Security Camera Procedures

I. Purpose

The University of Colorado Boulder (“CU Boulder”) adopts and implements uniform procedures and standards for the installation, maintenance, and use of security cameras on all property owned or controlled by the CU Boulder. The Security Camera Policy and these Security Camera Procedures (“Procedures”) also govern security camera data access, control, and retention. The Policy and these Procedures support the use of security cameras at CU Boulder to deter crime, assist law enforcement, and protect people and property, while respecting the privacy and rights of employees, students, and campus guests.

II. Procedures

Procedures, Scope, Exclusions, and Definitions
1. Application. These Procedures apply to all CU Boulder Security Cameras and all CU Boulder-affiliated individuals who request or obtain access to Security Camera Data.
2. Definitions. As stated in the Security Camera Policy, the following definitions apply to these Procedures:
  1. Authorized User means any CU Boulder–affiliated individual authorized by a Security Camera Administrator to have ongoing viewing access to Security Camera Data.
  2. Data means any digital video data captured by Security Cameras that can be monitored, transmitted, stored, retrieved, or modified.
  3. Security Camera means any device capable of capturing video recordings, with or without audio, that a Security Camera Administrator uses to promote campus safety and security by monitoring:
    1. Exterior common areas;
    2. CU Boulder-owned or operated property and buildings;
    3. Rooms and labs containing high-value equipment or information;
    4. Cash-handling areas where money is exchanged, such as cashier locations; and
    5. Common areas and areas accessible to the public.
  4. Security Camera Administrator means any CU Boulder employee responsible for installation, management, operation, maintenance, and use of the infrastructure associated with Security Cameras for a specific CU Boulder college, department, program, office, research center, business service center, or other operating unit of CU Boulder. Security Camera Administrators are also responsible for data maintenance and access. Security Camera Administrators shall be designated by the Associate Vice Chancellor. Current Security Camera Administrators include:
    1. Facilities Management Security Camera Administrator – responsible for all CU Boulder Security Cameras not under the purview of another Security Camera Administrator;
    2. CU Boulder Police Department (“CUPD”) Security Camera Administrator – responsible for all CUPD Security Cameras;
    3. Student Affairs Security Camera Administrator – responsible for all Student Affairs Security Cameras;
    4. University Memorial Center Security Camera Administrator – responsible for all University Memorial Center Security Cameras (except those maintained by the CU Bookstore Security Camera Administrator); and
    5. CU Bookstore Security Camera Administrator – responsible for all CU Bookstore Security Cameras.
  5. University Safety Working Group means the committee appointed by the Associate Vice Chancellor for Office of Public Safety to review requests for Security Camera installations, requests for approval of existing Security Cameras, and lists of Authorized Users, and to make recommendations to the Associate Vice Chancellor or the Associate Vice Chancellor’s designee about those issues.
  6. Private Areas means areas in which an individual has a reasonable expectation of privacy, including but not limited to residential living areas, bathrooms, shower areas, locker and changing rooms, and rooms used for ombudsman, medical, physical, or mental health treatment.
3. Exclusions. These Procedures do not apply to cameras or audio/video recording systems deployed for any purpose other than security, including those used for:
  - The recording of live lectures or performances;
  - Instructional purposes;
  - Clinical patient care;
  - Human subjects research;
  - Video conferencing;
  - Use by individuals or organizations with whom CU Boulder has a valid, contractual landlord/tenant relationship relating to CU Boulder property;
  - Capturing images and data of vehicle license plates for parking or law enforcement purposes; and
  - Private use of by persons not acting pursuant to their employment or agency relationship with CU Boulder, or under CU Boulder’s direction and control.
Formation of the University Safety Working Group
1. Membership. Within thirty (30) days of the Effective Date of the Security Camera Policy and these Procedures, the Associate Vice Chancellor for Office of Public Safety (“Associate Vice Chancellor”) shall appoint the members of the University Safety Working Group. The University Safety Working Group shall include five (5) members, in addition to the Associate Vice Chancellor or the Associate Vice Chancellor’s designee, comprised of the Security Camera Administrators from Facilities Management, Student Affairs, University Memorial Center, CU Bookstore, and CU Boulder Police. University Counsel may advise the University Safety Working Group.
2. Chair. The Associate Vice Chancellor, or other person designated by the Associate Vice Chancellor to serve in the Associate Vice Chancellor’s place (“designee”), shall serve as Chair of the University Safety Working Group.
