Contract analysis

1. EXECUTIVE SUMMARY Northgate Telecommunications PLC ("NTP" or the "Company") proposes to deploy a closed-circuit television ("CCTV") system enhanced with live facial recognition technology ("FRT") at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, the Company's principal office (the "Pilot"). The Pilot would involve the installation of 47 CCTV cameras across five floors, building entrance lobbies, the g

2. INTRODUCTION AND LEGAL FRAMEWORK 2.1 Purpose of this DPIA

Article 35(1) of the GDPR, as retained and supplemented by the Data Protection Act 2018 ("DPA 2018") (together, the "UK GDPR"), provides that where a type of processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing,

Article 35(3)(c) GDPR / UK GDPR. A DPIA is specifically required where the processing involves "a systematic monitoring of a publicly accessible area on a large scale." Northgate Tower's ground-floor entrance lobby, reception area, and building perimeter are accessible to visitors and members of the public, and the proposed deployment of 47 CCTV cameras (12 with facial recognition) across the building constitutes lar

3. DESCRIPTION OF THE PROPOSED PROCESSING 3.1 Overview of the Pilot NTP proposes to deploy a CCTV and facial recognition pilot programme at its principal office, Northgate Tower, located at 88 Canary Wharf Boulevard, London E14 5HN. Northgate Tower is a 22-storey commercial office building that serves as NTP's global headquarters and houses the Company's executive leadership, core corporate functions, and a significa

4. ASSESSMENT OF NECESSITY AND PROPORTIONALITY 4.1 Stated Purpose and Legitimate Interest NTP's facilities management team and Chief Security Officer have articulated the following objectives for the proposed CCTV and facial recognition Pilot at Northgate Tower: (a) Enhance physical security at London HQ by deploying advanced surveillance technology capable of real-time identification of building occupants. (b) Preve

Article 35(7)(b) of the GDPR requires that a DPIA include an assessment of the necessity and proportionality of the processing operations in relation to the purposes. The principle of data minimisation (Article 5(1)(c)) further requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. The central question for the necessity assessment is

5. IDENTIFICATION AND ASSESSMENT OF RISKS 5.1 Risk Methodology The risks identified in this DPIA have been assessed using a risk assessment methodology consistent with the ICO's DPIA guidance and the EDPB Guidelines on Data Protection Impact Assessments. Risks are assessed on a matrix of likelihood and severity to data subjects' rights and freedoms: Likelihood: • Remote: The event could occur in exceptional circumsta