CCTV Policy Bayle Building

Article 1: Definitions

Within this policy, the following terms are capitalized. The following definitions apply:

Article 2: Goals of CCTV

1. CCTV within the Bayle building is used as a means to protect people and property, as well as to prevent fraud and theft, and to record incidents:
   1. In order to protect the safety and health of one or more natural persons, targeted recordings of the Data Subjects will be made, to the extent necessary for these purposes;
   2. In order to secure the access to buildings and grounds, targeted recordings of the access roads and entrances will be made, to the extent necessary for these purposes;
   3. In order to monitor and secure goods in the building or on the grounds, targeted recordings of these goods will be made, to the extent necessary for this purpose;
   4. In order to be able to record incidents, targeted recordings of parts of the building or grounds where the incidents tend to occur will be recorded, to the extent necessary for these purposes.
2. It is not permitted to place cameras in areas where Data Subjects should reasonably find themselves undisturbed, including but not limited to toilets, showers, and changing rooms.

Article 3: Tasks and Responsibilities

1. The Board of Directors is responsible for the Processing of Personal Data and therefore for the       CCTV. The CCTV is carried out on the basis of RSM B.V.’s legitimate interest.
2. The CCTV is carried out by the System Administrators, but TRA can only occur after explicit Written permission from the ED. The Executive Board reserves the exclusive right to take decisions with regards to any covert cameras.
3. The technical management of the CCTV is carried out by the System Administrators. The CCTV is secured using generally accepted industry standards.
4. In the event of an incident, the System Administrators immediately report this to the ED. In case an incident is reported to the System Administrators by a Data Subject, this will be immediately reported to the ED.
5. The ED ensures a logbook is kept of the actual TRA of the CCTV.

Article 4: Operation of the CCTV and Targeted Recording Access

1. Processing Video Recordings using CCTV also includes the TRA, as well as the storage of the Video Recordings and the Personal Data on CD/DVD or any other form of data storage.
2. TRA of Personal Data recorded by the CCTV may take place to detect unpermitted behaviour and/or further investigate unpermitted behaviour, but only in case there is a reasonable presumption or suspicion of unpermitted behaviour by one or more Data Subjects.
3. Authorised to initiate TRA is the EDO who gives explicit Written permission to the System Administrators to provide access to a Designated Observer and a Second-Pair-of-Eyes to perform the TRA , for the goals as described in Article 2.
4. Authorised to initiate TRA are investigating (police) officers, prosecutors, or judges, but only on a legal basis, and if necessary for the proper performance of their legal duty.
5. Authorised to initiate TRA and thus to Process Personal Data are:
   1. The examination board, in accordance with Article 11.5
   2. Others, in case:
      1. The Data Subject has explicitly consented to the Processing of his/her Personal Data;
      2. The Processing is necessary for the fulfilment of a legal obligation;
      3. The Processing is necessary for the fulfilment of a vital interest of the Data Subject (such as an urgent medical necessity);
      4. The Processing occurs for historical, statistical or scientific purposes. This may only occur on the condition that the Executive Board accepts responsibility for ensuring the Personal Data is used for these purposes only.
6. The following Personal Data may be processed:
   1. Video Recordings of the building and grounds, and people and property located thereon, which fall under responsibility of the Executive Board in accordance with Article 3.1
   2. Data related to the time, the date and the place on which the Video Recordings were made.
7. If the TRA is initiated by the ED, pursuant to the goals laid down in Article 2.1., on the basis of a signal or otherwise communicated information by a third party, the ED has the prerogative to inform this third party, in an anonymized manner, of the decision to initiate or the results of the TRA.

Article 5: The Targeted Recording Access Room

The room in which the CCTV is recorded and in which TRA can take place, is accessible to authorized personnel 24 hours a day, and is protected against intrusion and vandalism.

Article 6: Issuing Video Recordings

1. Video Recordings are only issued to third parties, including but not limited to investigating (police) officers, prosecutors, or judges, on the basis of a Written request, claim, and/or on the basis of a legal ground.
2. Such a request or claim is immediately submitted to the ED.
3. The ED can immediately decide on this request or claim orally, and/or with a Written confirmation (afterwards).
4. The Video Recordings are provided on CD/DVD or using another form of data storage. The CD/DVD or other form of data storage is marked with a unique ID. The issuance and the ID are registered by the ED.
5. The third party must identify him/herself in advance to the ED, before the Video Recordings are transferred.
6. The third party will sign for receipt.

Article 7: Overview of Cameras & Placing New Cameras

1. An overview of cameras will be kept in Annex 1. Annex 1 will be made available to the Executive Board, System Administrators, and the RSM B.V. Employee Council. It will only be made available to others upon request, and only after obtaining explicit Written permission from the ED.
2. New cameras may be installed at the request of the Executive Board.
3. The Executive Board must make a proper Written assessment of the interests and rights of the Data Subjects versus the interests of RSM B.V. This assessment must be made available to the RSM B.V. Employee Council.
4. The RSM B.V. Employee Council will be asked for approval before the placement of cameras may occur.
5. After approval from the RSM B.V. Employee Council has been received, the Executive Board may install the cameras. The installation will be recorded in Writing and added to Annex 1.

