Businesses with networks of CCTV cameras installed have a number of obligations under the General Data Protection Regulation (GDPR). They must provide a reason for the cameras, alert the public to their presence, provide footage upon request and comply with Gardaí when they request footage, to name just a few.

• Justify You must have a valid reason to have CCTV cameras.
• Inform Signs must be posted indicating the presence of CCTV.
• Retain CCTV footage must only be retained with a valid reason.
• Permit Individuals may request CCTV footage that they appear in.
• Redact Personal data not relevant to a subject access request must be blurred.
• Assist Providing CCTV footage to Gardaí should be followed by a written request.
• Ensure Valid data processing agreements and contracts must be in place.

The GDPR states “Any person whose image is recorded on a CCTV system has a right to seek and be supplied with a copy of their own personal data from the footage”.

 

If a person is captured on your CCTV cameras, that footage is considered personal data and can be requested as long as a suitable procedure is followed. As indicated below, since appearance in CCTV footage is considered personal data, it must be treated and protected as such.

Personal data cannot be shared or published without explicit, unambiguous, opt-in consent under the GDPR. That means to satisfy a subject access request for an individual, the personal data of other subjects who appear in the footage must be redacted or removed.

 

Practically speaking, CCTV redaction means blurring out the faces and other identifying characteristics of all individuals who appear in a piece of footage that are not part of the subject access request. Under the GDPR, CCTV redaction is a legal requirement.