Someone asks for CCTV footage showing them – must we provide it, and how?

Camera footage is often kept for a few days or weeks and then overwritten automatically. If you wait until every detail is clear, the footage may be gone.

The EDPB guidelines on the right of access (01/2022, paragraph 38) say that where retention periods are short, the steps you take to answer a request must be adapted to them, so the person does not permanently lose the chance to get the data. In practice: when you receive a request, copy the requested period to a separate secure place until you reply.

If the footage has already been deleted under your retention period, you cannot provide it and are not obliged to. Tell the person it was deleted and state the retention period.

With a lot of footage, you may be unable to find the person without more information (EDPB Guidelines 3/2019, paragraph 95). The EDPB video guidelines (3/2019, paragraph 96) say the person should state when they were in the monitored area – within a reasonable window, depending on how many people are recorded there. In the guidelines' example of a busy shopping centre, that is a window of about one hour.

Ask for:

• the date and approximate time;
• the place or camera (entrance, hall, yard);
• a description to recognise the person in the footage: clothing, what they were doing.

If you can demonstrate that you cannot tell which person in the footage is the requester, Article 11(2) GDPR requires you to inform them of that, if possible. The EDPB then recommends telling the person the monitored area and which cameras were in use, so they understand what data about them may have been processed.

Footage is sensitive: handing it to the wrong person is a data breach. Article 12(6) GDPR lets you ask for additional information when you have reasonable doubts about identity.

Suitable ways:

• the person comes in and shows an identity document;
• the request is signed with an electronic signature;
• you compare the footage with the person who came in.

Do not ask for more than needed. You usually do not need to keep a copy of the identity document on file – a note that identity was checked is enough.

Article 15(4) GDPR: the right to a copy must not adversely affect the rights and freedoms of others. But the EDPB guidelines (3/2019, paragraph 94) say clearly that this is not an excuse to refuse. You need a technical measure:

• blur other identifiable faces and number plates;
• or cut out segments showing only other people;
• or give them screenshots of segments in which only they appear.

If the person asks to view the footage at your premises, you may allow it, but other people must still be protected – unblurred footage on a screen discloses them just as a copy does (EDPB Guidelines 01/2022).

Blurring can be done with video-editing software. If a supplier maintains your camera system, ask whether it does this and how fast.

• Deadline: without undue delay, and at the latest within one month of receiving the request (Article 12(3) GDPR). For complex requests it can be extended by two more months, but you must tell the person about the extension and the reasons within the first month.
• Cost: the first copy is free (Article 12(5), Article 15(3) GDPR). For further copies you may charge a reasonable fee based on administrative costs.
• Format: if the request came electronically, the copy is given in a commonly used electronic form, unless the person asks otherwise (Article 15(3)). Safest is a secure, password-protected download link, not an email attachment.
• Include all the information in Article 15(1), including: purpose, categories of data, who receives recordings, retention period, the right to ask for rectification, erasure, restriction or to object, and the right to complain.

• The footage no longer exists – deleted under your retention period. Tell the person.
• The request is manifestly unfounded or excessive, for example the same request repeated every week. Article 12(5) GDPR allows you to refuse or charge a fee, but the burden of proof is yours.
• You cannot identify the person in the footage even with the information they gave – and can demonstrate it (Article 11(2), Article 12(2)).

If you refuse, within one month tell the person why, that they may complain to the State Data Protection Inspectorate, and that they may seek a judicial remedy (Article 12(4) GDPR).

The police, an insurer or a neighbour are third parties, not data subjects. Other rules apply to their requests: you need a legal basis to hand over footage. This is covered in the dat.lt article on who may view recordings (link below).

Prepare a short procedure in advance: who takes requests, who saves the segment, who blurs, who replies. If you do not have video surveillance documents yet, they can be ordered as a one-off procedure – €195 excl. VAT. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities.

Can we just show the footage and not give a copy?
The person has the right to a copy (Article 15(3)). Viewing at your premises fits if the person asks for it, and even then other people must be protected.

Can we charge for blurring?
Not for the first copy. A fee is possible only for further copies or for manifestly unfounded or excessive requests.

What if the footage will be deleted tomorrow and the reply needs time?
Save the segment at once – that is good practice. Once a request arrives, data must not be erased to avoid answering it (EDPB Guidelines 01/2022, paragraph 39). Use the saved copy only for this request; it is no reason to extend your general retention period (paragraph 38).

Do we have to blur employees?
Usually yes, if they are identifiable and a copy would adversely affect their rights. Employees are "others" under Article 15(4) too; you must be able to justify that effect.

• May we film our premises and grounds? (in Lithuanian)
• We received a request for access to data – what to reply and by when? (in Lithuanian)
• How to set a retention period when the law does not? (in Lithuanian)

The law and the risk: Cameras in apartment buildings and yards: who may view the recordings and who may not – dat.lt

• Right of access and to a copy – Article 15(1) and 15(3) GDPR; protecting others – Article 15(4).
• Deadline and extension – Article 12(3) GDPR; reasons for not acting – Article 12(4); free of charge and manifestly unfounded requests – Article 12(5); confirming identity – Article 12(6).
• When the person cannot be identified – Article 11(2) GDPR; Article 12(2).
• Storage limitation – Article 5(1)(e) GDPR.
• Time window, blurring, short retention periods – EDPB Guidelines 3/2019 on processing of personal data through video devices, version 2.1, paragraphs 94–96; EDPB Guidelines 01/2022 on the right of access, version 2.1, paragraphs 37–39.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). EDPB guidelines read from the official PDFs. This text is general information and is not individual legal advice.