Requests for CCTV footage usually come from three different kinds of people, and a different rule applies to each. The person filmed has the right to a copy of their own data (Article 15(3) GDPR) within one month at the latest (Article 12(3) GDPR), but the data of other people in the frame must be protected (Article 15(4) GDPR). A pre-trial investigator, a prosecutor and a court have the right to require items and documents to be handed over (Article 97 of the Code of Criminal Procedure, BPK), and the law names video recordings as documents (Article 96(1)(4) BPK). The GDPR gives an insurer, a lawyer, another company or a neighbour no right to demand footage. You may give it to them only when you yourself have a legal basis for doing so.
Who may watch camera footage in the first place, for example in an apartment building, is covered in our article apartment building cameras: who can view recordings. Here we cover how to respond when footage is requested from you, and what happens when the answer is wrong.
Every disclosure is a separate processing operation
Filming lawfully does not mean you may hand the footage to anyone who asks. The European Data Protection Board (EDPB), in its Guidelines 3/2019 on video devices (version 2.0, adopted on 29 January 2020), says that any disclosure of personal data is a separate kind of processing. The controller must justify it on one of the bases in Article 6 GDPR (paragraph 51).
The purpose matters too. If footage is passed on for a purpose other than the one it was filmed for, and there is neither consent nor a law behind it, the controller must assess whether the new purpose is compatible with the original one (Article 6(4) GDPR). The EDPB gives an example. A camera in a car park is installed to deal with damage. Passing the footage to a lawyer so that a claim for the damage can be brought raises no compatibility issue, because the purpose is the same (a legal basis under Article 6 is still needed). Publishing the same footage online for entertainment is not, because the purpose has changed and is incompatible (paragraph 53).
The recipient must also have its own legal basis for receiving the footage (EDPB 3/2019, paragraph 55). That is why a written request stating who is asking, for what period and why helps both sides.
When the person filmed asks
The person has the right to confirmation of whether their data is processed, and to access it (Article 15(1) GDPR). The controller provides a copy of the data being processed (Article 15(3) GDPR). The first copy is provided at no cost (Article 12(5) and Article 15(3) GDPR). The answer must be given without undue delay and within one month of receiving the request at the latest (Article 12(3) GDPR). How and when to answer a subject access request is covered in Subject access requests: the deadline and the answer.
Other people in the frame are not a reason to refuse. The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4) GDPR), so other people’s faces are blurred or otherwise masked. The EDPB says clearly that protecting third parties should not become an excuse for denying people what they are lawfully asking for (3/2019, paragraph 94). The person, for their part, should say when they entered the monitored area, and the controller should tell them in advance what information it needs. In the EDPB example of a large shopping centre, that means to within one hour (paragraph 96).
The biggest risk here is time. If recordings are deleted automatically after a few days and the request arrives later, there is nothing to give, and the person must be told so (EDPB 3/2019, paragraph 96). But if the request arrives while the recording still exists, the EDPB Guidelines 01/2022 on the right of access (version 2.1) say that where data is kept only for a very short time, there must be measures so that it is not deleted while the request is being handled. In practice this means one step: when a request arrives, save the relevant clip separately straight away.
When the police or a pre-trial investigator asks
A pre-trial investigator, a prosecutor and a court have the right to require natural and legal persons to hand over items and documents relevant to investigating a criminal offence (Article 97 BPK). In administrative offence cases, the investigating officers also have the right to require items and documents relevant to the case (Article 593(1)(7) of the Code of Administrative Offences, ANK).
Your legal basis in that case is a legal obligation (Article 6(1)(c) GDPR). This is also how the EDPB sees it: where national law requires cooperation with law enforcement, the disclosure is based on a legal obligation, and purpose compatibility is usually not an issue (3/2019, paragraphs 57–58).
One company received a police letter asking for footage and for details of the people who were on the premises at the time. It asked whether the police had to prove separately that they were entitled to collect this data. We answered that the officer was using the right given by Article 97 BPK and did not have to prove it separately. What is worth checking is something else: whether the letter really comes from the authority conducting a pre-trial investigation (it usually gives the investigation number), and exactly which period and which cameras it covers. Article 97 BPK allows items and documents to be required, so hand over the existing recordings for the period requested, not the whole archive.
If the footage is not handed over, a seizure may be carried out on a reasoned order of the pre-trial investigation judge (Article 147(1) BPK), and the footage may be taken by force (Article 147(4) BPK). A person who does not follow the lawful instructions of an officer, a prosecutor or a court may be fined (Article 163(1) BPK).
You may also give footage to the police on your own initiative (Article 98 BPK), for example when a camera has recorded a theft. The basis then is not a legal obligation but legitimate interest (Article 6(1)(f) GDPR). The EDPB says this is usually enough where you reasonably suspect that a crime has been committed (3/2019, paragraph 59). The police themselves, when investigating criminal offences, no longer process the data under the GDPR (Article 2(2)(d) GDPR).
