GDPR Data Request for CCTV Footage

Pablo_Flox

I have a quick question for people that know more than me on the subject...

Theoretically if someone was to put in a GDPR Data Request for CCTV footage of themselves at a tram stop, requesting any footage of them within a 5 minute time frame. And the tram operator was to responded saying they would only respond to requests for CCTV footage from the Gardai, would they within their rights to refuse the request? If not what in theory could some possible next steps...

I have read about cyclists successfully requesting CCTV footage from Dublin Bus (https://irishcycle.com/2018/10/21/how-to-request-cctv-from-dublin-bus-using-gdpr/)


Of course this is all hypothetical and just for general discussion. The reason someone might want the footage is irrelevant.

Thanks in advance for any info!

zell12

If it is refused, appeal to the ODPC
The entity has to give you the data if it exists, and blob out anyone else.

Robbo

You right of access is a strong one, write/email to the DPO of the tram operator outlining your request.

There's no exact form for a Subject Access Request (despite some jobsworth DPOs insisting that there's a magic formula) but do try to include as much detail as you can to make everyone's life easier (e.g. I was the guy in the blue hat at Heuston stop between 11:00 and 11:15 on Christmas Eve).

Bear in mind that the earlier you make a request the better. CCTV is regularly overwritten.

Aye Bosun

Pablo_Flox wrote: »

I have a quick question for people that know more than me on the subject...

Theoretically if someone was to put in a GDPR Data Request for CCTV footage of themselves at a tram stop, requesting any footage of them within a 5 minute time frame. And the tram operator was to responded saying they would only respond to requests for CCTV footage from the Gardai, would they within their rights to refuse the request? If not what in theory could some possible next steps...

I have read about cyclists successfully requesting CCTV footage from Dublin Bus (https://irishcycle.com/2018/10/21/how-to-request-cctv-from-dublin-bus-using-gdpr/)


Of course this is all hypothetical and just for general discussion. The reason someone might want the footage is irrelevant.

Thanks in advance for any info!

I’m open to correction on this but as the CCTV recorded you and most likely other people as well in the same clip then they cannot just release the video to you without an official request from the Garda or a solicitor on your behave. Even then the video would have to have any other person visible blurred to protect their privacy too.

Pablo_Flox

Aye Bosun wrote: »

I’m open to correction on this but as the CCTV recorded you and most likely other people as well in the same clip then they cannot just release the video to you without an official request from the Garda or a solicitor on your behave. Even then the video would have to have any other person visible blurred to protect their privacy too.

Data Protection Commissions outlines in the Guidance on the use of CCTV that “data protection law provides for a right of access to their personal data by individuals. This applies to any individual whose identifiable image has been recorded by a CCTV system….

Pablo_Flox

Thanks for the replies! It has helped point my in the direction of what some theoretical next steps could be if such a situation was to ever arise!

KWAG2019

Aye Bosun wrote: »

I’m open to correction on this but as the CCTV recorded you and most likely other people as well in the same clip then they cannot just release the video to you without an official request from the Garda or a solicitor on your behave. Even then the video would have to have any other person visible blurred to protect their privacy too.

5 mins of CCTV in a very busy area will take some amount of anonymization. Can the firm charge the applicant for the cost of editing?

SlowBlowin

Its been a few years since I was involved in this, but when I was you were entitled to charge a justified nominal fee, mainly to put off casual requests.

listermint

Also if they've deleted the footage then you've no entitlement to it. As it's gone.

80j2lc5y7u6qs9

Aye Bosun wrote: »

I’m open to correction on this but as the CCTV recorded you and most likely other people as well in the same clip then they cannot just release the video to you without an official request from the Garda or a solicitor on your behave. Even then the video would have to have any other person visible blurred to protect their privacy too.

There is no need for garda or solicitor. The data controller has to give you your images and blank out the other people. If you are not happy with the result you complain to the Data Protection Commissioner. See Data Protection Commissioner site

Carawaystick

KWAG2019 wrote: »

5 mins of CCTV in a very busy area will take some amount of anonymization. Can the firm charge the applicant for the cost of editing?

