IHRB CCTV Privacy Notice

 Table of Contents

Introduction.

Data Controller.

Purpose.

What personal data we collect.

Legal basis for processing.

How we obtain CCTV information.

Why we use CCTV cameras.

Sharing information with Third Parties.

International data transfer.

How do we keep your records secure and confidential.

Retention period.

Access to your CCTV records.

Your data protection rights.

Changes to privacy notice.

Introduction

Irish Horseracing Regulatory Board (“IHRB”) is the regulatory body for horseracing in Ireland who is committed to protecting privacy and is responsible for enforcing of the rules of racing as well as monitoring and ensuring the safety and security of the horses. As such, the IHRB has installed CCTV cameras in the ‘Stable Yard’ area of all its controlled racecourse properties in Ireland.

CCTV recordings are considered to be personal data under data protection law as they can be used directly or indirectly to identify or re-identify individuals. As such, IHRB have a duty of care and are obliged to secure this personal data to prevent it being accessed by unauthorised individuals. 

Data Controller

“IHRB” (referred to as “we”, “us”, “our” or “IHRB”) in this privacy notice primarily refers to Irish Horseracing Regulatory Board. IHRB will process all personal data in compliance with the General Data Protection Regulation (GDPR) and any applicable local privacy law.

For the purposes of data protection legislation, the Data Controller of your personal data is:

Irish Horseracing Regulatory Board
The Curragh
Co. Kildare
R56 Y668

E-mail: dataprivacy@ihrb.ie
Telephone: +353 45 445 600
Fax: +353 45 445 601

Purpose

IHRB respect your right to privacy and to the protection of your personal data, and comply with the Data Protection Acts 1988-2018 and the General Data Protection Regulations (GDPR). The purpose of this CCTV privacy notice is to explain how we process personal information collected via the use of CCTV systems installed by IHRB in the stable yard area of all racecourses.

What personal data we collect

IHRB CCTV  cameras are operational only on race days and collect the following.

• Your image as it appears on CCTV cameras
• Times and dates related to your presence in the stable yard area

The personal data collected in the CCTV system in all cases processes video images of data subjects. No audio data is collected.

Legal basis for processing

Any processing of personal data is only lawful where it has a ‘legal basis’. Article 6 of the GDPR sets out what these potential legal basis are, namely: consent, contract, legal obligation, vital interests, public task and legitimate interests.

The legal basis on which IHRB are processing personal data is legitimate interest and legal obligations.

Legitimate interest: the processing of personal data is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect data subject’s personal data which overrides those legitimate interests.

These types of processing of personal data are strictly necessary and proportionate for our purpose and the interests, the fundamental rights and freedoms of the data subject are not overridden, taking into consideration the reasonable expectations of data subjects based on their relationship with IHRB. 

For example, it is IHRB legitimate interest to safeguard racecourses; to both deter and detect breaches of the rules of racing and malpractice in racing (e.g. doping, mistreatment of horses) and to deter and detect thefts of property from the stable yard area i.e. security reasons. Hence, it would be necessary to have CCTV in operation.

Legal Obligation: There could also be circumstances where it is IHRB legal obligation to disclose or share personal data to be compliant, pursuant to a legal request, subpoena or other legal processes, or in order to enforce or apply the company’s terms of use and other agreements.

For example, IHRB could get a request for sharing a footage with the Garda Siochana in order for them to investigate or detect a crime.

How we obtain CCTV information

CCTV cameras will be used to record, monitor (stream) all the locations in the stable yard area on race days. The six primary locations in the stable yard area where CCTVs are in operation includes:

• Offloading Area;
• Stable Blocks;
• Entrance and Exit to the stable yard;
• The wash bays;
• The Vet yard; and
• The Sampling Units

The CCTV system provide the IHRB with video images from the cameras installed in the stable yard area. The video images are automatically transmitted/stored onto the Network Video Recorder (NVR) database. This database only stores recordings for race days, a process manually initiated via a key operated switch by IHRB security staff on arrival and terminated on conclusion of the race meeting.

CCTV systems capture images that may identify individuals directly, by capturing recognisable images of faces, or indirectly, by recording.

