This privacy notice is intended to provide information about how Hermes Airports Ltd, the Cyprus Police and the Department of Civil Aviation collect and process personal data about you captured by the closed-circuit television (“CCTV”) surveillance systems that operate at Larnaka and Pafos International Airports (the “Airports”).
1. Organization responsible for processing your personal data
Video surveillance is controlled by Hermes Airports Ltd, a company registered in Cyprus with company number HE152453 and registered office at Larnaka International Airport, 6650 Larnaka, Cyprus, the Cyprus Police and the Department of Civil Aviation (DCA) who j are jointly the Joint Controllers (“Controllers”) of your personal data pursuant to EU General Data Protection Regulation 679/2016 (“GDPR”) and Cyprus law 125(I)/2018.
Please see below the contact details of the Data Protection Officer of Hermes Airports Ltd:
Head Office, PO Box 43027,
Larnaka International Airport 6650
Larnaka, Cyprus
Email address: dpo@hermesairports.com
Phone: +357 24 742 132
2. Information processed
When you use the Airports, the Controllers may collect static or moving imagery and meta data such as vehicle plate data, via the surveillance system (“Surveillance Data”). There is no sound or voice being recorded.
3. Purposes of processing
The Controllers use Surveillance Data for the following purposes:
-
To identify suspicious actions, prevent crime and protect premises and assets from damage, disruption, vandalism and other crime;
-
To ensure the required coordination with responsible governmental authorities for the prevention of illegal and/or unlawful acts at the Airports;
-
For the personal safety of staff, stakeholders, passengers, airlines, visitors and other members of the public and to act as a deterrent against crime;
-
To support and assist law enforcement bodies in the prevention, detection and prosecution of crime;
-
Meet obligations under contract or applicable laws in respect of airport security, aviation safety, and health and safety;
-
For the investigation of legal or other claims or allegations;
-
In response to a data subject request;
-
For performing car park services at the Airports; and
-
To run its business and optimize operational capability,
together the “Purposes”.
4. Areas of processing
The Airports are classified as critical infrastructure by the Republic of Cyprus and for this reason CCTV is necessary in order to contribute to the application of an effective airport terminal security program and to enhance the passengers’ and staff’s feeling of security and safety. CCTV provides the Airports’ operations and security centres with a general overview of what is happening throughout the Airports’ facilities. Individuals are only identified if it is necessary to meet any of the Purposes.
Surveillance Data collected inside the terminal building covers the passenger journey, starting at the entrance of the terminal of each Airport and ending when boarding the aircraft for departing passengers, or starting when passengers disembark the aircraft and ending when exiting the terminal for arriving passengers. Passenger baggage that is dropped off at the check-in counters is also being monitored by CCTV for the Purposes.
Moreover, the airport car park area is being monitored for the Purposes. Surveillance Data collected at this location involves the car park entry and exit points (enables Automatic Number Plate Recognition (ANPR), and the parking and drop off/pick up areas located near the entrance to the terminal of each Airport.
On airside, parts of the apron and manoeuvring areas are being monitored for the Purposes. Surveillance Data collected on airside covers activity around the aircraft parking stands including the aircraft turnaround process and in the manoeuvring area.
Also, all airside entry and exit points and the security screening points are being monitored for the Purposes.
No Surveillance Data is collected in areas where an individual would expect privacy, for example the rest room areas.
5. Information notices
Individuals are being informed of the surveillance activity taking place at the Airports with clearly visible signage installed in prominent spots.
6. Lawful basis
The processing is lawful under Articles 6.1.c and 6.1.f of the GDPR. The processing of Surveillance Data is necessary for:
-
Compliance with a legal obligation to which the Controllers are subject:
-
Article 10(1)(c) of Law 44(I)/2019, which provides:
“The processing is necessary for the performance of a task by a competent authority for the purposes provided for in paragraph (a) of Article 3, which is based on Union law or on the relevant national legislation.”
-
The Police Law (Law 73(I)/2004)
The responsibilities of the Police, as defined by the Police Law, include the maintenance of law and order, the preservation of peace, the prevention and detection of crime, and the arrest and prosecution of offenders, while other specific provisions assign to the Police duties relating to guarding, detention, and the maintenance of order.
-
The Civil Aviation Law of 2002 (213(I)/2002)
-
Regulation (EC) No 300/2008
-
Commission Regulation (EU) No 139/2014 laying down requirements and administrative procedures related to aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (including the applicable EASA certification specifications (CSs) and acceptable means of compliance (AMC)
-
The purposes of the legitimate interests pursued by the Controllers who use video surveillance equipment for the purposes of airport security, aviation/personal safety, crime prevention, protection of airport premises and operational capability optimization.
7. Access to Surveillance Data
-
Surveillance Data can only be accessed by CCTV operators and authorised employees of the Controllers.
-
An access / footage release application and authorization process is in place for third parties requesting access to Surveillance Data.
8. Retention period
Surveillance Data is retained for fourteen (14) days and then deleted permanently through an automated system process. Surveillance Data may be extracted prior to the expiration of the retention period for the Purposes and in accordance with the applicable Surveillance Systems Installation and Data Processing Policies of the Controllers.
9. Data Transfers
The Controllers may share Surveillance Data with competent judicial and law enforcement authorities. The Controllers may also share CCTV surveillance footage with their stakeholders on occasion where they consider it necessary to pursue a Purpose.
The Controllers require all third parties to respect the security of your personal data and to process it in accordance with applicable law.
The Controllers do not authorise third parties to use the video footage for their own purposes and only permit them to process it for specified purposes and in accordance with the Controllers’ instructions.
10. Individuals’ rights - how to exercise them
As a data subject, under the GDPR and applicable legislation you have the right to, where appropriate:
-
Access your personal data by making a subject access request
-
Rectification, erasure or restriction of your information
-
Object to the processing of your information
If you wish to exercise any of these rights, please send an email to dpo@hermesairports.com.Your requests for CCTV are first reviewed by the Data Protection Officer (DPO) of Hermes Airports Ltd, who is the appointed initial point of contact for the Controllers concerning Data Subject Requests. The Hermes Airports Ltd DPO identifies the responsible joint controller and either (i) handles the request if it involves Hermes Airports Ltd or (ii) forwards it to the DPO of the responsible joint controller.
You will not have to pay a fee to exercise any of your rights. However, the Controllers may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We aim to respond to any request for information promptly, and in any event within the legally required time limits (currently thirty (30) days).
11. Complaints
If you are unsatisfied with our response or handling or your personal information, you also have the right to make a complaint to the Commissioner for Personal Data Protection, the Cyprus supervisory authority for data protection issues. We would, however, appreciate the chance to address your concerns before you approach the Commissioner, so please contact us in the first instance.
12. Security of personal data
The Controllers are committed to protecting your personal data and use several security technologies, controls and procedures to help protect your personal data from unauthorised access, use or disclosure. The Controllers keep your data on video and computer systems that are limited in access and physically kept in access-controlled facilities.
13. Regular updates of the CCTV Privacy Notice
This Privacy Notice will be regularly reviewed and updated to reflect any changes to the processing activity.
