Subject Access Requests

[DT]

Has anyone had any experience dealing with Subject Access requests for CCTV footage?

I am a little confused now after hearing a story from a colleague regarding a customer of a supermarket being refused a copy of CCTV footage of him in-store. I am not sure why but he had made a subject access request to the store to view footage of himself standing in a particular aisle. He gave an exact time, date, and description of himself etc – everything they need to find him on the recordings. The store refused his request saying they could not release a copy, as it would breach the Data Protection Act. They also stated they had no Code of Practice for their system.

I was under the impression that as long as there were no requirements for the footage to be used in criminal/civil proceedings then the store must provide the it? I spoke to my own company and they told me they only release images to the police and no one else under any circumstances.

So what is the law?

If I operated a camera system in a store, would I have to give footage to a customer if they requested it?

What if there were other people in the images but no expectation of privacy being a public place? Can I refuse due to other people in the footage or must I blank them out and provide the edited footage?

If I were to observe a shoplifter on CCTV and use the footage to prosecute them, would they be able to request the footage of themselves in the act?

I have looked at the ICO website and it doesn't make it entirely clear, or I might have just missed it.

[bigboyblue]

I am a little confused now after hearing a story from a colleague regarding a customer of a supermarket being refused a copy of CCTV footage of him in-store. I am not sure why but he had made a subject access request to the store to view footage of himself standing in a particular aisle. He gave an exact time, date, and description of himself etc – everything they need to find him on the recordings. The store refused his request saying they could not release a copy, as it would breach the Data Protection Act. They also stated they had no Code of Practice for their system.

DPA says they must have a code of practice for their system, and yes, you are right - assuming there is no legal action pending, then there should be a release made. If the data subject wanted to, i'd say get a good solicitor, and take them to the cleaners.


I was under the impression that as long as there were no requirements for the footage to be used in criminal/civil proceedings then the store must provide the it? I spoke to my own company and they told me they only release images to the police and no one else under any circumstances.
They are talking crap. As you said above, the DPA gives the data subject THE RIGHT to view / have a copy of the footage they have been captured on. Yes, you can chrge up to £40 for it, but you have to provide.

So what is the law?

If I operated a camera system in a store, would I have to give footage to a customer if they requested it?
Yes, you would. They have to make a request, and its then up to you if you will release it. The only reasons you can use are legal prceedings pending, the footage doesnt exist, or you dont physically have it. BUT, you cant release anyone elses footage - so if there is anyone else in the frame, you would have to blank out their face. Something which you cant do in store. So in essance, if I came up to you, and demanded my footage, you cant say no, but you can make me ask for it in writing, and then make your decision

What if there were other people in the images but no expectation of privacy being a public place? Can I refuse due to other people in the footage or must I blank them out and provide the edited footage?
Unless you have their permission too (eg a family etc) then yes, you have to blank out their faces. You would be breaching their data proteciton rights if you didnt, opening up to prosecution by the data comissioner, and also by the others you didnt blank out as well.

Its the data controller of the store whose bum is on the line - whoever is named on the cctv signs. Supermarkets etc simply get the data subject to write to loss prevention department, and they handle all the requests etc. If its a smaller shop, and nobody knows anything about it, then bottom dollar they have no policy.

There is a group going round asking for DPA request forms etc. They are threatening to sue the shops concerned if they have no knowledge. Ive yet to hear them issuing papers, but its only a matter of time till a shop settles out of court.

[DT]

Very helpful reply, thank you :)

[djbt_uk]

Hmmm, interesting one this.

Normally it's a head office department that would deal with these requests, not anyone at store level... you'd normally just point them in the right direction, give them an address etc.

CCTV footage is the same as any other data, governed by the DPA. However I see the following as a bit of a catch 22.

Data can only be used by the data holder for it's advertised purpose.
For example, if the sign at the front door says "CCTV is recorded...For the protection of customers, staff and stock" then you have to prove that you are not using that data for any other purpose at audit level.
Therefore you could ask what the footage will be used for by the subject making the access request and say that if it isn't in line with your stated purpose, you can't just give it out. But I think that would merely delay the inevitable handing over of the data/open a court case.
If it's for an insurance claim, then require the insurer to make the request and if you then hand it over to the insurer, state it is still governed by the DPA.

On the other hand, the subject has a legal right to know/see what data is held by the company that has collected it.

I don't think you can actually state "Piss off, you're not seeing what my cameras can and can't see" but from what has been said about a specific aisle on a specific time and date, it suggests someone might want to test if certain areas of your shopfloor are constantly recording or not. This rings alarm bells to me.

Here's a few suggestions, but not what I would stand up in court and defend as advising you to do;

>How about giving them stills, but blacking out EVERYTHING except the person and the time and date bar. Essentially you'll have a black box with just a time and date bar and one person showing. This complies with their request, but protects your shopfloor and other people in the shot(s). It is also a 'merry two-fingers' to the twunt making the request.

>Lie. "We do not have/no longer have the data you have requested to view. We cannot find a match to your request/it has been recorded over. All my love, Jim, Security."

>Make it someone elses problem, ie head office, but outline any concerns you have about misuse, bad intentions, criminal activity.

Just make sure whatever you do is authorised/sanctioned from above and records kept to cover your arse.

I hope this helps a bit.

[bigboyblue]

Ive always thought about the whole 'just seeing what your cameras can see' bit.

My local Tesco superstore had over 100 cameras - and recorded ................ 16. (since been refitted properly, in case anyones from my area and needs to go for christmas shopping).

And most of those cameras were of course statics, covering high risk 'off shop floor' areas.

At least we know all about dpa requests, or at least what to do when someone asks. I do remember a programme with Dom Jolly on, going into small shops, and asking about dpa release. They had no idea. No signage, tapes that were so close to the counter you could eject them yourself ......

[djbt_uk]

Something similar to Dom Joly putting people on the spot, but more sinister.
My mate's a CCTV engineer and told me about this one when we were discussing what sortof training they give to small businesses they deal with:

Bloke walks into a small shop and says he can demand that CCTV is turned off, he objects to being filmed... "Human rights etc etc"
Shopkeeper goes and turns the thing off and then gets a bat round his head. Two more blokes walk in and the three turn the place over: Till takings, stamps, spirits, tobacco & cigs, scratchcards -the lot.

The shopkeeper wasn't seriously hurt, but probably learnt a lesson.
Insurance, quite rightly, refused to pay out full amounts for all that was taken because CCTV is a factor in the policy and the terms weren't fully met.

[karlbee]

A little tip for when punters start going on about human rights etc or what they are telling you that you ( in their opinion) legaly have to to,politely explain that if they believe a crime is been committed they should phone the police.This will leave you free to get on with the job that you are trained and payed to do.I did this with an awkward customer Friday night,after him phoning the police to report me for his rights abuse and getting nowhere he gave up.

[djbt_uk]

A little tip for when punters start going on about human rights etc or what they are telling you that you ( in their opinion) legaly have to to,politely explain that if they believe a crime is been committed they should phone the police.This will leave you free to get on with the job that you are trained and payed to do.I did this with an awkward customer Friday night,after him phoning the police to report me for his rights abuse and getting nowhere he gave up.

A man after my own heart. Have done this in the past: "If you think I'm breaking the law, here's 20p, ring someone who gives a flying f@ck..."

Another one that my mate uses all the time: "Only humans get human rights, fella..."

[Gepard]

"If you think I'm breaking the law, here's 20p, ring someone who gives a flying f@ck..."

God....with all the people I deal with I'd end up working for a loss!