Privacy Notice
This privacy notice tells you what to expect when Heathrow Airport Ltd or Heathrow Express Operating Company, collectively known as “Heathrow” collects personal information about you, in this case, static or moving imagery, audio and meta data such as vehicle plate data via the surveillance systems as you pass through the airport. Heathrow is committed to protecting your personal information, safety and security when you use Heathrow services. We are legally obliged to use your information in line with all applicable laws concerning the protection of personal data, including the UK General Data Protection Regulation (UK GDPR).
When you use Heathrow Airport we may collect, static or moving imagery, audio and meta data such as vehicle plate data, via the surveillance systems using both static and mobile devices, such as staff activated body worn cameras. Heathrow collects this data via surveillance devices located throughout the airport, in both landside (public) and airside (restricted access) locations.
Heathrow may use surveillance data for a number of purposes including but not limited to the following:
* We will make a reasonable and proportionate effort to locate CCTV images of you upon request. However, we cannot guarantee retrieval of any CCTV images we may hold, especially if the request is made close to the end of the CCTV retention period which is typically 31 calendar days from the date recorded. A minimum of five working days before expiry is required for an effective search. To improve the chances of retrieval of any CCTV images we may hold, please submit your request as soon as possible with sufficient details i.e. the specific location in the airport, the exact date and time, a description of yourself (e.g. your appearance and attire worn at the time).
The lawful justification for collecting and using surveillance data is that there are legitimate interests to do so. Surveillance data may be handled and used by the following recipients to maintain a safe, secure efficient and compliant airport/rail operation:
Some of Heathrow's surveillance camera infrastructure is shared with third parties such as the Police, UK Border Force, local authorities and some service partners. They may take control of cameras and use them for security or crime prevention activities, for example. These arrangements are covered by information sharing agreements and Heathrow is not responsible for the cameras when in the control of the third party. In certain circumstances Heathrow may provide footage to third parties for their own purposes such as to investigate an incident. In such instances, the third party will be the data controller. There may also be third party market researchers who operate their own recording systems in limited circumstances. Additionally, other third parties in the airport may install their own CCTV; in these case the third parties are data controllers in their own right.
We will not transfer or disclose your personal information, other than: as identified in this Privacy Notice, to our trusted third-party suppliers and/or to the police, tribunals, courts, regulators, or other authorities to assist them with their investigations or requests and/or for us to report security incidents or suspected or actual unlawful acts and/or as may be otherwise required by law or in response to a subject access request. Your information may very occasionally be processed outside of the UK for the purposes of system maintenance and support or for the purposes of international security and crime prevention.
Heathrow colleagues and our authorised representatives may in limited circumstances use BWC. Our colleagues will inform you if you are being filmed unless the situation means we are unable to communicate this with you. While we do not rely on consent, the footage is handled by authorised Heathrow colleagues in line with the rest of this privacy notice.
BWC have an up to 60 second record function, which is continuously overwritten unless the device is switched on to save footage or the device senses an impact. The record function will be manually turned off by the operator. BWC will only be recording when the situation requires it for example for health and safety or for investigations etc. Footage and audio that is recorded will be saved onto Heathrow systems and will be kept for 31 days unless it is needed for investigative or evidential purposes.
To provide the Terminal Drop-Off Charge service, Heathrow will collect your VRM via Automatic Number Plate Recognition (“ANPR”) and CCTV. This information will then be passed on to APCOA, who manage the process of forecourt access including the enforcement of the program.
Heathrow will only collect first name, last name, and email address of users who consent to their details being used for marketing purposes, this information will be collected by APCOA on our behalf and transferred to our marketing agents.
The lawful basis for our processing of your vehicle registration data is based on it being necessary to perform our contract with you permitting the use of a vehicle at Heathrow Airport for use of the forecourt. Heathrow also relies upon legitimate interests in connection with data processed in connection with TDOC. The terms and conditions are set out on the signage located around the site and online:
https://www.heathrow.com/terms-and-conditions/terminal-drop-off-charge-terms-and-conditions
We also utilise ANPR (Automatic Number Plate Recognition) data to support our sustainability goals, including reporting on surface access carbon emissions and understanding vehicle usage. The data collected includes vehicle registration numbers collected from ANPR cameras; this information is shared with the DVLA to gain further insight about the vehicle and emission type. By processing this data, we are actively contributing to a cleaner environment and fostering sustainable practices. If you would like to opt out of this processing, please contact: ANPRdata@heathrow.com. We will make every reasonable and proportionate effort to fulfil your opt-out request. Please note that your data is retained for 31 days before being permanently deleted from our systems. To ensure an effective search and increase the likelihood of processing your request within the retention period, we require a minimum of 10 working days before expiry. Therefore, we strongly recommend submitting your opt-out request as early as possible.
Under normal circumstances, your information could be retained for up to 31 calendar days after which point it will be deleted. Imagery required for investigative or evidential purposes may be retained beyond 31 days and is securely disposed of upon completion/conclusion of the purpose for which it has been retained. In certain circumstances, for example, the capture of Automatic Number Plate Recognition, images could be kept for up to 90 days.
Imagery is retained in a secure environment and is only accessible by authorised personnel who have a legitimate reason to do so.
Under the UK General Data Protection Regulation, you will have the right to, where appropriate:
To exercise your rights please contact the Heathrow Data Protection Officer using the following contact details:
Data Protection Officer
Heathrow Airport Ltd
The Compass Centre
Nelson Road
Hounslow, Middlesex
TW6 2GW
Or email: privacy@heathrow.com
A new era has begun for the UK and EU now that the Brexit transition period is over. From time to time we may process personal data from EU residents. Whenever applicable, we have appointed an EU Representative to ensure that we continuously process your personal data in compliance with applicable laws and without undermining your statutory rights.
You can contact our EU Representative at HeathrowEURepresentative@eversheds-sutherland.com and write EU Representative as subject matter. You may also contact our EU Representative per post mail at:
Eversheds Sutherland Netherlands B.V.
Attn. EU Representative Heathrow Airport
Fascinatio Boulevard 212
Floor 2A
3065 WB Rotterdam
Should you find our response unsatisfactory, you have the right to lodge a complaint with the supervisory authority – the Information Commissioner’s Office (ICO). You can find more information on the ICO website at ico.org.uk/concerns/ regarding the complaints process.
We will keep this privacy notice under regular review and we will place any updates here. At the start of this privacy notice we will tell you when it was last updated.
