Dear All,

Thanks for the various response. Here is my follow up to refine the question.

I can see that scenario A and C would likely be dealt with under 12 (5) (a). However, Scenario 2 remains live and is not likely to be covered by 12 5 a.

Scenario 2.

Person B walks into council building on a Friday. They check their council tax accounts at the counter and talk with a benefits advice officer for 20 minutes in an interview room. Their file is updated with several changes.

On Monday, they put in a SAR request for all their personal data with photo identification. As part of that SAR, the council would have to provide any CCTV footage it holds of that transaction. That means the council, to comply with the SAR, will need to link its CCTV to its transactions and extract these when a request arrives.

In this scenario Joe Bloggs says “I want the personal information you hold on me.” To answer that question, the council will need to search its systems. In that search, it will be aware that the applicant visited the council building and talked to a benefits advice officer. Here is the question.

Under the new DPA, it would appear that the organisation would, as part of the SAR response, need to provide the CCTV. Is this correct? (my view is yes, but I want to know what others think)

If the visit became confrontational and the benefits officer asked that the CCTV be retained as part of the potentially violent person process, then Mr Bloggs would receive that CCTV footage if he put in his SAR asking for everything. Is this correct? (my view is yes)

What this suggests is that public organisations that have CCTV will need to provide a lot more CCTV footage as a routine part of their SAR response. Is this correct? (my view is yes as it is PII)

How many organisations currently provide CCTV footage as part of SARs? Or, is it mainly only when specifically requested? Do organisations routinely provide telephone recordings or only when asked?

Best,

Lawrence

Lawrence Serewicz

Information and Records Manager

Transformation and Partnerships

Durham County Council

County Hall

Room 143-148 4th Floor

Durham

County Durham

DH1 5UF

Direct 03000 268 038

Switchboard 03000 26 0000

www.durham.gov.uk

Like us at facebook.com/durhamcouncil

-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Phil Bradshaw
Sent: 19 March 2018 16:42
To: [log in to unmask]
Subject: Re: CCTV and SARs some scenarios about PII (I hope there are easy answers) (by implication this also applies to telephone recording)

If nothing else, if someone failed to provide location and time slot, I would seek to levy a time based reasonable search fee on the basis that requiring me to search every recording was manifestly excessive Art 12 (5)(a). In that area GDPR improves on DPA98.

As a DPO I would also support controllers taking a similar approach with many "give me everything but I won't tell you what interactions we have had" requests.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

All archives of messages are stored permanently and are

available to the world wide web community at large at

http://www.jiscmail.ac.uk/lists/data-protection.html

If you wish to leave this list please send the command

leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html