3. Committee Procedures. The University Safety Working Group members shall determine the University Safety Working Group operating procedures and rules. The University Safety Working Group operating procedures and rules may include, in addition to other operating documents as determined by the University Safety Working Group: Security Camera Training Guide; signage example(s); and forms for requests for longer data retention, logging of Authorized Users by Security Camera Administrators, and logging of Data releases.
4. Training for Security Camera Administrators. All CU Boulder Security Camera Administrators must receive training on technical, legal, and ethical use of Security Cameras and Data retention and release as outlined in the Security Camera Training Guide, as set by the University Safety Working Group pursuant to Section (B)(3) of these Procedures. All Security Camera Administrators must receive and acknowledge a copy of the Security Camera Policy and these Procedures.
Proposals for Installation of New Security Cameras
1. Proposal Process – New Installations. All new installations of Security Cameras requested after the Effective Date of the Security Camera Policy and these Procedures must comply with the standards and process outlined in this Section. Before purchasing or installing Security Cameras, all prospective applicants must adhere to the following process:
  1. The CU Boulder-affiliated applicant must submit a completed Security Camera Installation Proposal (Proposal) to the University Safety Working Group Chair. A complete Proposal includes:
    - The name and title of applicant submitting the proposal;
    - The building codes for the proposed locations to install the Security Cameras;
    - If applicable, the floors and rooms for the proposed Security Camera locations;
    - The focal points for the proposed Security Camera locations;
    - A narrative explaining the purpose and justification for the Security Cameras;
    - Acknowledgement that the applicant’s unit or department has secured the funding for purchase, installation and maintenance of the requested cameras (the applicant’s unit or department is responsible for making repairs to security cameras within 30-days of notification by the University Safety Working Group);
    - Signature from the building proctor and department or program head, if different than the applicant; and
    - If applicable, a narrative explaining any requested exemptions from these Procedures.
  2. After receipt of a completed Proposal, the University Safety Working Group Chair will present the Proposal to the University Safety Working Group for review. The University Safety Working Group will review each Proposal in accordance with these Procedures. To be approved, proposed Security Cameras must meet the following criteria:
    - The intended purpose and use of the proposed Security Cameras is security, as required by the Security Camera Policy and these Procedures.
    - The proposed Security Cameras’ hardware and technology specifications allow for and ensure compatibility with data access, storage, and retention requirements set by these Procedures.
    - The proposed Security Cameras’ location and coverage comply with Section II(E) of these Procedures (Security Camera Placement and Audio).
  3. The University Safety Working Group will recommend approval or denial of the Proposal to the University Safety Working Group Chair. The University Safety Working Group Chair has the authority to approve or deny the Proposal based on the recommendation of the University Safety Working Group, but the University Safety Working Group Chair shall make the ultimate decision to approve or deny the Proposal.
  4. The University Safety Working Group Chair will inform the applicant who submitted the Proposal of the determination in writing.
2. Denied Security Camera Installation Proposals. If the University Safety Working Group Chair denies a Proposal, the applicant who submitted the Proposal may not proceed with the Security Camera installation.
3. Approved Security Camera Installation Proposals. After the University Safety Working Group Chair notifies the applicant that the Proposal is approved, the applicant, together with the designated Security Camera Administrator for the building or program, may proceed with obtaining the Security Cameras. The Security Camera Administrator for the building or program is responsible for the installation, management, operation, maintenance, and use of the Security Cameras and for verifying and maintaining data storage functionality and capacity.
Requests for Approval of Existing Installed Security Cameras
1. Proposal Process – Existing Installations and Transition Period. Within one (1) year of the Effective Date of the Security Camera Policy and these Procedures (the “Transition Period”), all existing CU Boulder Security Cameras must adhere to the following process. By the end of the Transition Period, the CU Boulder affiliates responsible for the respective Security Cameras must either: (1) bring their existing Security Cameras into compliance with these Procedures; (2) remove noncompliant Security Cameras and acquire new Security Cameras which comply with these Procedures; or (3) remove noncompliant Security Cameras and proceed without any Security Cameras:
  1. The applicant must submit a completed Existing Security Camera Approval Request (“Approval Request”) to the University Safety Working Group Chair. A complete Approval Request shall include:
    - The name and title of the applicant submitting the Approval Request;
