Irish Data Protection Commission Case Studies

We received a complaint in February 2013 concerning the alleged failure of a data controller to supply a data subject, in response to an access request, a copy of their personal data and, in particular, the CCTV footage of an incident involving the data subject. The data subject provided the data controller with the specific date and time of the incident captured on the CCTV system.

 

A claims adjuster firm responded to the access request on behalf of the data controller stating that it was in possession of the CCTV footage but it was not in a position to release a copy of the footage as images of other customers were identifiable on it and to release same would contravene data protection rules.

 

We commenced our investigation in March 2013 by writing to the data controller. The claims adjuster subsequently replied to us and it stated that the supply of the CCTV footage could potentially prejudice any right of recovery or indemnity that it was due to receive. It also claimed that, as there were other members of the public in the CCTV footage, providing the footage to the data subject would breach the Data Protection Acts.

 

We responded to the claims adjuster and we informed it that it had not cited an exemption under the Data Protection Acts which it was seeking to rely on to withhold a copy of the CCTV footage. We also drew its attention to the judgment of the High Court in the case of Dublin Bus v The Data Protection Commissioner. This case related to an access request for a copy of CCTV footage concerning a woman falling on a bus (Case Study 5 in Annual Report 2012 refers). The High Court ruled that "the existence of proceedings between a data requester and the data controller does not preclude the data requester making an access request under the Act nor justifies the data controller in refusing the request." We told the claims adjuster to re-consider its position on withholding the CCTV footage in light of that judgment.

 

On foot of our correspondence the claims adjuster sought photographic identification of the data subject in order to correctly identify him in the CCTV footage. On receipt of photographic identification it released a series of photographic stills from the CCTV footage to the data subject's legal representatives. The data subject's solicitor wrote to our Office and informed us of their dissatisfaction that there was no audio recording supplied with the series of stills. We wrote to the claims adjuster about this matter and it informed us that there was no audio recorded on the data controller's CCTV system. We advised the data subject's solicitor that we were satisfied that the obligations of a data controller were met in this case by providing a reasonable series of stills of images from the CCTV footage showing the requester's image only.

 

The following outlines this Office's position with regard to access to CCTV footage made under a Section 4 access request:

 

1.Any person whose image is recorded on a CCTV system has a right to seek and be supplied with a copy of their own personal data from the footage.

 

2.When making an access request for CCTV footage, the requester should provide the data controller with a reasonable indication of the timeframe of the recording being sought - i.e. they should provide details of the approximate time and the specific date(s) on which their image was recorded. For example, it would not suffice for a requester to make a very general request saying that they want a copy of all CCTV footage held on them. Instead, it is necessary to specify that they are seeking a copy of all CCTV footage in relation to them which was recorded on a specific date between certain hours at a named location. Obviously, if the recording no longer exists on the date on which the data controller receives the access request, it will not be possible to get access to a copy. Requesters should be aware that CCTV footage is usually deleted within one month of being recorded.

 

3.For the data controller's part, the obligation in responding to the access request is to provide a copy of the requester's personal information. This normally involves providing a copy of the footage in video format. In circumstances where the footage is technically incapable of being copied to another device, or where the supply of a copy in video format is impracticable, it is acceptable to provide stills as an alternative. Where stills are supplied, it would be necessary to supply a still for every second of the recording in which the requester's image appears in order to comply with the obligation to supply a copy of all personal data held. 

 

4.Where images of parties other than the requesting data subject appear on the CCTV footage, the onus lies on the data controller to pixilate or otherwise redact or darken out the images of those other parties before supplying a copy of the footage or stills from the footage to the requester. Alternatively, the data controller may seek the consent of those other parties whose images appear in the footage to release an unedited copy containing their images to the requester.

 

5.Where a data controller chooses to use technology to process personal data, such as a CCTV system to capture and record images of living individuals, they are obliged to shoulder the data protection obligations which the law places on them for such data processing. In the matter of access requests for CCTV footage, data controllers are obliged to comply fully with such requests. Claims by a data controller that they are unable to produce copies of footage or that stills cannot be produced from the footage are unacceptable excuses in the context of dealing with an access request. In short, where a data controller uses a CCTV system to process personal data, its takes on and is obliged to comply with all associated data protection obligations.