Article 8: Temporary Covert Cameras

1. In exceptional circumstances, the Executive Board may decide to place temporary hidden cameras in the building or on the grounds, but only if it can be demonstrated that other means have not led to the desired result. The provisions from Article 7 do not apply under these circumstances.
2. The provision of Article 2, sub 2, remain in force with regards to the covert cameras.
3. In case covert cameras are used in the workplace, there must be a reasonable suspicion with regards to one or more employees. A minimum of 2 members of the Executive Board will be informed of the use of covert cameras. A condition for the use of covert cameras is that the concerned employee or employees are informed upfront about which behaviour is tolerated, and warned that unpermitted behaviour will be sanctioned.

Article 9: Reports & Reporting

1. Every particularity or irregularity that is discovered, will immediately be reported to the ED.
2. A report of all incidents that occurred, all TRAs that took place, and their findings and potential consequences, if any, will be, at least once a year, issued to the Executive Board.
3. The information necessary for this report, is collected by the System Administrators in conjunction with the ED. With this report, the ED also provides an overview of names of involved System Administrators.

Article 10: Notice, Integrity & Privacy

1. The CCTV and the resulting Video Recordings, including the Personal Data on them, will only be used for the goals as described in Article 2.1, and may only be accessed on the basis of Article 4.3.
2. The fact that CCTV is taking place within the building and on the grounds of RSM B.V., is clearly indicated using signs on the entrance door to the Bayle Building.
3. By publishing this policy on the RSM website, employees, clients, and visitors are informed about the purposes of the CCTV, the fact that recordings are made, and the circumstances and conditions under which TRA may take place.
4. The Video Recordings are saved for a maximum of 4 weeks after they have been captured.
5. If the Video Recordings and the following TRA have resulted in a case to resolve an incident or discipline unpermitted behaviour, the Video Recordings and the Personal Data on them will be retained for as long as necessary in the context of the case.
6. Unauthorized personnel do not have access to the CCTV.
7. The ED, as well as any representative from a group mentioned in Article 4.3, who in the performance of their duties have access to the Data on the Recordings, will handle the Recordings and the Data on them confidentially and with integrity, in particular with regards to the privacy of the Data Subjects on them.

Article 11: CCTV during Written Tests

1. During written tests, CCTV takes place with the aim of checking for incidents and recording irregularities. This CCTV is governed by the EUR CCTV Policy, not by the RSM B.V. CCTV Policy.
2. The fact that CCTV is taking place during the written tests, is clearly indicated using signs on the entrance door to test location.
3. The Video Recordings captured during the written tests, will be deleted within 24 hours after the test results have been finalized. The finalization of the results will immediately be reported by the RSM B.V. Manager Registrar’s Office to the Operational Administrator (Operationeel Beheerder) of the EUR.
4. If the Video Recordings and the following TRA have resulted in a case to resolve an incident or discipline unpermitted behaviour, the Video Recordings and the Personal Data on them will be retained for as long as necessary in the context of the case.
5. The examination board may request TRA of the Video Recordings if it has a realistic indication that an irregularity occurred during a written test, or may watch the live Recording of the CCTV in case it has a realistic indication that an irregularity will occur during a test.
6. In the annual report of the examination board, it provides to the Executive Board insight into all incidents that occurred, all TRAs that took place, and their findings and potential consequences. With this report, the examination board also provides an overview of names of involved System Administrators.

Article 12: Complaints & Rights of Data Subjects

1. Complaints regarding the CCTV, the TRA procedure, and/or personnel involved in the CCTV and TRA procedure, must be submitted to the ED in Writing.
2. The ED will respond within 4 weeks after the date of receipt of a Written complaint.
3. A Data Subject may exercise their rights under GDPR, using this link (the link will transfer to the EUR privacy platform).
4. RSM B.V. will respond within 30 days to all requests to exercise a right under GDPR.

Article 13: Sanctions

1. In case Data Subjects, System Administrators, or any others that gain access to the Recordings on the basis of Article 4.3, behave in conflict with the general applicable values and norms, or in conflict with the interests of RSM B.V., the Executive Board will be informed.
2. Depending on the nature and severity of the violation as mentioned in Articles 4.2 and/or Article 13.1, the Director HR and/or Legal Affairs may be informed and/or consulted, and disciplinary sanctions and/or labour law sanctions may be taken against Data Subjects.
3. In the event of any unlawful acts, RSM B.V. will also report this to the EUR security and the police.

Article 14: Publication

This policy will be published on the RSM website.

Article 15: Role of the RSM B.V. Employee Council

The RSM B.V. Employee Council has the right of approval with regards to this policy.

Article 16: Final Provisions

1. In cases not covered by this policy, the ED decides.
2. This policy will be evaluated yearly, starting in January 2025, by the Board of Directors and the  RSM B.V. Employee Council.
3. This policy enters into force on 1 June 2024.