    - The building codes for the locations where the existing Security Cameras are installed;
    - If applicable, the floors and rooms for the locations where the existing Security Cameras are installed;
    - The original installation date, if known, for the Security Cameras;
    - The type and model of the Security Cameras;
    - The focal points for the locations where the existing Security Cameras are installed;
    - The locations of any existing signage signaling the Security Cameras’ presence;
    - A narrative explaining the purpose and justification for the Security Cameras;
    - Acknowledgement that the applicant’s unit or department has secured the funding for purchase, installation and maintenance of the requested cameras (the applicant’s unit or department is responsible for making repairs to security cameras within 30-days of notification by the University Safety Working Group);
    - If applicable, a narrative explaining any requested exemptions from these Procedures.
  2. After receipt of a completed Approval Request, the University Safety Working Group Chair will present the Approval Request to the University Safety Working Group for review. The University Safety Working Group will review each Approval Request in accordance with these Procedures. To be approved, existing Security Cameras must meet the following criteria:
    - The existing Security Cameras are currently used and will continue to be used for security in compliance with the Security Camera Policy and these Procedures.
    - The existing Security Cameras’ hardware and technology specifications allow for and ensure compatibility with data access, storage, and retention requirements set by these Procedures.
    - The existing Security Cameras’ location and coverage comply with Section II(E) of these Procedures (Security Camera Placement and Audio).
  3. The University Safety Working Group will recommend approval or denial of the Approval Request to the University Safety Working Group Chair. The University Safety Working Group Chair has the authority to approve or deny the Approval Request based on the recommendation of the University Safety Working Group, but the University Safety Working Group Chair shall make the ultimate decision approve or deny the Approval Request.
  4. As an alternative to approval or denial, the University Safety Working Group may hold an Approval Request for further review.
  5. The University Safety Working Group Chair will inform the applicant who submitted the Approval Request of the determination in writing.
2. Existing Security Camera Approval Requests Held for Further Review. If the University Safety Working Group holds an Approval Request for further review, the University Safety Working Group Chair will appoint one member of the University Safety Working Group to act as liaison to the applicant. The appointed University Safety Working Group liaison will work with the applicant to develop an Existing Security Camera Transition Plan (a “Transition Plan”). After the applicant and appointed University Safety Working Group liaison determine that the Transition Plan is complete, the University Safety Working Group liaison will resubmit the Transition Plan on behalf of the applicant to the University Safety Working Group for review and recommendation consistent with provisions (1)(i) – (iii) of this Section D. If the applicant and the University Safety Working Group liaison are unable to develop a Transition Plan, the University Safety Working Group liaison will resubmit the original Approval Request to the University Safety Working Group for review and recommendation consistent with provisions (1)(i) – (iii) of this Section.
3. Denied Existing Security Camera Approval Request. If the University Safety Working Group Chair denies an Approval Request, the applicant who submitted the Approval Request must, within 30 days of the University Safety Working Group Chair’s written notice of denial, remove the Security Cameras listed in the Approval Request.
Security Camera Placement and Audio
1. Areas Where Individuals Have a Reasonable Expectation of Privacy. Security Cameras must not capture footage of Private Areas. Security Camera Administrators shall ensure that their respective Security Cameras do not capture footage, either directly or indirectly, in any Private Areas.
2. Audio. Security Camera audio must be disabled at all times. No audio recordings from any Security Cameras may be captured or stored.
3. Special Considerations for Residence Halls. If any Security Camera’s line-of-sight includes views of any CU Boulder residence hall building, including any residential room or apartment, the Security Camera may only capture footage of the building exteriors and interior common areas that are generally accessible to all residents. Security Cameras may not capture footage of the interior of any residence hall or residential room except as part of an active criminal investigation authorized by a law enforcement agency. If a Security Camera’s line-of-sight includes any residence hall or other residential room window, this line-of-sight must be noted on the Security Camera Installation Proposal or Existing Security Camera Approval Request. If the University Safety Working Group Chair approves the Proposal or Approval Request, the respective Security Camera Administrator is responsible for ensuring that any windows are perpetually blacked out and that no footage of the windows is recorded.
Data Retention and Storage Requirements
