For those of you that watch my youtube channel, you may have seen a video I posted where I included the CCTV footage from the bus of an incident I had with them.
This wasn’t the first time that I had tried to get CCTV from a bus company, nor the first from this company. The other times there were issues with the companies processes and the timescale for which they keep CCTV footage. However, this time was successful. Several people have asked how I did this, and if I can offer some kind of template. This post will be for that.
I built my template mostly off of the information on the ICO website about right of access.
First you will need to find out where you need to send this to, e-mail is probably best. Go to the companies website, in this case Arriva. You’ll want to find the privacy section of the website, most likely there will be a link in the footer. You will need to read or search through this page for information about who to contact with regards to data. This may come under terms such as; subject access request, sar, data protection, gdpr, personal information, access. In this case it is under a section about data protection and an e-mail is provided.
Subject: Subject access request – CCTVGaz
Dear Sir or Madam
Subject access request
Please supply the data about me that I am entitled to under data protection law relating to external CCTV footage of [Bus route] on [date] at around [time] traveling north on Vauxhall Bridge A202 at the junction with Millbank. The numberplate was LC67AHO, other markers on the bus were N119 and HV387
I was the cyclist to the right of the bus going through the junction with Millbank, I request all external CCTV from the bus that includes me in it. Attached is a screenshot of my video to prove it was me at that location and that I am entitled to this data.
If you need any more data from me, please le me know as soon as possible. It may be helpful for you to know that data protection law requires you to respond to a request for data within one calendar month.
If you do not normally deal with these requests, please pass this on to your Data Protection Officer, or relevant staff member. If you need advice on dealing with this request, the Information Commissioner’s Office can assist you.
They actually came back the next day in the morning. Which based on my previous experiences was very quick.
Re: SAR [reference]Arriva
I am in receipt of the below, exercising the right of access to personal data under Article 15 of the General Data Protection Regulation (GDPR).
So that we may accurately identify you and locate the information you require, please provide the following:
Description of clothing worn on the date in question
A recent photograph
In order for us to progress the request, please also forward a proof of identity document. This could include a copy of your birth certificate, driving licence, passport or utility bill. Please send these documents to the postal or email address listed below, ensuring that the reference number is included within the correspondence.
Until we have received this information, please be advised that your request will be put on hold.
Should you have any questions in the meantime, or feel that there is additional information that may support your request, please contact me quoting the above reference number.
I had a bit of to and fro with them on why they needed some of this information. I provided pictures of my bike, the clothes I was wearing at that time and my helmet so they could match it up. But they wanted something with my address on it, and some information that is quite personal. I ended up giving them a restricted copy of my utility bill and mentioned that I would make a request in the future for my data to be deleted.
They didn’t explain why they wanted this at first, but it made sense in the end. As the process of making sure the CCTV is only visible to people who have the right to see it means that they sent me a DVD in the post to my home address with the footage burned on it, that was password protected. The password was sent to me via e-mail.
As Arriva said, under article 15 of the General Data Protection Regulation, data subjects have the right to know what data is held on them. They must reply to such requests within 30 days, however with CCTV processes from buses usually delete data after 14 days. It is key that you make your request as soon as possible and chase up any requests after a week if you haven’t heard back.
For UK (not including Scotland) citizens, you can use the Information Commissioners Office website as a good reference guide on your rights and how to request data.
If the company is storing and processing data on you, they must give it to you when you request it. This includes CCTV from onboard cameras or dash cams if the data is kept for any period of time. If a company tries to deny your subject access request you can ask them about how they process the data you are requesting. If they fail to comply at all, then you can let them know you will contact the ICO about them failing to comply to a subject access request, then penalties are listed online.
My knowledge of GDPR is only based around what I have read and experienced, I’m sure there are many different scenarios I haven’t covered. I will assist where I can.