information that Network Rail collect and how will we use it?

Network Rail Infrastructure Ltd are the data controllers of surveillance systems on our infrastructure (Network Rail managed stations).  Network Rail capture, record and monitor record images and audio commentary at our sites to monitor and maintain safety and security of property and premises and the prevention and detection of crime. Where camera systems with analytical capabilities are operated, the data will be used to improve the performance of our public functions, our business and services.

3. Who will Network Rail share your personal information with?

Network Rail may share your personal information with:

Governmental, regulatory and legal authorities and third parties involved in legal action
Government departments, governmental agencies, regulatory organisations and justice agencies.

British Transport Police (BTP) have access to surveillance systems at our managed stations via their control centre at Ebury Bridge.  BTP provide a redaction service (faces or identifiers removed) on Network Rail’s behalf.

Third parties for safety matters – Train and Freight Operating Companies, station tenants, Network Rail teams and designated public bodies (e.g. West Midlands Combined Authority which covers Transport for West Midlands who manage the Regional Transport Coordination Centre (RTCC) – who may also share information with RTCC members where necessary).

Before Network Rail authorise any surveillance system disclosures, third party or law enforcement bodies must demonstrate the request is proportionate and necessary in assisting them with the prevention or detection of a crime or safety matter.

4 . How will Network Rail store and protect your personal information?

Network Rail have put in place appropriate technical and organisational security measures to prevent your personal information from being accidentally lost, altered, used, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to access this and who are subject to a duty of confidentiality. In the case of third-party data processors, they will only process your personal information on our instructions and have their own legal obligations under data protection law to protect your personal information and keep it secure.

Network Rail surveillance data is not processed outside the European Economic Area (EEA).

Network Rail have put in place procedures to deal with any suspected personal data breach and, will notify affected parties and the regulator of such instances where we are legally required to do so.

5. How long will Network Rail keep your personal information for?

Surveillance system data across our sites is held for up to 31 days from the time of recording.  Recording times from body worn cameras and cameras at level crossings may vary.   Surveillance system data disclosed to law enforcement agencies, third parties, internal safety investigation teams or subject access requests will be stored for six years in line with the Network Rail retention guidelines.

6. What are my rights in relation to personal information?

Under data protection law you have data subject rights, depending on the reason for processing; most do not apply to video surveillance processing.

You can exercise the right to access your personal information by submitting a subject access request.  The subject access request form provides guidance on how to complete a subject access request, the information we require and where to submit it.  Subject access requests for surveillance systems should be addressed to the relevant station/level crossing contact found on the subject access request form.  Please refer to Network Rail managed stations for a list of our stations.

Although the form is not mandatory, it provides guidance and ensures that we can review your request as swiftly as possible. We will respond to all requests within one month, unless an extension is required. Further information is available on the Network Rail Data Protection page.  Please note that surveillance system data is only kept for a limited time.

No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, Network Rail may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What Network Rail may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information. This is a security measure to ensure that your personal information is not disclosed to any person who has no right to receive it.  We also require specific information e.g. exact details of location, date and time, to speed up our response.  

Third party arrangements
Network Rail use third parties to manage and provide surveillance systems in our managed station car park. Retail tenants may also manage and process surveillance data within their units.  There should be clear signs which will provide you with the data controller of the equipment, and this may vary from station to station.

Train Operating Companies
Please be aware that surveillance data may be held by a train operating company, rather than Network Rail.  You can find the appropriate train operating company on the National Rail Enquiries website.

7. How can I complain or get further information?

Questions, comments and complaints regarding data protection matters are welcomed and should be addressed to the Data Protection Officer.

Data Protection Officer
Network Rail
The Quadrant, Elder Gate
Milton Keynes
MK9 1EN
Telephone: 03457 11 41 41

If you are not satisfied with our response to your request, you can contact the Information Commissioner who will be able to assist you further. They can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545 700
Website: www.ico.org.uk

Appendix 1

Useful links