1. Data Retention Policy. Security Camera Administrators must ensure that all resulting Data from their respective Security Cameras is retained for at least 30 days. Security Camera Data may be retained for longer periods in the following circumstances, to the extent compliant with Colo. Rev. Stat. § 24-72-113: the Data is relevant to an ongoing or potential criminal, civil, or other legal proceeding; an ongoing criminal investigation by a law enforcement agency; an active investigation pursuant to CU Boulder policy, including active student conduct proceedings; a legal hold obligation; as required by Administrative Policy Statement 2006 or the CU Boulder record retention schedules; pursuant to a valid court order; or as otherwise determined by the SCC Chair.
2. Data Destruction. Data that reaches or has exceeded the 30-day retention limit (or longer retention limit, as described in Section 2.F.1) may be replaced by newer, recently recorded Data as required by the security camera storage infrastructure applicable to that Data and managed by the responsible Security Camera Administrator. Data that is released to Authorized Users, CUPD, OIEC, or approved CU Boulder affiliates must be destroyed according to Administrative Policy Statement 2006 (“Retention of University Records”) by either deleting the Data file from the data system or reformatting of the removable media used to store the Data.
3. Data Security. Security Camera Administrators shall implement appropriate security safeguards based on the sensitivity, criticality, and level of identified risk of their respective stored data. All data generated by Security Cameras must be stored in a secure location established by the responsible Security Camera Administrator.
4. Data Storage Systems: Data from all CU Boulder Security Cameras must be recorded to the storage infrastructures maintained by one of the five authorized data storage systems as follows, except that a Security Camera Administrator may at any time opt to record and store Data on the system maintained by the Facilities Management Information Systems Office. The Associate Vice Chancellor or University Safety Working Group can make recommendations for change to the storage infrastructure based upon storage or technological need. Current data storage systems include:
  1. Facilities Management. Data from Security Cameras maintained by the Facilities Management Security Camera Administrator must be recorded to the storage infrastructure maintained by Facilities Management Information Systems office.
  2. CUPD. Data from Security Cameras maintained by the CUPD Security Camera Administrator must be recorded to the storage infrastructure maintained by CUPD Information Technology office.
  3. Student Affairs. Data from Security Cameras maintained by the Student Affairs Security Camera Administrator must be recorded to the storage infrastructure maintained by the Student Affiars Information Technology Services Office.
  4. University Memorial Center. Data from Security Cameras maintained by the University Memorial Center Security Camera Administrator must be recorded to the storage infrastructure maintained by the UMC Administration office.
  5. CU Boulder Bookstore. Footage from Security Cameras maintained by the CU Boulder Bookstore Security Camera Administrator must be recorded to the storage infrastructure maintained by CU Boulder Bookstore.
Security Camera Data Access and Release
1. Data Access Management. Security Camera Administrators are responsible for managing access to their Security Camera Data.
2. Access for Authorized Users. Security Camera Administrators may grant ongoing Security Camera viewing access to any CU Boulder–affiliated individual. These individuals are considered Authorized Users. Authorized Users may only monitor or review Data for specified and pre-designated Security Cameras as authorized by the Security Camera Administrator. Security Camera Data must be accessible only to Authorized Users in view-only format and configured to prevent unauthorized modification, duplication, or destruction.
3. List of Authorized Users. Each Security Camera Administrator must maintain a current list of the Authorized Users with access to Security Camera Data using a form as set by the University Safety Working Group pursuant to Section (B)(3) of these Procedures. Security Camera Administrators must conduct annual audits of their Authorized User lists to ensure compliance with these Procedures. The University Safety Working Group may request to review a Security Camera Administrator’s list of Authorized Users at any time.
4. Special Permissions for OIEC and CUPD. OIEC Authorized Users are granted both ongoing viewing access to Data and access to Data in removable media format for all Security Cameras to support OIEC investigations and foster a safe, inclusive, and accessible campus environment for all members of the CU community. CUPD Authorized Users are granted both ongoing viewing access to Data and access to Data in removable media format for all Security Cameras to support investigations, provide situation awareness during planned and unplanned events, and to enhance public safety. Security Camera Administrators are responsible for including any OIEC and CUPD Authorized Users on their Authorized Users list pursuant to Section II(G)(3) (List of Authorized Users).
