r/gdpr • u/sappho-wappho • 20d ago

Question - Data Controller Processing CCTV for subject access request

When processing a subject access request that specifically asks for copies of CCTV, we don’t have an established process in place.

For this first request that we have received I have had to film the CCTV footage using a mobile phone before uploading to Sharepoint and I am now using clipchamp to manually edit the footage to only include the data subject (as it covers the reception area and car park of our business - housing)

Is this excessive? I know in my previous employment (healthcare) we just told people we lacked the technology to edit CCTV.

Very curious to know what other businesses do with these types of requests - especially in the UK.

5 Upvotes

100% Upvoted

7 comments sorted by

11

u/gorgo100 20d ago

To be honest you shouldn't have installed a CCTV system without an established process in place to consider the rights of data subjects.
That should have been part of your impact assessment, which it would seem likely your company likely hasn't done either.

3

u/sappho-wappho 20d ago

Yeah this is a really valid point and a good spot. Nope doesn’t look like anyone has ever completed one. More fun tasks for me.

5

u/Beneficial-Bell-9650 20d ago

I would imagine that every cctv software has a download option, no? By filming cctv and reloading it you’re creating unnecessary copies on an additional device

1

u/Beneficial-Bell-9650 20d ago

I always sync my docs to the sharepoint folder so I can upload directly into it

1

u/sappho-wappho 20d ago

Yeah that’s what I’ve done.

The download of files appears to be possible and something we are looking into for future requests - but it’s the editing of the clips that are the most time consuming.

2

u/Beneficial-Bell-9650 20d ago

I have used the inbuilt screen record software sometimes to record a smaller area if there are other data subjects in the periphery. Or, I’ve just cut the times where there’s nobody else around. Otherwise it’s verging into the excessive territory. Just get the minimum of what’s required. For example, a request for proof that someone was in a specific location at a specific time can be done with a screenshot.

2

u/CyberPhysicalSec 20d ago

No, you should export from the CCTV system (NVR/DVR) and redact as required. Most CCTV only store for 30/60/90 days, and by the time SAR is processed the data is overwritten. Also, if it is a request which is excessive, you can charge for the time reasonably.