I am a little confused now after hearing a story from a colleague regarding a customer of a supermarket being refused a copy of CCTV footage of him in-store. I am not sure why but he had made a subject access request to the store to view footage of himself standing in a particular aisle. He gave an exact time, date, and description of himself etc – everything they need to find him on the recordings. The store refused his request saying they could not release a copy, as it would breach the Data Protection Act. They also stated they had no Code of Practice for their system.
DPA says they must have a code of practice for their system, and yes, you are right - assuming there is no legal action pending, then there should be a release made. If the data subject wanted to, i'd say get a good solicitor, and take them to the cleaners.
I was under the impression that as long as there were no requirements for the footage to be used in criminal/civil proceedings then the store must provide the it? I spoke to my own company and they told me they only release images to the police and no one else under any circumstances.
They are talking crap. As you said above, the DPA gives the data subject THE RIGHT to view / have a copy of the footage they have been captured on. Yes, you can chrge up to £40 for it, but you have to provide.
So what is the law?
If I operated a camera system in a store, would I have to give footage to a customer if they requested it?
Yes, you would. They have to make a request, and its then up to you if you will release it. The only reasons you can use are legal prceedings pending, the footage doesnt exist, or you dont physically have it. BUT, you cant release anyone elses footage - so if there is anyone else in the frame, you would have to blank out their face. Something which you cant do in store. So in essance, if I came up to you, and demanded my footage, you cant say no, but you can make me ask for it in writing, and then make your decision
What if there were other people in the images but no expectation of privacy being a public place? Can I refuse due to other people in the footage or must I blank them out and provide the edited footage?
Unless you have their permission too (eg a family etc) then yes, you have to blank out their faces. You would be breaching their data proteciton rights if you didnt, opening up to prosecution by the data comissioner, and also by the others you didnt blank out as well.
Its the data controller of the store whose bum is on the line - whoever is named on the cctv signs. Supermarkets etc simply get the data subject to write to loss prevention department, and they handle all the requests etc. If its a smaller shop, and nobody knows anything about it, then bottom dollar they have no policy.
There is a group going round asking for DPA request forms etc. They are threatening to sue the shops concerned if they have no knowledge. Ive yet to hear them issuing papers, but its only a matter of time till a shop settles out of court.