CCTV, Discovery and Access Requests

In a decision of the High Court in November 2020 (Dudgeon v Supermacs Ireland Ltd., [2020] IEHC 600), Mr Justice Barr ruled that a restaurant was not obliged to disclose CCTV recordings of an incident to a person identifiable on the recording and who claimed damages for injuries resulting from that incident. The decision has prompted discussion of how it may affect access requests under Article 15 of the GDPR and Section 91 of the Data Protection Act 2018, specifically where the request encompasses CCTV recordings. It is important to bear in mind that Mr Justice Barr’s decision relates specifically to discovery in litigation in Ireland and in relation to the specific circumstances surrounding this case. The DPC considers it important to highlight distinctions between access requests and discovery in civil (that is, non-criminal) litigation.

The purpose of discovery is to give parties to a case access to documents and materials that are necessary for the fair disposal of the issues being brought before the court. Discovery has some similarities to access requests, if only because it can require a person who controls documents or information that match particular criteria to disclose their existence and give another person access to them.

The right to access one’s own personal data is founded on Article 8(2) of the Charter of Fundamental Rights of the European Union, “Everyone has the right of access to data which has been collected concerning him or her”. This right is also set down in Article 15 GDPR.  It applies in a wide variety of circumstances affecting the lives of EU citizens and residents, and not necessarily where a court case is contemplated or in being.

This highlights an important difference between discovery and access requests. As mentioned above, discovery is an issue only in civil litigation and the law concerning it is closely related to the rules and processes that govern how courts handle cases. In contrast, an individual’s right under data protection laws such as the GDPR to request access to their personal data does not depend on whether they are engaged in a court case.

In summary, Mr Justice Barr’s decision in this case is focussed on the law concerning discovery and is not in reference to or related to data protection rights. The right to request access to personal data applies whether an individual is involved in litigation or not.  For that reason, unless a restriction under the GDPR or relevant data protection legislation can be relied upon, a data controller is still required to fulfil access requests in relation to CCTV footage.

The DPC will continue to support data subjects and controllers in giving effect to all aspects of data protection law in this respect.