CCTV subject access request from public

[Deleted member 314759]

Hi everyone,

I hope some of you has knowledge and experience about official requests of CCTV footage from a public subject (no police, no court).

A few days ago I received a SAR from a lady requesting CCTV footage of a specified date/time as she may include it in a court trial soon because of an "incident" as she describes it. I reviewed the footage even around the time specified but couldn't see her harassed by anyone, she walks in the hotel (the business I'm helping out with this request) but nothing I would call "incident" happens.

As you know starting the process of providing this footage can be expensive and long-lasting due to the other people we have to blur the faces for in each frame. I obviously confirm I double-checked the identity of this person and the request is genuine, she is in the footage.

I tried to explain to her the above but she insists on getting the footage otherwise she'll raise a complaint through the ICO. What would you do in this situation? Does she have the right to insist? Can I mitigate the situation by inviting her to view the footage in person? What if she doesn't accept this either?

Thanks in advance, unfortunately I don't have too much experience with CCTV and any recommendation would be helpful.

Alessandro.

 

[Mike Kilby PC.dp]

I would say you are within your rights to refuse the request or charge a fee for the effort that will be required to anonymized the video.

You could always call the ICO, the helpline number is on their website, and get their opinion.

 

[Deleted member 314759]

Thanks for your reply Mike.

Ideally I'd like to not contact the ICO, I've been advised several times to not do that in this kind of occasions. Can we appeal to any rights to delete the CCTV footage though is still within our retention period?

 

[The Byre]

I would say you are within your rights to refuse the request or charge a fee for the effort that will be required to anonymized the video.

Wrong on both counts!

You have to provide the footage and you have to do so for free (something the MD of a company offering GDPR services should be painfully aware of!) I have just been through this process for my wife, who was injured in a fall and the other side tried all the same excuses and tried all the usual delaying tactics and all they achieved was to make their situation even worse.

If you collect footage of people, you must be prepared to have to do this under GDPR laws on a regular basis. The only alternative is to stop collecting CCTV footage. (And no, you are not allowed to destroy the footage either, but must keep it for a reasonable length of time. Also, if there is an incident or you become aware of a GDPR request, you must keep that footage until the incident or request is resolved.)

 

[Mike Kilby PC.dp]

I am not going to get into any arguments about who is qualified to advise, but I will say I have undertaken the 5 day's mandatory training and the closed book examination on Data Protection. This was written by respected professionals in the field of data protection in conjunction with the ICO, so I think I probably have the qualifications and knowledge.

The GDPR does explicitely allow you to charge for answering a Subject Access Request where it is "manifestly unfounded or excessive".

An organisation can refuse to supply any personal data as part of a SAR where that disclosure would also identify other unrelated parties, unless you can reasonably obtain the permission of those parties, or suitably redact their personal data. In the case of a video, it is technically possible to blur out the images of others however it is not an easy process.

It is also worth bearing in mind that it is an offence to require a data subject to make a subject access request that is not for their own information. If there is a genuine court case and this information is explicitly for that purpose, the request should come via a solicitor with authority from the data subject, exercising the rights under the DPA2018 to bring or defend a legal claim.

s3v3ns3v3n, I would strongly advise you to speak with the ICO if you are at all unsure. This is precisely the kind of reason why the ICO set up their helpline to help small businesses. They are not going to investigate you for querying whether you could either reasonably charge a fee for supplying the CCTV footage, or refuse on grounds that in releasing it you would be forced to release data about other parties.

Do not be afraid of the ICO, they are there to help and prefer to help than issue fines in all but the most exceptional cases. If you approach them first, any complaint the data subject might then make will be less serious for you.

 

[Newchodge]

If there is a genuine court case and this information is explicitly for that purpose, the request should come via a solicitor with authority from the data subject, exercising the rights under the DPA2018 to bring or defend a legal claim.

Unless, of course, the individual is representing themselves, when no solicitor will be available.

 

[tony84]

Why would you not speak to the ICO? They govern us on this sort of thing.

I have spoken to them once or twice over the years (never about a SAR) and they have always been helpful and friendly. If nothing else, you may told you are in the wrong and learn something new - Im not suggesting you are btw. I think I would be looking for the customer to cover the costs if it is expensive/time consuming.

 

[Deleted member 314759]

Thanks for your replies.

How does their hotline work? Do they record the call? Do they take all the details of the company I'm calling on behalf of? Do they follow up or just give advice?

 

[The Byre]

I have undertaken the 5 day's mandatory training and the closed book examination on Data Protection.

My legal team (one solicitor, one barrister and some paralegals) are eminently well qualified to come to conclusions on this topic and they pointed to recent case law on this subject. The company administrating the CCTV, once relevant case law had been made clear to them, had to back down. They too had probably attended five-day courses.

Of course, if requests being made are not reasonable (e.g. vexatious or irrelevant to any incident or circumstance) then provision may be either denied or charged for.

 

[Deleted member 314759]

FYI and for future reference in case this can be helpful to someone else:

I called the ICO, explained the situation and they agree with me that it is unreasonable for her to ask us to edit the video, unless we have an easy process in place to do so (not the case). They also said that we have an obligation to protect the confidentiality of other people on this video.
Last but not least, they say that if this is a matter of a court trial, a SAR request is not appropriate. This request must be initiated by the police or a court order.

Thank you all for your recommendations!

 

[The Byre]

If this is to be a possible criminal matter, yes, it sounds as if you were given the correct advice.

unless we have an easy process in place to do so (not the case).

If you or your client fear that such requests may come again (they almost certainly will!) then it might be a good idea to download the free version of 'Hit-Film-Express'. It has a match-move function that allows you to blotch out moving faces and you can export short sections suitable for email.

https://fxhome.com/express

It's a great deal easier to spend a couple of minutes processing a few seconds of video, than arguing for hours over why you should not have to do this!

 

[Deleted member 314759]

Thanks, I'll check that out for them.

Cheers!

 

[Calvin Crane]

I would think if the evidence is for use in court you could argue you don't need to make the faces anonymous as it isn't public. Think you are making this harder than it needs to be. Would be doing the same if it were me and you wouldn't release the footage. If you give the file to the courts I would say you have very low cost. Job done?

 

[Mike Kilby PC.dp]

I would think if the evidence is for use in court you could argue you don't need to make the faces anonymous as it isn't public.

Indeed what you say is true but for the wrong reason. A UK court of law is a public court, in theory anyone can go and watch a court proceeding, unless the judge explicitly makes the matter a "closed court".

If an official request for data is made, that is done under the Data Protection Act 2018 and overrides the requirements of the GDPR, so it would not need to be redacted. These must be made by law enforcement, the courts or an official tribunal in order to enact the provisions of the DPA2018. If that is not enacted, the GDPR explicitly forbids releasing 3rd party information, including images, for ANY purpose.

 

[Diesel]

We sometimes do redacting of videos for local government in preparation for court cases. Despite this I often think what is the harm in showing someone who is incidental and irrelevant to the issue in hand? Someone just generally passing through is unlikely to suffer in any way from the CCTV being shown for a purpose unconnected to them. We do some redacting work where issues are clearly more sensitive - CCTV in school incidents for example - but recording someone in a public place is perfectly legal as far as standard filming is in the question so not sure why the issue is seemingly escalated for passive CCTV? Filming your own event in a private place is also absolutely fine but it is very good practice to make people aware of this. My feeling specifically here is to supply the footage and pass on any redacting/privacy buck to the end user, in writing.