We are all Data Subjects in one way or another. Any digital record held within the EU which is about you, makes you a Data Subject. Whether its a health record, voting record, the booking system of a hotel, or CCTV footage/recordings of you, you are still the Data Subject.
When details about you are stored digitally, you (as the Data Subject) have certain legal rights. These rights include the right of access to the data, the right to request copies of the data and the right to request it is deleted (the ‘right to be forgotten’).
CCTV Access Requests Under GDPR
CCTV recordings containing images of individuals who could be identified in that footage are considered to be recordings of personal data. Therefore, the vast majority of CCTV recordings made in a commercial/business/workplace/public space do come under GDPR and Data Protection Act 2018 regulations.
In the context of CCTV, a Data Subject is an individual who has been recorded on CCTV. The individual has the right to request a copy of any CCTV footage containing images of them by making a Subject Access Request. They can also ask for the footage to be deleted.
The CCTV footage should be disclosed to the individual within 1 month of the Subject Access Request being made.
The Data Subject only has the right to see CCTV images of his or herself. If the CCTV recordings being disclosed show anyone else who could be identified then those 3rd parties must have their identity protected. The is known as redaction and is usually achieved by blurring or pixelating areas of the image to obscure the identities of these 3rd parties.
Contact us about our CCTV redaction service for GDPR & DPA compliant disclosures.