No, can't charge. if they are processing so many peoples data that the costs to blur all the other people are large, maybe they should consider not processing so many peoples data...

KWAG2019

Carawaystick wrote: »

No, can't charge. if they are processing so many peoples data that the costs to blur all the other people are large, maybe they should consider not processing so many peoples data...

One possible outcome of current legislation will be the decline in use of CCTV and decline in public safety. Another would be the recognition that the data protection legislation is having a contrary effect to that intended and that it will be repealed or significantly amended. This particular struggle will begin to play out more in years ahead.

harr

Last place I worked ( retail) we would have had the odd request for cctv footage of a certain time frame even if the person requesting it wasn’t in it ..normally it was seeing if a certain car had been on the premises...in that instance the guards would need to request the footage.
But as per legislation a request from an individual of footage of themselves has to be given and everyone else’s face needs to be blocked out including any car reg numbers for a small business with basic cctv the cost of sending footage to get faces blurred is substantial and time consuming.
So owners stared to delete footage after only a week which people often didn’t believe.. we have gotten letter form data commissioner asking why we didn’t supply footage but were ok with our explanation about only keeping footage for the week.
A lot the newer cctv systems have the blurring software built in but are hugely expensive especially for smaller businesses.
I did think you could request a small few for supplying the footage .. that might have changed.

80j2lc5y7u6qs9

harr wrote: »

Last place I worked ( retail) we would have had the odd request for cctv footage of a certain time frame even if the person requesting it wasn’t in it ..normally it was seeing if a certain car had been on the premises...in that instance the guards would need to request the footage.
But as per legislation a request from an individual of footage of themselves has to be given and everyone else’s face needs to be blocked out including any car reg numbers for a small business with basic cctv the cost of sending footage to get faces blurred is substantial and time consuming.
So owners stared to delete footage after only a week which people often didn’t believe.. we have gotten letter form data commissioner asking why we didn’t supply footage but were ok with our explanation about only keeping footage for the week.
A lot the newer cctv systems have the blurring software built in but are hugely expensive especially for smaller businesses.
I did think you could request a small few for supplying the footage .. that might have changed.

Isn't it only garda could back then request footage they were not in? Didn't you used to be able to charge up to 6.35 for processing the request?

harr

Kassandra Mealy Spaciousness wrote: »

Isn't it only garda could back then request footage they were not in? Didn't you used to be able to charge up to 6.35 for processing the request?

Not sure how far back that came into force... but definitely before GDPR became law it seemed to be ok to check CCTV for people and yes I do believe you could charge a few quid for getting footage for people.
What’s the procedure for shops posting CCTV footage on the likes of Facebook surely they are leaving themselves wide open for a breach of GDPR especially when the general public can be identified in the footage.
I still see it nearly on daily basis..

mightyreds

I don't want to start a new thread but also cautious about derailing this, but I want to put in a gdpr for CCTV to a hotel is this possible and how do I go about it

SlowBlowin

As I said before its been a few years, but we used to supply CCTV all over the UK. It was common practice, in a retail/public environment, to charge a small fee to process a request. Without this fee it would be easy for anyone to legally bring any CCTV department to its knees by issuing multiple requests. The fee is seen purely as a deterrent for repeated requests.

CCTV law is vague, and guidelines are published each year, but these are open to interpretation and change radically depending if there has been a recent terrorist attack.

Vetch

SlowBlowin wrote: »

As I said before its been a few years, but we used to supply CCTV all over the UK. It was common practice, in a retail/public environment, to charge a small fee to process a request. Without this fee it would be easy for anyone to legally bring any CCTV department to its knees by issuing multiple requests. The fee is seen purely as a deterrent for repeated requests.

CCTV law is vague, and guidelines are published each year, but these are open to interpretation and change radically depending if there has been a recent terrorist attack.

Where a person is identifiable on CCTV it is personal data and under GDPR access to one copy is generally free of charge. Controllers are allowed to charge a reasonable fee or refuse a request where the initial request is 'manifestly unfounded or excessive'. Controllers can also charge a reasonable fee for further copies of the data. Controllers have to prove a request is 'manifestly unfounded or excessive' so refusing or charging a fee would have to be justifiable.