• Have a clear policy setting out and justifying your reasons for recording camera footage and other data (for example to improve personal safety, to avoid false insurance claims and to track driver routes);
• Make sure that your drivers and other employees who might be recorded understand your reasons (your legitimate interests under GDPR) for recording the camera footage and other data.
• Make sure that you are recording personal data only to the extent that it is required in accordance with your policy;
• Explain how the data will be used (for example to demonstrate FORS compliance, review accidents and track driver routes and delivery times);
• Make everyone aware that the vehicle is recording camera footage (for example through in cab and external stickers);
• Be clear how long you will keep the data and the reasons for this and only retain the data for as long as is required (for example 6 months for insurance purposes or 4 weeks for vehicles accessing HS2 worksites);
• Ensure that you keep the data secure by restricting everyday access to the data to certain individuals (for example the Transport Manager and HR Manager) through a lockable hard drive and password protection; and
• If an individual whose image is recorded on camera equipment requests it, provide copies of the footage to the individual in accordance with the subject access provisions of GDPR.

Durite DVRs have extensive functionality to ensure that you can keep recorded data secure, restrict access to recorded information and only keep information for as long as you deem appropriate, so that you are GDPR compliant in accordance with this guide.

• Four around vehicle cameras and one in cab camera.
• Vehicle tracking and speed data.

Ensure that the policy explains the reasons why the company is recording footage and the benefits (your legitimate interests). For example:

• To have accurate video footage in the event of an accident and to avoid false insurance claims.
• To improve driving behaviour and reduce vehicle damage and accidents.
• To ensure vehicles are FORS compliant.
• To track driver routes and delivery times.

Include in the policy how the information will be used, and make sure access to the data is restricted. For example:

• The Transport Manager will have access to the recorded data to demonstrate FORS compliance, review accidents and track driver routes and delivery times.
• The HR Manager or another senior person will have access to the footage where required for an investigation or disciplinary procedure.

Make sure that your drivers and other staff who may be recorded are aware of your policy and the reasons for it:

• Hold training sessions to explain the many benefits of mobile DVRs and cameras systems.
• Ask them to sign a letter acknowledging your policy and that they will be recorded in accordance with the policy.

Do not use the camera footage and data for purposes that are not set out in your policy. For example:

• Consider turning off in cab cameras when drivers are resting or sleeping to respect their privacy. DVRs can be set to only record when the vehicle ignition is switched on.

Make sure the relevant individuals are made aware of their data protection rights in the policy, including the right to have access to data and the right to erasure. Provide as much transparency about the use of the system as possible, including a contact point for information and complaints.

The use of mobile DVRs must take into account its effects on individuals and their privacy, so you should carry out regular reviews of your policy to ensure the use remains justified.

Ensure staff are aware of your retention policy for recorded data. For example:

• If recording for insurance purposes, speak to your insurers to see how long they would recommend keeping the data.
• If recording to monitor driver behaviour, to track routes or to track delivery times, this will depend on the time you deem appropriate to keep data for these purposes.
• HS2 specification requires that vehicles accessing HS2 worksites for mass haulage movements will be required to record activity around the outside of the vehicle for at least 4 weeks to provide digital witness and evidence in the event of collisions and near misses for training purposes to reduce the risk of future accidents.

Any footage of third parties who are outside the vehicle will be particularly intrusive and such external footage should be kept for as short a time as possible.

It is worth noting that a mobile DVR with a 1TB hard drive will typically hold between 4 and 8 weeks of data on the hard drive depending on the vehicle usage, the number of cameras and the recording definition for the camera footage.

For customers with 3G or 4G enabled Durite DVRs and the Durite Live cloud based live streaming service, it is possible to upload and store data for 12 months or longer.

• Identify named authorised individuals who will have access to DVR data (for example the Transport Manager).
• Decide which of these authorised individuals should be able to view DVR data and which both view and download data.
• Ask the authorised individuals to sign a letter accepting responsibility for the proper use of DVR data, in accordance with the company policy, as misuse may be in breach of GDPR.

Durite DVRs have advanced administration rights which allow the person controlling access to the data to set the restrictions so that certain users can only view footage but cannot download or edit the footage.

It is recommended that you put signage on vehicles to give notice that the vehicle is recording. This should not only be on the outside of the vehicle, where there are outward facing cameras, but in the cab as well to ensure that all drivers and passengers are aware of its use. Any signs should be clearly visible and readable, and should include details of your organisation. Bear in mind that members of the public are entitled to make subject access requests if they or their number plates have been recorded.

Under GDPR regulations individuals can make a request in writing to obtain images that have been recorded. You will need to respond to such requests within 30 days. If such a request is received, only footage of that individual can be provided and any other identifiable individuals should be blurred out.

This document is a guide to make sure you are GDPR compliant when recording data on mobile DVRs and is not intended to constitute legal advice. Please consult your legal advisers as appropriate.