When an insurer, a lawyer, another company or a neighbour asks
The GDPR gives these requesters no right to demand footage. Other laws may give certain bodies a right to require information. In that case, ask them to name the specific article: if it exists and obliges you to hand over the footage, your basis is a legal obligation (Article 6(1)(c) GDPR). The State Data Protection Inspectorate can also require information (Article 58(1)(a) GDPR).
Where there is no such law, refusal is still not the only possible answer. A person who had been told that the GDPR does not allow footage to be used to identify an offender received our answer that this is wrong: passing footage to the police or to the injured owner can have a legal basis. For the injured party this is usually the legitimate interest of a third party (Article 6(1)(f) GDPR), for example in obtaining compensation for damage.
For this basis to actually work, you need three things. First, a written request stating the incident, the time and the purpose. Second, provide only the clip that is needed, not the whole day’s recording. Data must be limited to what is necessary for the purpose (Article 5(1)(c) GDPR). Third, write down why you decided to disclose.
For an insurer, another route is sometimes simpler: the person filmed gets a copy of their own recording and passes it to their insurer. But other people are masked in that copy (Article 15(4) GDPR), so if the insurer needs to see the other party to the incident, this route does not work. And if the incident looks like a criminal offence, the footage should be requested by the police.
What you may not do: publish the footage on social media to “help find the culprit”. To a person who asked about footage being published in an owners’ association’s social media group, we answered that publishing someone’s image to shame them would not meet the GDPR’s lawfulness criteria. It is a separate processing operation with a different purpose, and there is almost never a basis for it.
What most often goes wrong, and what it can lead to
The footage is deleted while the request is being considered. In one case a police letter arrived after the recordings had already been deleted under a retention period of a few days. That is not a breach if the period is set and justified. But if footage is deleted after a police demand has been received, this may be treated as obstructing the investigation (Article 163(1) BPK), and if it is deleted after the person’s own request, their right of access is infringed.
Refusing “because of the GDPR”. With the police, this can end in a seizure and a fine under the BPK. With the person filmed, it can end in a complaint to the State Data Protection Inspectorate (VDAI).
Giving too much. A full, unedited recording showing other people, sent by email to an insurer or a neighbour, is a disclosure without a legal basis as regards those people.
No trail is left. The controller must be able to demonstrate compliance with the principles (Article 5(2) GDPR). Without a record of who asked for what, when, and what they received, there is nothing to demonstrate it with.
The consequences can be serious. Breaches of the processing principles and the legal basis, and breaches of data subjects’ rights, fall into the highest fine tier: up to twenty million euros or, for an undertaking, up to 4 % of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5) GDPR). This tier covers both the principles and legal basis (Article 83(5)(a) GDPR) and data subjects’ rights (Article 83(5)(b) GDPR). A person who has suffered damage because of a breach has the right to compensation (Article 82(1) GDPR).
When to call a lawyer
- when footage is requested because of a dispute between your employees, customers or neighbours;
- when an insurer, a lawyer or another company asks for footage covering a long period or all cameras;
- when it is unclear whether a police request relates to a pre-trial investigation or to another procedure;
- when you want to hand over footage on your own initiative or publish it;
- when a person has complained that they did not receive their recording.
Frequently asked questions
Do the police need a court order to obtain CCTV footage?
No. A pre-trial investigator, a prosecutor and a court have the right to require items and documents to be handed over (Article 97 BPK), and such a request is a legal obligation for you (Article 6(1)(c) GDPR). An order by the pre-trial investigation judge is needed for a seizure, which may be carried out when the footage is not handed over voluntarily (Article 147(1) BPK). Record who asked and what you handed over.
May CCTV footage be given to an insurer?
Yes, if you have a legal basis. Where no law gives the insurer such a right, legitimate interest would usually be the basis (Article 6(1)(f) GDPR), and it has to be weighed: is the footage really necessary, and do the interests of the other people in the frame not override it? Hand over only the clip that is needed, on a written request stating the incident, the time and the purpose. Sometimes it is simpler for the person filmed to get a copy of their own recording and pass it to the insurer, but other people will be masked in it.
Must I give footage to a person if other people can be seen in it?
Yes, if the person has given a sufficiently precise time and the recording is still kept. Other people’s faces are blurred, because the right to a copy must not adversely affect the rights of others (Article 15(4) GDPR). The EDPB stresses that protecting other people is not a reason to refuse altogether.
What should I answer if the footage has already been deleted?
Tell the person that recordings are kept for a set period and that the recording for the period they asked about no longer exists. This is what the EDPB recommends too (3/2019, paragraph 96). What matters is that the retention period was set in advance and that the recording was not deleted after the request was received.
How to start
List who asked for your footage over the past year and what you answered. Send us your video surveillance rules and one typical request. We will tell you whether your procedure holds up in these three situations and what it is missing.
You can check whether your organisation needs a record of processing activities with the Privacio tool, built by Linden (in Lithuanian).
Email: info@linden.lt
More about this service: video surveillance documentation.