Commissioner (Cyprus) - 11.17.001.007.219

Commissioner - 11.17.001.007.219
Authority:	Commissioner (Cyprus)
Jurisdiction:	Cyprus
Relevant Law:	Article 4(1) GDPR Article 12(3) GDPR Article 15 GDPR Article 53(3) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:	08.07.2020
Published:
Fine:	None
Parties:	Pop Life Electric Shops Ltd
National Case Number/Name:	11.17.001.007.219
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Greek
Original Source:	Commissioner for Personal Data Protection (Cyprus) (in EL)
Initial Contributor:	Panayotis Yannakas

The Cypriot Data Protection Authority held that the footage from a CCTV system of an individual shall be handled as subject to Article 4(1) of the GDPR Regulation. The meaning of that conclusion is that the Data Controller is obligated to provide access to the affected individual.

English Summary

Facts

The Complainant had an accident outside a store, and an Action has been filed subsequently. Access to the video footage records has been requested from the Complainamt's lawyer, but merely as an out-of-court procedure and before any court order to produce relevant evidence to the trial.

Initially, the Company, just as the Data Controller, has rejected the above request on the grounds that if a trial is taking place, then Article 55(3) of the GDPR is triggered. The Company believed that this article suspends the obligation to provide access to personal data.

The Cypriot DPA intervened and informed the Company about this for his error in law. Article 55(3) suspends the power of supervisory authorities, not the obligations of legal subjects. The Company's reaction was the forwarding of a small extract of the footage from only one camera, when more cameras were available, too, at least according to the view of the Complainant. The Complainant was still feeling dissatisfied and again asked for the support of the Cypriot Commissioner.

Holding

One of the Data Controller's allegations was that his CCTV system maintains footage only for one month and only that particular extract has been separated and that, because it was also requested from their lawyer and their insurance partner, was immediately provided they had been notified of the action. The rest of the footage remained with the CCTV system until the automated clean-up.

The Cypriot Commissioner for Personal Data Protection asked for corroborating evidence about the allegation that the CCTV system saves the footage only for that duration. The confirmation came by letter from the Company who has installed the CCTV system in the store.

The Cypriot Commissioner for Personal Data Protection was convinced regarding those allegations and, held that, in these circumstances, the Complainant enjoyed her right of access, even if she received only an extract of the footage.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.