Vehicle camera notice

You are reading this because you saw a camera notice sticker in or on a vehicle. This page explains what the cameras record, why, who is responsible for the footage, and what your rights are.

Who is responsible for the footage

The vehicle belongs to a fleet operator. The operator's name is printed on the sticker in the vehicle, under "Operator". That operator is the data controller. They decide why the cameras are used and are responsible for the footage and for answering your requests.

Yipii Limited, a company registered in Malta with registration number C 16799, supplies the camera system and stores the footage on the operator's behalf. Yipii is a data processor. We act only on the operator's instructions and do not use the footage for our own purposes.

If you contact Yipii about footage, we will pass your request to the operator named on the sticker and let you know we have done so.

What is recorded

Depending on the vehicle, one or both of the following camera views are fitted:

• A front-facing camera that records the road ahead.
• A cabin-facing camera that records the inside of the vehicle, including the driver and passenger seats.

Alongside the video, the system records the vehicle's location, speed and the time. It can also flag certain driving and safety events automatically. Which of those are switched on depends on the vehicle and on what the operator has chosen, so ask the operator which are active in their vehicles.

The cameras record video. Audio is not recorded. Recording runs while the vehicle's ignition is on; the cameras do not record when the vehicle is switched off.

The system does not use facial recognition and does not make any automated decisions about you. Footage is not used to train or test artificial intelligence systems.

Why the cameras are used

Each operator decides and records its own reasons for using cameras before switching them on, and you can ask them for that record. Those reasons usually include:

• The safety of drivers and passengers.
• Evidence in the event of an accident or incident.
• Handling insurance claims.
• Preventing theft, damage and misuse of the vehicle.

Footage is not used for marketing, is not sold, and is not shared with anyone beyond the recipients listed below.

The legal basis

The operator relies on its legitimate interests (Article 6(1)(f) of the GDPR) in protecting its drivers, passengers and vehicles and in being able to establish what happened when an incident occurs. Before installing cameras, the operator weighs these interests against your privacy and puts safeguards in place: limited retention, restricted access, a clear notice in the vehicle, and no audio recording. Legitimate interests, not consent, is the basis the law expects for monitoring of this kind. That is why you are told about the cameras rather than asked to agree to them.

How long footage is kept

• Ordinary footage is kept for 30 days and then deleted automatically.
• Footage relating to an accident, incident, complaint or claim may be kept for longer, until the matter is closed and any legal deadlines have passed.
• Footage requested by the Police or by Transport Malta is kept for as long as they require.

Who can see the footage

• The operator, through authorised staff only.
• Yipii, as processor, to host and maintain the system and to support the operator.
• The operator's insurer, where footage is needed for a claim.
• The Police, Transport Malta or a court, where the law requires it or a lawful request is made.

Yipii staff access is limited. A small number of named staff can open footage where it is needed to run the service: fixing a fault, checking that a camera is positioned correctly and producing a usable image, checking that an automatic alert is working, or retrieving a clip the operator has asked for. Every access is logged. Yipii does not copy footage out of the system, does not keep it beyond the operator's retention period, and does not use one operator's footage for another.

Footage is stored on servers within the European Economic Area and is not transferred outside the EEA.

Your rights

Under the GDPR you have the right to:

• Access the footage in which you appear.
• Erasure of footage, where there is no overriding reason to keep it.
• Restriction of processing while a request is being handled.
• Object to the processing on grounds relating to your particular situation.

To exercise any of these rights, contact the operator named on the sticker in the vehicle. If you do not have their contact details, ask the driver or contact Yipii at [email protected] and we will forward your request to the operator.

To find your footage, the operator will need the vehicle registration number and the approximate date and time of the journey. Please make your request as soon as possible, because ordinary footage is deleted after 30 days.

The operator will respond within one month. Where footage shows other people, parts of it may be masked before it is shared with you.

Complaints

If you believe your personal data has been handled unlawfully, you can complain to the Information and Data Protection Commissioner:

Contact

For questions about the camera system itself, contact Yipii at [email protected] or +356 9930 0600. For questions about the footage or your rights, contact the operator named on the sticker.

Changes to this notice

We may update this notice from time to time. The version number and date at the top tell you which version you are reading.

For how Yipii handles personal data in its own right, read our privacy policy.