technically with GDPR you have up to 30 days to obtain images in which you appear but some systems wipe after 10 days, or less.
The CCTV's data controller has one calendar month in which to respond to a request for the footage, although the DPA 2018 states initially that it should be "without undue delay". But it is probably a Good Thing to request CCTV images as soon as possible.
For example:
Lothian Buses: "The systems in use on board buses work on a looped recording basis capable of storing 1 week or more of data, depending on the equipment in the bus, thus images or events recorded will not be available after the files have been overwritten, unless the images have been recovered by the CCTV Manager prior to being overwritten."
Edinburgh Trams: "Our trams and premises are fitted with CCTV. Our Ticketing Services Assistants are equipped with personal CCTV. This is done to ensure that evidence of any act of violence and aggression or other inappropriate behaviour or of theft or criminal damage can be passed to the Police and the prosecuting authorities. We will always use all means to secure prosecution of anyone who commits a violent or criminal act on our trams or in our premises."
and
"We will only retain your information for the minimal period we deemed duly required, thereafter we will ensure any data is securely deleted from our system. Hard copy evidence received which securely destroyed using a reputable specialist company." (though this is in the context of non-CCTV personal information)
Scotrail (e.g. for Haymarket): "CCTV footage – this is generally held for a maximum of 31 days from the time of recording, with the following exceptions: (i) if it relates to an accident, we will retain media for 3 years; (ii) if it relates to an operational incident, we will retain media for 5 years. Recordings obtained from body worn cameras are generally held for 24 hours, unless footage from a recording is required to be retained for any of the purposes set out in this privacy statement (such as, for example, the prevention and detection of crime or health and safety purposes) in which case it shall be held for so long as needed for these purposes."
Questions:
If a data controller has a privacy policy that says it retains CCTV images for 10 days, and within that time period the images are requested by a competent authority (e.g. Police Scotland), is it a data breach if the data controller does not preserve them?
If a data controller has a privacy policy that says it retains CCTV images for 10 days, and within that time period the images are requested by the data subject, is it a data breach if the data controller does not preserve them?
posts
