The DPC received a complaint from an individual who had made an access request to a transport company. They sought a copy of CCTV footage of an accident they were involved in with one of the transports company’s buses. The individual did not receive a response to this request.

The DPC contacted the Data Protection Officer (DPO) for the transport company and informed them of the complaint.

The DPC reminded the transport company of their GDPR obligations, drawing their attention to Article 12(3) of the GDPR, which states that organisations have an obligation to provide a response to an individual’s subject access request within the statutory timeframe. As part of the engagement, the DPC stipulated a timeline for the transport company to respond to the individual and provide them with a copy of the CCTV footage. The transport company complied with the DPC’s direction and the individual confirmed they received the requested personal data.