Guide
CCTV subject access request: who can see your footage, and how
Updated
This is the obligation that catches businesses out, because it arrives by email months after the cameras were installed and the recorder is not set up for it.
The right, in one paragraph
Footage of an identifiable person is their personal data, so they can make a subject access request for it. The ICO's guidance is explicit that when choosing a surveillance system, personal data should be easily retrievable in response to a subject access request and other individual rights, and that you should ensure your system can redact footage where third parties need to be blurred or obscured. In other words, the ability to answer is meant to be a purchasing criterion, not an emergency.
What to do when a request arrives
- Note the date it arrived: the statutory response clock starts then, and the ICO's own example refers to responding within the statutory response times.
- Ask for what you need to find the footage: date, time window, location, and a way to identify the person, but do not use questions as a delaying tactic.
- Confirm who they are, proportionately, so you do not hand someone else's images to the wrong person.
- Find the footage and check who else appears in it.
- Redact or obscure third parties where their rights would otherwise be affected, and provide the footage in a form the person can access.
- Keep a record of what you provided, what you withheld and why.
Who else might ask
- The police
- A request from law enforcement is a disclosure question, not a subject access request. Ask what the legal basis for the request is, record who asked and what you gave them, and get it in writing.
- Insurers and solicitors
- Third-party requests need their own justification. Do not hand footage over simply because the request sounds official.
- Another business or a neighbour
- Being asked nicely is not a lawful basis. If the request is really about an incident involving a specific individual, that individual can make their own request.
- An employee
- Staff have the same right to their own images as anyone else, and workplace monitoring is one of the ICO's stated high-risk examples requiring a DPIA. Expect requests, and be ready to answer them without drama.
Make the system do the work
- Ask at quotation stage whether the software can export a defined clip with faces or plates redacted, and whether that needs an extra licence.
- Check how long it takes to find a specific time on a specific camera. A system with poor search makes every request expensive.
- Make sure more than one person knows how to do an export, so a request does not sit until someone comes back from leave.
- Write a one-page internal procedure and keep it with the retention policy.
If your recorder cannot redact and cannot export cleanly, that is a cost you will pay later in staff time on every request. It is worth weighting at purchase.