Discover how your organisation can deal with changes to data transparency regulation, and protect yourself from liability
On May 25th 2018, GDPR was enacted across all businesses in the EU, granting to the public additional rights to access personal data held on them.
Organisations operating within the EU which capture video of the public are legally required to handle Subject Access Requests and Right of Erasure requests from the public, who have the right to obtain this information free of charge from any entity that holds it.
Yes. We contacted the Information Commissioner's Office (ICO – the organisation within the UK and Europe guiding and enforcing GDPR) in June 2019. The ICO confirmed that video of a person is considered personal data. It is therefore included in the information they can ask for from any organisation they think may hold footage of them.
It is your responsibility to ensure members of the public have a clear way to contact you to make requests for and potentially have removed or redacted any video in which they feature. Failure to do se could see your organisation in breach of Article 13, opening up the possibility for large fines.
Once a request is made, you are accountable for processing the request and communicating the actions taken to the requestor within one month of receipt. All the work to find and supply data must be completed free of charge to the requestor.
If results are found and the member of the public requires a copy, this must be provided in a format the public can readily use.
Are you informing members of the public that they can request and have deleted any video you hold on them?
Can your organisation search for people captured in your videos and deliver it to them within a month, free of charge, and in an easy to digest format?