Irish Data Protection Commission Case Studies

This Office received a complaint from a solicitor acting on behalf of a data subject concerning the alleged further processing of the complainant’s personal data, as contained in CCTV footage captured in the complainant's place of work, a Spar store. It was indicated that, following an incident in the Spar store which resulted in the complainant falling, CCTV footage of the incident was accessed, copied to a mobile phone by another staff member in the company of a manager and circulated to third parties. It was contended that this action constituted a breach of Section 2(1)(c)(ii) of the Data Protection Acts as the purpose for the use of CCTV within the shop was for security purposes. The complainant provided us with a CD of the CCTV footage concerned which appeared to show a shop attendant tripping and falling behind a shop counter.

 

We commenced an investigation of the matter by writing to Spar outlining the details of the complaint. We received a response from Spar which stated, among other things, that: "This behaviour is regrettable and completely in contravention of the ethos of the business. The policy of this store has always been, and is still, that access to our CCTV equipment is only available to the management team and members of the Gardaí. In this instance, members of the management team, ……. were involved and this is unforgivable." We were also informed that the members of the management team involved were no longer employed by the Spar store concerned.

 

Having regard to the complaint and the response received, we informed Spar that we were of the opinion that Section 2 of the Data Protection Acts had been contravened by the processing and disclosure of the complainant’s images from the CCTV system in Spar and we requested proposals for an amicable resolution of the complaint.

 

Solicitors acting on behalf of Spar wrote to us stating that its client was concerned and apologetic that the matter had arisen. They informed us that the members of staff responsible for the release of the CCTV data were severely reprimanded as they were in serious breach of shop policy. They also informed us that their client was interested in amicably resolving this complaint by acknowledging the error and conveying apologies to the complainant in writing. However, the complainant’s solicitor sought a formal decision on this complaint.

 

The decision which issued on this complaint stated that the Data Protection Commissioner was satisfied that the complainant’s personal data was further processed by Spar in contravention of Section 2(1)(c)(ii) of the Data Protection Acts 1988 & 2003. This contravention occurred when the complainant's personal data (CCTV footage) was accessed, copied and circulated by staff of Spar for a purpose unrelated to those purposes for which the data was obtained.

 

The misuse of CCTV in this instance clearly contravened the Data Protection Acts. Modern technology provides an easy means for recorded footage to be accessed and transmitted to a wide audience in a very short time, often causing considerable distress to individuals whose images appear in the footage. Data controllers should be constantly vigilant to ensure that CCTV footage of individuals is processed only for its intended purpose, is restricted from access by staff who have no business need to access it, and that all managerial staff handle such footage with the level of care that is expected for the processing of personal data generally.