On Wed, 30 May 2001, Charles Oppenheim wrote:

> Tim seems to be missing the point.  It makes no difference how expensive it
> is, the data controller *has* to pass the record to the data subject.
> "Disproprortionate effort" only relates to a refusal to supply in
> "permanent" (understood  by all the commentators I've heard to be printed)
> form.  It is not an excuse for not supplying the data at all.

Is the only non-permanent form a showing in situ of the footage?  Anything
supplied to the subject via email/post would be permanent?  Which leads
back to the example of the data subject living on the remote island who
can't travel to the controller?

> >I don't quite see where the law states what should or should not be shown
> >to the data subject.
>
> See Clause 7(4) of the Act - it's clearly laid out there.   Incidentally,
> there is no need to "fuzz out" if the others in the footage cannot be
> readily identified.

But that states in 7(1)(i), "the personal data of which that individual is
the data subject".  7(4) doesn't say *what* information is to be disclosed.
If I draw a rectangle around the subject in the footage, and mask
everything else out, is the data subject not getting everything that
7(1)(i) states?  I ask because such a mechanism may be a lot easier to
do when disclosure is required.  It removes any element of doubt over
other data subjects (or other non-human sensitive info) in the footage,
although of course there still may be some occlusions with other objects,
human or otherwise.

Or is the argument that everything else in the footage is related personal
information?  If so, I'm still not convinced the law is clear?  One
wouldn't offer spurious log data in response to a query regarding personal
entries in computer activity log files, I assume?

> If everything bar the subject is fuzzed, then the
> >subject knows they were in the footage at time X; what else do they have a
> >legal right to know?
>
> The data subject also has the legal right to know where the data came from,
> and to whom it has been passed.

I meant in the context of the image of the subject within the footage.

> If organisations choose to create CCTV pictures, they have to take the
> consequences.  It would be an effective way of stopping over-bearing use of
> CCTV if everyone demanded to inspect the CCTV footage on them.

The country would grind to a halt if every worker submitted a DPA access
request daily; everyone would be fielding everyone else's requests...

While the spirit of the law is fine, it allows certain types of individual
to waste the time of others.   Mark Thomas is funny, but if he came to your
office daily to demand X, Y and Z the humour would wear thin ;-)

Tim

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    If you wish to leave this list please send the command
       leave data-protection to [log in to unmask]
            All user commands can be found at : -
    www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^