Can a data controller refuse to provide CCTV footage where a crime or misdemeanor is recorded?

ANSWER

As a rule, an injured party has a factual interest in obtaining access to CCTV footage relating to the incident — e.g. damage to a vehicle. However, the question of to whom the data controller discloses CCTV footage remains as a rule within the controller's discretion. It is accepted that on request from law enforcement authorities (e.g. the police) the data controller is obliged to provide the recording, or must provide it to a person who requests it under Article 15(3) GDPR, if the recording shows the data subject. Where the recording shows a situation in which a person wishes to identify the perpetrator of a crime or misdemeanor, a third party's image will be visible; the decision on disclosure will therefore depend on the data controller.

In such a situation there are two options: first, submit a request to the data controller for disclosure of the CCTV footage indicating the factual interest in the matter. If the controller refuses again, the matter should be reported to the police — on request from law enforcement the controller will be obliged to provide the recording, and the injured party will be entitled to review it.