Monitoring

General information

In order to ensure safety and security on the premises of the Warsaw Chopin Airport, managed by us, including the safety of property and people staying on the airport, an integrated video monitoring system operates at the airport and adjacent buildings, areas.
In addition, in accordance with the Act of 26 April 2007 on crisis management, as an airport, which is part of critical infrastructure in the area of air transport, we are obliged to take actions aimed at ensuring the functionality, continuity and integrity of the infrastructure in order to prevent threats, risks and the occurrence of other events interfering with its proper functioning and the CCTV system is installed also for this purpose.

Detailed rules regarding the protection and processing of personal data collected in the video surveillance process and the possibility of gaining access to footage recorded as part of its operation are described below.


Information clause concerning processing data in the video monitoring process

According to art. 13 par. 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 04.05.2016, page 1), hereinafter referred to as the “GDPR”, we inform that:


Controller of your data

The Controller of your personal data, processed in the video monitoring system, is Polskie Porty Lotnicze S.A., seated in Warsaw (00-906), at ul. Żwirki i Wigury 1, e-mail: kontakt@ppl.pl, phone: 22 650 11 11 (hereinafter: “we” or “PPL”).


Data Protection Officer

PPL designated a Data Protection Officer, who can be contacted on any matters related to personal data processing and exercising rights related to personal data processing either by e-mail at IODO@ppl.pl, in writing, to the following address: Polskie Porty Lotnicze S.A., ul. Żwirki I Wigury 1, 00-906 Warsaw with a note „Data Protection Officer”, or by phone: 22 650 30 47.


Purpose of processing of your data
We process your personal data:

Basis of processing of your personal data

We process your personal data as it is necessary in order to fulfil of our legal obligation under Article 186b, par. 1 and 2, Article 188 par. 1 of the Polish Aviation Law of 3 July 2002 and §2 par. 1 point 10 letter r) of the annex to the Regulation of the Minister of Transport, Construction and Maritime Economy on the National Civil Aviation Security Programme of 31 July 2012 (Article 6 par. 1 c) of the GDPR) and legitimate interest pursued by the controller, which is to ensure security at Warsaw Chopin Airport and adjacent buildings, areas (Article 6 par. 1 f) of the GDPR).


Data recipients

In relation to the processing of data for the above purpose, personal data may be transferred to entities processing personal data on our behalf, with whom we have concluded contracts for entrusting the processing of personal data or entities authorized to access data on the basis of legal provisions, including operators of IT systems used for the purpose referred to above, providing accounting, archiving and maintenance services.


Data retention period

Your personal data will be stored by us for the period of 30 days following their disclosure to us, unless the video surveillance recording has been secured for the purposes of the proceedings (until the end of the proceedings).


Your rights

You have the right to access your data and receive a copy thereof, right to rectify (correct) your data, delete or restrict access to your personal data, and restrict the scope of processing thereof (in justified cases), right to raise objections based on reasons related to their special circumstances, if PPL processes data on the basis of its legally justified interests.

In order to exercise your rights, please contact the data controller or the Data Protection Officer. The contact details are provided above.
If, in your opinion, the processing of your personal data is incompliant with the GDPR you may also file a complaint with President of the Personal Data Protection Authority.


Obligation to provide your data

Even though provision of your personal data is voluntary, it is, nonetheless, indispensable for fulfilment of the objectives specified hereinabove.


What area is surveyed by the CCTV system?

Processing of your personal data by means of the CCTV system shall cover: interior and exterior areas of the airport, including any access roads, adjacent buildings and areas and the Terminal, including its interior area.
 

Fulfillment of requests for access to video surveillance footage

If we receive a request for access to recordings of video surveillance operating at Warsaw Chopin Airport and adjacent buildings, areas, due to the fact that the airport is a place subject to special protection for security reasons, where some of the airport facilities are part of critical infrastructure, as well as in connection with additional circumstances, where the recording of the recording to which the request relates most likely contains images of third parties, the fulfilment of the request must be preceded by:  

- a detailed description: specifying by the data subject in what time frame (as precise hour range as possible), where (zones, places, e.g. the baggage conveyor from which baggage was collected, etc.), how the person was dressed during registration of stay, whether the person used the assistance of the airport staff at the airport information point or the Lost and Found Office, thanks to which it will be possible to find the person requesting footage on the recording among thousands of passengers,

- analysis of the person's right or interest in obtaining the recording: it is necessary to provide a detailed description of the situation from which it will follow that what the requesting person will obtain or protect themselves against as a result of securing/acquiring the recording is superior to the rights of persons on the recording and whether it will, nevertheless, violate the rights of these persons (in accordance with the guidelines of the European Data Protection Board No. 3/2019 on processing of personal data through video devices),

- verification of the identity of the person making the request: this action is necessary to unambiguously state that the person submitting the request is indeed the person who they claim to be and whose image has been recorded. This will make it possible to exclude situations where information about the location of a given person could be obtained by an unauthorized person, as it is necessary to minimize the risk of disclosing data to such a person. According to Art. 12 par. 6 of the GDPR, if the controller has doubts as to the identity of the person making the request, the controller may request the provision of additional information necessary to confirm the identity of the data subject. In addition, recital 64 of the GDPR states that "The controller should use all reasonable measures to verify the identity of a data subject who requests access",

- analysis whether making the recording available will not threaten the safety of the airport infrastructure and people staying there: in the event of a high risk, we reserve the right to refuse the application, e.g. the recorded image will cover parts of critical infrastructure, parts of the airport security system, rules of operation of uniformed services and possibility of securing the recording until a request is received from the authorized body, e.g. Court, Prosecutor's Office, the Police.

Accordingly, even in the event of a negative decision, it is possible to obtain access to the recording through law enforcement or judicial authorities, which may submit such a request at the request of the data subject.


Finally, we would like to inform you that recordings of video surveillance operating at Warsaw Chopin Airport and adjacent buildings, areas are stored, as a rule, for a period of 30 days from the date of their acquisition, which means that the request for access to the recording or its protection in accordance with the above guidelines should be submitted in advance, before the end of the data retention period.