Why we use CCTV cameras

IHRB’s CCTV cameras are covering the perimeter of the stable yard area for the following purposes:

1. Controlling and safeguarding access to each premise and ensure only authorised people have the access
2. Recording sampling process for integrity purposes

• Deter and detect breaches of the rules of the racing and malpractices in racing (for example: doping, mistreatment of horses) from the CCTV coverage

1. Safety and security of horses, security staff and visitors.
2. to prevent, reduce and investigate crimes
3. to satisfy administrative orders from public authorities

Sharing information with Third Parties

IHRB may share your personal data from the CCTV system with the CCTV system maintenance provider for the limited purposes of incident processing and general maintenance of the CCTVs. We are careful only to share the information that is necessary for this purpose. Anyone who receives this information is also bound by confidentiality and by the data protection laws. The current list of those with whom personal data is shared can be found below:

In certain situations, we may have to disclose your personal information to other agencies, in accordance with legal requirements. Where necessary the CCTV footage may be provided to relevant third parties such as Horse Racing Ireland, An Garda Síochána, the Department of Agriculture, Food and the Marine and bodies responsible for the regulation of horse racing in other countries.

If, for example, the CCTV footage discloses breaches of the Animal Remedies Regulations, such footage may be disclosed to the Department of Agriculture, Food and the Marine for the purposes of its statutory functions pursuant to the Animal Remedies Regulations.

We may also share CCTV footage to respond to requests from government agencies, including law enforcement and other public authorities, which may include such authorities outside your country of residence.

International data transfer

We do not transfer CCTV information to countries outside the European Union. 

How do we keep your records secure and confidential

We are committed to ensuring that your information is secure with us and also with the third parties who act on our behalf. All the third parties involved do not have access to the CCTV footage. We have a number of security precautions in place to prevent the loss, misuse or alteration of your information.  All staff working for the IHRB have a duty to keep information about you confidential. The IHRB will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy notice.

We may disclose your information to trusted third parties for the purposes set out in this Privacy Notice. We require all third parties to have appropriate technical and operational security measures in place to protect your personal data, in line with Irish and EU law on data protection rules.

Retention period

We keep your personal data as long as required to fulfill the purpose for collection or to fulfill legal obligation. Afterwards, we delete your personal data, in particular:

• CCTV Images from the cameras installed in the stable yard area of the racecourse: Images are recorded and retained for a period of 6 months and automatically purged thereafter, except where specific extracts may be exported and retained, for example in support of an incident investigation. Where CCTV subject access requests are received requesting access to video clips from particular racecourse cameras on particular days, the IHRB will extend the retention period for the requested footage until the request is satisfactorily fulfilled.

Access to your CCTV records

You can access your records by making a subject access request (SAR). It is also sufficient to write to the IHRB at dataprivacy@ihrb.ie. It is important that you provide satisfactory evidence of identification and a sufficient description of the information that you are looking for. 

Your data protection rights

You have certain legal rights concerning your information and the manner in which we process it. This includes:

• a right to get access to your CCTV footage;
• a right to request that we restrict the processing of your CCTV footage in certain circumstances;
• a right to request the deletion of CCTV footage which includes your image
• a right to receive the CCTV footage in the portable format;
• a right to object to us processing your CCTV footage in certain circumstances; and
• a right to lodge a complaint with the Data Protection Commission.

Some of these rights only apply in certain circumstances and so are not guaranteed or absolute rights.

Individuals making such a request should provide the organisation with a photograph or a description of themselves, together with the relevant time and date of the image, so that they may be easily identifiable.

This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We will respond to all legitimate requests within one month.

All such requests should be made to the IHRB by sending an email to dataprivacy@ihrb.ie

If you are not happy with our response, or you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer at dataprivacy@ihrb.ie who will investigate the matter.

You have the right to lodge a complaint with the Data Protection Commission (DPC) via their website www.dataprotection.ie if you think that the IHRB has not processed your personal data in accordance with data protection legislation.

Changes to privacy notice

Our Privacy Notice may change from time to time and any changes to the statement will be communicated to you by way of publication on the IHRB website (www.ihrb.ie).