INTRODUCTION. Combino Pharm (Malta) Limited of HF60, Hal Far Industrial Estate, Hal Far, Birzebbuga, Malta (the “Company”; “we”; “us” or “our”) values the trust of its employees and other workers (collectively, its “staff”), and is committed to protecting their personal data. In that regard, we believe that CCTV surveillance has a legitimate role to play in helping to maintain a safe and secure environment for all our staff and visitors. However, we also recognise that this may raise concerns about the effect on individuals and their privacy. This Notice is intended to address such concerns by informing you about: (i) the installation of CCTV cameras and recording within the Company’s premises, (ii) what personal data we collect as a result of this, and (iii) how we use this personal data, along with our reasons for doing so and the ways in which we protect it. It is addressed to all staff (including all employees, consultants, self-employed contractors, casual workers, agency workers, volunteers and interns) as well as to any individuals visiting our premises (i.e. “visitors”). For staff, this Notice should also be read in conjunction with our general privacy notice, together with any other policies which we may issue during the course of your employment or working relationship with us. If you have any further questions, please address them to: dataprotection@combinopharm.com.mt.
DEFINITIONS. In this Notice, the following terms have the following meanings: (i) “CCTV” means fixed and domed cameras designed to capture and record images of individuals and property; (ii) “data” means information stored electronically or in paper-based filing systems. In respect of CCTV, this generally means video images. It may also include static pictures such as printed screen shots; (iii) “data subjects” means all living individuals about whom we hold personal information as a result of the operation of our CCTV (or other surveillance systems); (iv) “personal data” means data relating to a living individual who can be identified from that data (or other data in our possession). This will include video images of identifiable individuals; (v) “controllers” are the people who, or organisations which, determine the manner in which any personal data is processed. They are responsible for establishing practices to ensure compliance with the law. We are the controller of all personal data used in our business for our own commercial purposes; (vi) “data processors” are any person or organisation processes data on our behalf and in accordance with our instructions (for example, a supplier which handles data on our behalf); (vii) “processing” is any activity which involves the use of data. It includes obtaining, recording or holding data, or carrying out any operation on the data including organising, amending, retrieving, using, disclosing or destroying it. Processing also includes transferring personal data to third parties. COMBINO PHARM (MALTA) LTD. 2
ABOUT THIS NOTICE. We have implemented CCTV cameras within our premises and we have also displayed signage and/or other visible marking to make you aware as to which areas are under CCTV surveillance. Together with those signs, this Notice outlines why and how we will use CCTV and how we will process data recorded by these CCTV cameras to ensure we are compliant with data protection law and best practice. It also explains how to make an access request or other data subject request in respect of personal data created or recorded by CCTV. This Notice covers all staff. It is non-contractual and does not form part of the terms and conditions of any employment or other contract. We may amend this policy at any time. This Notice will be regularly reviewed to ensure that it meets legal requirements, relevant guidance published by the Office of the Information and Data Protection Commissioner in Malta (“IDPC”) and industry standards.
REASONS FOR THE USE OF CCTVS. Through the use of CCTV, we will collect the following information about you:
Visual images which allows us to identify you and ascertain your location at a particular time (your “personal data”). We believe that the use of CCTV is necessary for legitimate purposes and legal obligations, including:
to prevent crime and protect our premises and assets from damage, theft, vandalism and other crime;
for the personal safety of staff, visitors and other members of the public;
to act as a deterrent against crime and unlawful / clandestine entry into our premises;
to ensure proper control of certain high-risk and/or sensitive pharmaceutical products manufactured or else stored on the Company’s premises (e.g. narcotic products). In particular, as regulated by Chapter 31 (Medical and Kindred Professions Ordinance) and Chapter 101 (Dangerous Drugs Ordinance) of the Laws of Malta and all subsidiary legislation, controlled drug substances require specific control measures to ensure appropriate secure storage and accurate reconciliation at all times. A secure physical environment provides the foundation for ensuring both adequate and safe management of the controlled drug substances that are manufactured / kept on the Company’s premises. A critical component of this secure foundation is having effective deterrent systems, such as intruder alarms, selective restrictive access control and high-resolution cameras to support any investigations;
to ensure that there are no breaches of confidentiality through the removal of Company property, including documents and files, from our premises;
to support law enforcement bodies in the prevention, detection and prosecution of crime;
to assist in day-to-day management, including ensuring the health and safety of staff and others;
to assist in the resolution of disputes; and
to conduct or support investigations in relation to any of the matters mentioned above. This list is not exhaustive and other purposes may be or become relevant.
