Dear All,
Thanks for the various response. Here is my follow up to refine the question.
I can see that scenario A and C would likely be dealt with under 12 (5) (a). However, Scenario 2 remains live and is not likely to be covered by 12 5 a.
Scenario 2.
Person B walks into council building on a Friday. They check their council tax accounts at the counter and talk with a benefits advice officer for 20 minutes in an interview
room. Their file is updated with several changes.
On Monday, they put in a SAR request for all their personal data with photo identification. As part of that SAR, the council would have to provide any CCTV footage it
holds of that transaction. That means the council, to comply with the SAR, will need to link its CCTV to its transactions and extract these when a request arrives.
In this scenario Joe Bloggs says “I want the personal information you hold on me.” To answer that question, the council will need to search its systems. In that search, it will be aware that
the applicant visited the council building and talked to a benefits advice officer. Here is the question.
Under the new DPA, it would appear that the organisation would, as part of the SAR response, need to provide the CCTV. Is this correct? (my view is yes, but I want to know what others think)
If the visit became confrontational and the benefits officer asked that the CCTV be retained as part of the potentially violent person process, then Mr Bloggs would receive that CCTV footage if
he put in his SAR asking for everything. Is this correct? (my view is yes)
What this suggests is that public organisations that have CCTV will need to provide a lot more CCTV footage as a routine part of their SAR response. Is this correct? (my view is yes as it is PII)
How many organisations currently provide CCTV footage as part of SARs? Or, is it mainly only when specifically requested? Do organisations routinely provide telephone recordings or only when asked?
Best,
Lawrence
Lawrence Serewicz
Information and Records Manager
Transformation and Partnerships
Durham County Council
County Hall
Room 143-148 4th Floor
Durham
County Durham
DH1 5UF
Direct 03000 268 038
Switchboard 03000 26 0000
www.durham.gov.uk
Follow us on Twitter @durhamcouncil
Like us at facebook.com/durhamcouncil
Follow us on linkedin.com/company/durham-county-council
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Phil Bradshaw
Sent: 19 March 2018 16:42
To: [log in to unmask]
Subject: Re: CCTV and SARs some scenarios about PII (I hope there are easy answers) (by implication this also applies to telephone recording)
If nothing else, if someone failed to provide location and time slot, I would seek to levy a time based reasonable search fee on the basis that requiring me to search every recording was manifestly excessive Art 12 (5)(a). In that area
GDPR improves on DPA98.
As a DPO I would also support controllers taking a similar approach with many "give me everything but I won't tell you what interactions we have had" requests.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to
[log in to unmask] All user commands can be found at
https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
Full help Desk - please email
[log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to
[log in to unmask]
(all commands go to
[log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html
Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]
Any queries about sending or receiving messages please send to the list owner [log in to unmask]
(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)