Last updated: January 2023
This privacy notice tells you what to expect when Heathrow Airport Ltd (Heathrow) collects personal information about you, in this case, static or moving imagery, audio and meta data such as vehicle plate data via the surveillance systems as you pass through the airport. Heathrow is committed to protecting your personal information, safety and security when you use Heathrow services. We are legally obliged to use your information in line with all applicable laws concerning the protection of personal data, including the UK General Data Protection Regulation (UK GDPR).
What information will we collect about you?
When you use Heathrow Airport we may collect, static or moving imagery, audio and meta data such as vehicle plate data, via the surveillance systems using both static and mobile devices, such as staff activated body worn cameras. Heathrow collects this data via surveillance devices located throughout the airport, in both landside (public) and airside (restricted access) locations.
How will Heathrow use the information it collects about me?
Heathrow may use surveillance data for a number of purposes including but not limited to the following:
- To maintain the safety and security of the airport for our passengers, colleagues and stakeholders, including but not limited to Control Authorities, national security, detection and prevention of crime and aviation security
- To monitor flows and demand throughout the airport to optimise resourcing and passenger experience and support market research activities
- To support the effective management of the airport operation and any incidents
- For investigative purposes or as evidence to support any formal follow-up to airport incidents
- To enhance our safety and security related procedures, redacted body worn camera and CCTV footages maybe used for training purposes
- To provide evidence of regulatory compliance to Department for Transport (DfT) and Civil Aviation Authority (CAA)
- In response to a subject access request
- To protect and monitor the Flight Restriction Zone from unmanned aerial systems
- Provide services and meet airport initiatives. This includes the use of Automatic Number Plate Recognition
- CCTV is used in stations at Heathrow operating the Heathrow Express service. We capture and monitor images of events that take place within the vicinity of the stations across all terminals, we do this for safety and security purposes. Please note, the CCTV inside the trains is operated by GWR (Great Western Railway). For more information visit the GWR website. https://www.gwr.com/privacy-policy.
The lawful justification for collecting and using surveillance data is that there are legitimate interests to do so. Surveillance data may be handled and used by the following recipients to maintain a safe, secure efficient and compliant airport/rail operation:
- Heathrow personnel
- Customer service personnel (third parties)
- Airlines
- Baggage system operators
- Border Force (part of the Home Office)
- Police/security services
- Other Heathrow service providers
- Airport/rail users in limited circumstances in order to fulfil subject access requests
- Third-party airport-related and/or rail-related service providers and operators
Some of Heathrow's surveillance camera infrastructure is shared with third parties such as the Police, UK Border Force, local authorities and some service partners. They may take control of cameras and use them for security or crime prevention activities, for example. These arrangements are covered by information sharing agreements and Heathrow is not responsible for the cameras when in the control of the third party. In certain circumstances Heathrow may provide footage to third parties for their own purposes such as to investigate an incident. In such instances, the third party will be the data controller. There may also be third party market researchers who operate their own recording systems in limited circumstances. Additionally, other third parties in the airport may install their own CCTV; in these case the third parties are data controllers in their own right.
We will not transfer or disclose your personal information, other than: as identified in this Privacy Notice, to our trusted third-party suppliers and/or to the police, tribunals, courts, regulators, or other authorities to assist them with their investigations or requests and/or for us to report security incidents or suspected or actual unlawful acts and/or as may be otherwise required by law or in response to a subject access request. Your information may very occasionally be processed outside of the UK for the purposes of system maintenance and support or for the purposes of international security and crime prevention.
Use of Body Worn Cameras (BWC)
Heathrow colleagues and our representatives may in limited circumstances use BWC. Our colleagues will inform you if you are being filmed unless the situation means we are unable to communicate this with you. While we do not rely on consent, the footage is handled by authorised Heathrow colleagues in line with the rest of this privacy notice.
BWC have a 60 second record function, which is continuously overwritten unless the device is switched on to save footage or the device senses an impact. The record function will be manually turned off by the operator. BWC will only be recording when the situation requires it for example for health and safety or for investigations etc. Footage and audio that is recorded will be saved onto Heathrow systems and will be kept for 31 days unless it is needed for investigative or evidential purposes.
How long will Heathrow keep my information?
Under normal circumstances, your information could be retained for up to 31 calendar days after which point it will be deleted. Imagery required for investigative or evidential purposes may be retained beyond 31 days and is securely disposed of upon completion/conclusion of the purpose for which it has been retained. In certain circumstances, for example, the capture of Automatic Number Plate Recognition, images could be kept for up to 90 days.
Imagery is retained in a secure environment and is only accessible by authorised personnel who have a legitimate reason to do so.
What rights do I have over my personal data?
Under the UK General Data Protection Regulation, you will have the right to, where appropriate:
- Access your personal data by making a subject access request
- Rectification, erasure or restriction of your information
- Object to the processing of your information
To exercise your rights please contact the Heathrow Data Protection Officer using the following contact details:
Data Protection Officer
Heathrow Airport Ltd
The Compass Centre
Nelson Road
Hounslow, Middlesex
TW6 2GW
Or email: privacy@heathrow.com
EU Representative
A new era has begun for the UK and EU now that the Brexit transition period is over. From time to time we may process personal data from EU residents. Whenever applicable, we have appointed an EU Representative to ensure that we continuously process your personal data in compliance with applicable laws and without undermining your statutory rights.
You can contact our EU Representative at HeathrowEURepresentative@eversheds-sutherland.com and write EU Representative as subject matter. You may also contact our EU Representative per post mail at:
Eversheds Sutherland Netherlands B.V.
Attn. EU Representative Heathrow Airport
Fascinatio Boulevard 212
Floor 2A
3065 WB Rotterdam
What if I find your response unsatisfactory?
Should you find our response unsatisfactory, you have the right to lodge a complaint with the supervisory authority – the Information Commissioner’s Office (ICO). You can find more information on the ICO website at https://ico.org.uk/concerns/ regarding the complaints process.
Changes to this privacy notice
We will keep this privacy notice under regular review and we will place any updates here. At the start of this privacy notice we will tell you when it was last updated.
