Data protection laws allow individuals to know the contents of CCTV footage in which they feature and to view the footage, but not necessarily to receive a copy, according to NAIH, Hungary’s Authority for Data Protection and Freedom of Information.
Businesses should now update their data privacy policies and CCTV practices as necessary to ensure that they comply with NAIH’s opinion.
NAIH was asked to decide whether a data subject was entitled to access CCTV recordings in which they appeared (as personal data under Article 12 of the Data Protection Directive 95/46/EC) or only to information about the data processing. The case concerned an individual claiming damages for personal injury in a shop seeking the release of CCTV footage of the accident. The shop, via its lawyers, declined to release the CCTV recording but informed the claimant that nothing in the footage indicated any liability attaching to the shop.
NAIH confirmed that:
- a data controller must respond as soon as possible and (at the latest) within 30 days of any subject access request being made, in a clearly understandable format and (if requested) in writing
- it must also provide the affected person with clear information about all available personal data relating to them, including any personal data processed through CCTV monitoring and recording
- the most complete way of complying with subject access requests for personal data in CCTV footage is to allow the person to view the recording
- the data controller must also provide on request a written description – in clear, everyday language – of exactly what is recorded on the CCTV recordings and what can be seen relating to the affected person
- this includes the time of the recordings, the times between which the affected person can be seen on the recording, the actions of the affected person visible on the recording, and whether anything occurs in connection with or affecting the affected people following their disappearance from view
- the affected person has no right to request or receive a copy of the CCTV recording, which would breach the privacy rights of any other people appearing in the recording
- the controller may, at its own discretion, provide the affected person with a copy of the CCTV recording as long as it blurs out the actions and images of all other individuals.
Act CXII of 2011 on the Right of Self-Determination in Respect of Information and the Freedom of Information (“Data Protection Act”)
Act CXXXIII of 2005 on Security Services and the Activities of Private Investigators (“Security Services Act”)
Case: NAIH/2015/1563/2/Vhttp://www.naih.hu/files/adatved_allasfoglalas_naih_2015_1563_v_anonim_cctv_betekintes.pdf (only in Hungarian)