HOW WE WILL OPERATE ANY CCTV. CCTV monitors the exterior of the building, the interior of the warehouse and selected production process rooms within the Company premises and both the main entrance and secondary exits. The company will use a single system of CCTV monitors for the coverage of all the selected rooms and spaces. COMBINO PHARM (MALTA) LTD. 3 Camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring. Where CCTV cameras are placed in the workplace, we will ensure that signs (such as stickers) are displayed at the entrance of the surveillance zone to alert individuals that their image may be recorded. CCTV cameras are not placed in areas where you are entitled to expect the total privacy (e.g., restrooms). Surveillance systems will not be used to record audio or sound. We will ensure that live feeds from cameras and recorded images are only viewed by approved members of staff whose role requires them to have access to such data. This will normally be limited to only Management.
REQUESTS FOR DISCLOSURE. No images from our CCTV cameras will be disclosed to any other third party, without express permission being given by the Company’s Management. Data will not normally be released unless satisfactory evidence that it is required for legal proceedings or under a court order has been produced. In other appropriate circumstances, we may allow law enforcement agencies to view or remove CCTV footage where this is required in the detection or prosecution of crime. No images from CCTV will ever be posted online or disclosed to the media.
USE OF DATA GATHERED BY CCTV. To assure the rights of individuals, we will ensure that data gathered from CCTV cameras is stored in a way that maintains its integrity and security. We may engage data processors to process data on our behalf. We will ensure reasonable contractual safeguards are in place to protect the security and integrity of the data.
RETENTION AND ERASURE OF DATA GATHERED BY CCTV. Data recorded by the CCTV system will be stored for 20-days, except where there is a request from the Courts, law enforcement agencies or if it is a required for the detection or prosecution of a crime, in which cases, the data will be kept until necessary for the fulfilment of those requirements. The Company uses a single system for CCTV monitoring, which does not allow us to implement different retention periods on a per-area basis. It is our reasoned assessment that the need to protect against theft, improper handling and/or any manipulation to our pharmaceutical products outweighs the privacy risks that could possibly be posed to individuals by retaining this CCTV footage. Data from CCTV cameras will not be retained indefinitely, but ordinarily will be permanently deleted once there is no reason to retain the recorded information and in any case, upon the lapse of 20-days from its capture. At the end of their useful life, all images stored in whatever format will be erased permanently and securely. Any physical matter such as tapes or discs will be disposed of as confidential waste. Any still photographs and hard copy prints will be disposed of as confidential waste. COMBINO PHARM (MALTA) LTD. 4
RIGHTS. Data subjects may make a request for disclosure of their personal data, and this may include CCTV images (data subject access request). A data subject access request is subject to the statutory conditions from time to time in place (such as third-party privacy rights) and should be made in writing and directed to Company Management following this procedure:
Send an e-mail to: dataprotection@combinopharm.com.mt. In order for us to locate relevant footage, any requests for copies of recorded CCTV images must include the date and time of the recording, the location where the footage was captured and, if necessary, information identifying the individual. We might not be able to disclose camera footage if the footages includes other individuals in it.
Once your request is received, we will start an internal procedure to decide whether or not we can attend to your request and we will provide our reply within one month from receiving it. You also have the right to correct (rectify) inaccurate personal data, and the right to request the erasure of your personal data in certain circumstances. In rare circumstances, individuals may have a legal right to object to processing and prevent automated decision making. Upon receipt of your objection, we will no longer process that data, unless there exists, and we are able to demonstrate, compelling legitimate grounds which allow for continued processing on our part, or where required for the establishment, exercise or defence of legal claims. Our position will be communicated to you in writing at the relevant point in time. For further information regarding this, please contact Management.
QUERIES AND COMPLAINTS. If any member of staff has questions about this Notice or any concerns about our use of CCTV, then they should in the first instance speak to Management. Where this is not appropriate or matters cannot be resolved informally, employees should use our formal grievance procedure by sending us an e-mail to: dataprotection@combinopharm.com.mt. as indicated in para. 9. You also can file for a complaint with the competent data protection supervisory authority. For Malta, this is the IDPC: https://idpc.org.mt/en/Pages/Home.aspx.
ONGOING REVIEW OF CCTV USE We will ensure that the ongoing use of existing CCTV cameras in the workplace is reviewed periodically to ensure that their use remains necessary and appropriate, and that any surveillance system is continuing to address the needs that justified its introduction.