5. Release of Data Pursuant to Valid Legal Process and Colorado Open Records Act Requests. Copies of Security Camera Data may be released pursuant to valid legal process. Security Camera Data may also be released in response to valid requests made pursuant to the Colorado Open Records Act, Colo. Rev. Stat. § 24-702-201, et. seq., or other applicable statute. Requests for Security Camera Data made pursuant to the Colorado Open Records Act must follow the processes outlined in Administrative Policy Statement 2022. University Counsel may provide advice regarding requests for Security Camera Data. All requests for Security Camera Data related to events or incidents involving potential criminal activity should first be made to University of Colorado Boulder Police Department.
6. Release of Data as Approved by the Security Camera Committee. Any CU Boulder-affiliated individual seeking Security Camera Data must adhere to the following process to seek Security Camera Data in removable media format:
  1. Applicants seeking release of Data based on events or incidents involving potential criminal activity must contact CUPD to open an investigation report and shall not request release of the Data from the University Safety Working Group Chair.
  2. Applicants seeking release of Data for any other purpose must submit Requests for Release of Security Camera Data to the SCC Chair using a form as set by the SCC pursuant to Section (B)(3). The University Safety Working Group Chair will present the Request for Release to the University Safety Working Group for review.
  3. The applicant requesting the Data must demonstrate the purpose for which the Data is being requested will further the interests of CU Boulder and does not violate any University of Colorado laws or policies. 
  4. The University Safety Working Group Chair shall forward the Request for Release to the Security Camera Administrator responsible for the Security Camera Data at issue. Within five (5) business days of receiving the Request for Release, the Security Camera Administrator may submit a written response to the Request for Release noting any objections or concerns about releasing the requested data. If the Security Camera Administrator does not submit a response, the Request for Release will be considered “no concern” by the Security Camera Administrator.
  5. The University Safety Working Group will review each Request for Release to ensure adherence to these Procedures. To be approved, the Request must meet the following criteria:
    - The CU-Boulder affiliate requesting the Data shows that the purpose for which the Data is being requested and will be used furthers the interests of CU Boulder and does not violate any University of Colorado laws or policies.
    - The amount of Data requested is the minimum amount necessary to fulfill the need demonstrated by the request.
    - The CU-Boulder affiliate requesting the Data demonstrates sufficient security measures will be taken to ensure the Data is not disclosed to any additional parties.
  6. The University Safety Working Group will recommend approval or denial of the Request for Release to the University Safety Working Group Chair. The University Safety Working Group Chair has the authority to approve or deny the Request for Release based on the recommendation of the University Safety Working Group, but the University Safety Working Group Chair shall make the ultimate decision of whether to approve or deny the Request for Release.
  7. The University Safety Working Group Chair will inform the applicant of the determination in writing.
  8. If the University Safety Working Group Chair approves the Request for Release, the University Safety Working Group Chair will forward the approved Request for Release to the appropriate Security Camera Administrator. The Security Camera Administrator shall allow access to the Security Camera Data consistent with the approved Request for Release.
  9. Any Data release must be logged in a form as set by the University Safety Working Group pursuant to Section (B)(3). This record should be maintained by the University Safety Working Group Chair.
  10. CUPD and OIEC are exempt from the requirements of this Section.
Signage to Notify of Security Cameras’ Presence
1. Signage. Signage consistent with example(s) as set by the University Safety Working Groups pursuant to Section (B)(3) should be placed in areas where Security Cameras are installed to provide reasonable notification of the cameras’ presence. Security Camera Administrators are responsible for ensuring appropriate signage is posted for their respective Security Cameras.
2. Placement. Signage may be placed at building entrances, interior/exterior common areas, or in the specific areas being monitored by Security Cameras, where deemed appropriate by the Security Camera Administrators given the location and circumstances.
Compliance
Any violation of the Security Camera Policy or these Procedures may be considered misconduct resulting in removal of the Security Camera, denial of access to Security Camera Data, and if applicable, corrective or disciplinary action, up to and including termination
Review
The University Safety Working Group will review the Security Camera Policy, these Procedures, and the University Safety Working Group operating procedures on an annual basis.

III. Related Policy

https://www.colorado.edu/policies/security-camera-policy

Effective Date

February 17, 2023

Approved By

Philip P. DiStefano, Chancellor

Policy Owner

Associate Vice Chancellor for Public Safety

Search

Other ways to search: