Privacy Notice for CCTV

Announcement by the Health Intervention and Technology Assessment Program Foundation

on Privacy Notice for CCTV

1. Background

The Health Intervention and Technology Assessment Program Foundation (hereinafter referred to as “HITAP”, “we” or “us”) uses CCTV cameras to observe the area of HITAP (“Area”) for ensuring security and safety of life, health and property of HITAP, employees, meeting attendees, contractors, visitors, or any other parties entering the Area (hereinafter referred to as “you” or “data subject”).

This Privacy Notice (“Privacy Notice”) was made to notify you of the purposes and means of collection, use and disclose (collectively referred to as “process/processing”) of your personal data as well as your rights under the Personal Data Protection Act B.E. 2562 (2019) (“Act”).

2. Types of Personal Data

HITAP installed the 24-hour CCTV cameras in the noticeable area unless the system is interrupted or under maintenance. The sign will be put up to notify the data subjects of CCTV in operation in such area, including any areas requiring observation as deemed appropriate by HITAP. The following personal data will be collected:

• Image
• Video
• Features of individual, e.g., figure, height, appearance.
• Property of individual, e.g., vehicle, bag, hat/cap, clothes.
• Behaviors of individual as well as unusual or suspicious activities.

In this regard, HITAP will not installed the CCTV cameras in the area which is likely to violate your basic rights of an individual, such as toilets, shower rooms, or personal office room.

3. Purposes and lawful Bases of Processing

HITAP processes your as necessary and required to achieve the lawful purposes of preventing or suppressing a danger to the life, body or health of you and other individuals, which is the legitimate interests of HITAP and others, as well as the purpose of compliance with relevant law. The purposes are assigned to each lawful basis, the details of which are as follows:

1) For preventing or suppressing a danger to life, body or health of you and other individuals

• To help a person in case of emergency or danger.

2) For legitimate interest of HITAP or other individuals

• For monitoring and ensuring security and safety of HITAP and other individuals entering the Area.
• For safeguarding the properties of HITAP and other individuals entering the Area.
• For disciplinary proceedings or compliance with HITAP’s internal rules or regulation.
• For dispute resolution proceedings or exercise of claims as well as establishment of civil or criminal actions.

3) For compliance with relevant law

• For compliance with the law relating to investigation or legal proceedings.
• For compliance with the order of an officer exercising official authority, e.g. police officer, attorney general, or court, who enforces the law in order to prevent or suppress an unlawful event and to commence a legal proceedings against the offender.

4. Disclosure of Personal Data

HITAP will keep the personal data from the CCTV camera confidential, and HITAP would not disclose the personal data to any third party unless it is necessary to achieve the purpose of monitoring and ensuring security and safety as specified in this Privacy Notice, including but not limited to the following individuals and/or organizations:

• Government authorities or officers seeking helps or supports in relation to enforcement of law or any investigation, inquiry, or legal proceedings.
• A third-party service providers, e.g. the landlord of the building or area, for the purpose of prevention or suppression of a danger to life, body, health and property of you and other individuals.
• Any party interested in a suspicious incident or activity occurred in the office or Area of HITAP with a condition that such interested party must comply with HITAP’s rules to obtain the information from the CCTV cameras.

5. Retention Period of Personal Data

HITAP will retain your personal data as long as it is necessary to achieve the purposes as specified in this Privacy Notice or it is required by law, i.e. for the period of 30 days. After expiration of the period, HITAP will consider erasing or destroying your personal data unless there is necessity for HITAP to continue retaining your personal data.

6. Security of Personal Data

HITAP sets up security measures, comprising of both technical and organizational measures for handling your personal data, such as implementing access control measure to allow only staff or individual that are authorized or assigned to use your personal data according to the Privacy Notice. Such people with authorization will have to strictly adhere to and comply with HITAP’s data protection measures, and they will also have an obligation to keep confidentiality of the personal data they became known in the performance of their duties.

Moreover, if HITAP requires your personal data to be sent or transferred to any third party, whether for the purposes of HITAP’s mission, contract, or other form of agreements, HITAP will determine the level of security and confidentiality measures as appropriate and as required by law to ensure your personal data with HITAP is always safe and secure.

7. Data Subject Right According to the Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act B.E. 2662 (2019) stipulates various rights of data subjects. A data subject or an authorized person, such as a parent or a guardian, is entitled to submit a request to exercise the rights through the channel as set out in Clause 9. The details of the available data subject rights are as follows:

1) Right to be informed of the purposes and details of collection, use, and disclosure of their personal data through a privacy policy or this Privacy Notice.

2) Right to access, obtain a copy, or request the disclosure of their personal data collected by HITAP unless HITAP has a justified reason to reject the request as permitted by the law or court order, or in case the exercise of this right may have an adverse effect to the rights and freedom of other individual.

3) Right to rectify your personal data that are not accurate, complete or up-to-date so as to ensure that the personal data are accurate, up-to-date, complete and not misleading, to the extent permitted by relevant law.

4) Right to have the personal data erased, destroyed, or anonymized.

5) Right to restrict your personal data from being processed in the following cases:

• when the request to rectify your personal data for accuracy, completeness and being up-to-date;
• when HITAP unlawfully processes your personal data;
• when their personal data is no longer necessary for HITAP, but the data subject requests HITAP to keep their personal data in support of their legal claim, such as establishment or defense of a legal claim; and
• when HITAP is in the process of verifying your objection request.

6) Right to object to the processing of personal data in case HITAP relies upon legitimate interest, as a lawful basis.

7) Right to transfer or receive the transfer of the personal data in a readable and commonly used, by automated devices or equipment, and can be used or disclosed by automated means.

8) Right to make a complaint to HITAP for investigation, clarification, or resolution of their concerns, including filing a complaint to the Personal Data Protection Commission if the processing of personal data by HITAP is in violation of the Act.

In case the data subject submits the request to exercise their rights under the Act, upon the receipt of the request, HITAP will proceed with the request within 30 days. HITAP reserves its right to reject or refuse to comply with the request and its right to extend the request respond timeline, including charging a fee if permitted by law.

8. Amendment to the Privacy Notice

HITAP may consider updating, amending, or making changes to the Privacy Notice from time to time to be in line with its internal practice and the Act. HITAP will notify you of the changes on the HITAP website.

9. Contact Details for Enquiry or Exercise of Rights

You may contact us for any enquiry regarding this Privacy Notice or for the data subject right request under the Act at:

Health Intervention and Technology Assessment Program Foundation

6th Floor, 6th Building, Department of Health, Ministry of Public Health,

Tiwanon Rd., Muang, Nonthaburi 11000

Tel.: 02-590-4549, 02-590-4374-5 or email: [email protected]

You can download the Data Subject Right Request Form here

Effective on 1^st June 2022

——

Related Privacy Notice(s) and document(s)

Privacy Policy

Privacy Notice for Job Applicants and Employees

Privacy Notice for Service Providers or Contractors

Privacy Notice for Events

Cookie Policy

Privacy Notice for Website Users

Data Subject Right Request Form