Depends who is the Data Controller doesn't it?
If it is the bus company which would own the CCTV footage and decide what
is done with it (as, presumably, it does in the case of its other
operations) than the company needs to have an appropriate notification.
If the Council is the data controller then the contract with the bus
company (as data processor) will need to spell out exactly what the company
can and can not do with the footage.
Regards,
Graham
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|