1

Looking at Accessing public CCTV footage about you I could see a scenario where a stalker might request GDPR data & footage on a person they are stalking who has passed the camera.
So, imagine actress A regularly walks past Millionaire M's house which is plastered with CCTV directed at both the house and the surrounding streets. Stalker S (pretending to be A) makes a GDPR request to M for all footage of A, giving an approximate time & date of one sighting of A.

What are the legal penalties to S for making this request or in successfully getting the footage? Is this just standard fraud or are there specific GPDR penalties involved and has anyone ever been prosecuted?

Improve this question

2 Answers 2

Reset to default
3

There are no direct penalties per GDPR.

The data controller must make sure that the person making the request is the data subject, or at least authorized by the data subject. If the controller has reasonable doubts about the identity, they should request additional information for identification purposes. The controller must find a middle ground between violating the GDPR by rejecting a potentially valid request and violating the GDPR by disclosing data to potentially unauthorized recipients. Having reasonable technical and organization measures that prevent unauthorized disclosure is part of the controller's responsibilities per Art 24.

What the data controller can do is to block future requests from the alleged stalker. When a request is “manifestly unfounded or excessive, in particular because of their repetitive character”, then the controller can charge a reasonable fee or refuse to act on the request (Art 12(5) GDPR). But it's up to the controller to prove that the requests are unfounded or excessive, it is not possible to reject potentially valid requests on sight.

Depending on what the alleged stalker does with the obtained data, they would fall within the scope of the GDPR themselves and would probably be violating it because there is no sufficient legal basis. Also, the alleged stalker, as a data controller, would be required to inform the data subject about subsequent processing of the data per Art 14 GDPR.

Attempting to obtain another person's personal data through an access request would have to be punishable by other laws. For starters, such attempts would likely involve identity theft, and successfully obtaining the data would probably be a kind of fraud.

Improve this answer
2
  • 1
    +1 Detailed GDPR answer as always, but for clarity there's no actual offence of "identity theft" in the UK - it's fraud by false representation (by statute in E&W and NI, and common law in Scotland)
    – Rick
    Mar 14, 2022 at 21:14
  • There's a certain dark humour in the idea of a stalker being required to send a GDPR notice to the person they're stalking.
    – Michael Seifert
    Mar 15, 2022 at 12:40
0

The stalker becomes a data controller/processor. Among others, the collection, consultation, and storage of personal data is sanctioned by Article 83 (5) (a) of GDPR. Local administrative authority could take actions. Domestic laws might also provide for criminal penalties depending on the country. Coordination of Administrative Laws and Criminal laws under EU Human Rights (ECHR/CEDH) is a complex matter which is country-specific. This will explain why an authority or court will be involved rather than another. The perpetrator could also be required to compensate the victim for the tort/prejudice under civil laws.

Impersonating someone to obtain something undue could qualify as one or multiple "fraud(s)", tort(s), or prejudice(s) per se depending on the country. The legal qualification(s) will depend on the country of occurence. It could be therefore sanctioned by civil laws (to compensate the victim) and criminal laws (jail/fines).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .