Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store.

Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head office.

He requests any CCTV footage from the day in which he may appear.

The corporate offices designated data protection officer receives his request and carefully reviews all of the day's footage to put together his formal response to Bob's request and soon realises why he is requesting the footage. Not wishing to cause a pr disaster for his employer, he decides to omit or accidentally not accidentally damage some of the most damning footage of the incidents.

What legal consequences in practice might the DPO realistically face, apart from the pleasure of his employer and future job security?

What recourse does Bob have if the DPO claims that all the footage provided is all the he appears in, even if it doesn't include the incidents motivating Bob's request, or to regretfully report to Bob that there was a technological failure and the footage from that day is irreparably destroyed?

E&W specified all welcome.

  • 3
    It may be worth mentioning that a GDPR DPO is more of an advisor/liaison position. If the DPO were to conduct relevant data processing operations themselves, that could call into question their independence. However, I don't think that the employee being designated DPO is actually relevant to the question.
    – amon
    Commented Oct 12, 2022 at 21:37
  • 1
    Focusing on the DPO might not be the right angle, the data controller has obligations towards you as a data subject regardless. The question for you is whether failing to provide the footage is somehow actionable. Whether this came to pass because the DPO omitted it or another employee destroyed it even before you sent a request is a secondary concern and not really something that's detailed in the GDPR (other legislation might be engaged but not the GDPR per se).
    – Relaxed
    Commented Oct 13, 2022 at 9:42
  • @Relaxed yes well it does seem immaterial then. But what are the obligations of the Sara controller towers the subject? Commented Oct 13, 2022 at 9:47
  • 5
    Why is Bob trying to obtain this footage? Assault is a criminal offense, wouldn't the police be doing this investigation and demanding the footage?
    – Barmar
    Commented Oct 13, 2022 at 14:37
  • Perhaps he would like separately to pursue a formal complaint to the corporate HQ and or a civil claim? Commented Oct 13, 2022 at 15:44

3 Answers 3


Is it a criminal offence to destroy and conceal information [that would otherwise have to be produced in response to a SAR]?

It is a criminal offence to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information a person making a SAR would have been entitled to receive."

You can defend this offence if you prove that:

  • the alteration, defacing, blocking, erasure, destruction or concealment of the information would have happened regardless of whether the individual made a SAR; or
  • you acted in the reasonable belief that the person making the SAR was not entitled to receive the information requested.


Alteration etc of personal data to prevent disclosure to data subject https://www.legislation.gov.uk/ukpga/2018/12/section/173/enacted

Can a court order be used to enforce a SAR?

If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply. It is a matter for the court to decide, in each particular case, whether to make such an order.

Failure to comply with the order could be contempt of court.

  • Okay, but how in practice could there be any scrutiny or accountability if one claims that a subject simply doesn't occur in any other footage, or that the camera in question had malfunctioned or ran out of battery that day? Who would ever know if they weren't telling the truth? Commented Oct 13, 2022 at 12:58
  • @JosephCorrectEnglishPronouns Were there no other witnesses (staff, customers) to this "brutal assault"? Was there no physical injury to Bob's body? Were there no witnesses (family, friends, paramedics, nurses, doctors, police) of the existence of these injuries? Did Bob not promptly go to the police? Is there nothing whatsoever other than "CCTV footage" that could persuade any authority (police, CPS, ICO, court) this "brutal assault" occurred?
    – Lag
    Commented Oct 13, 2022 at 15:11
  • There were luckily no injuries but Bob promptly called 999 and waited an hour for the level 2 priority to be assigned until the store closed and staff went home. There was one witness who also waited close to an hour but his phone was dead and Bob's was destroyed so they didn't Exchange contact info. Commented Oct 13, 2022 at 15:47
  • But is CCTV alone not pretty conclusive? Commented Oct 13, 2022 at 15:48
  • 4
    @JosephCorrectEnglishPronouns A "brutal assault" resulting in no injuries - incredible. My understanding of your comment is that CCTV is not available, in which case you ask "how could there be any accountability?" Well, if there were other evidence there could be accountability. Surely this is a simple matter of logic. Bob must persuade the authorities this occurred. The better his evidence the more persuasive his complaint. If he has no evidence whatsoever then it comes down to his word against the alleged offenders.
    – Lag
    Commented Oct 13, 2022 at 16:03

Spoliation of evidence, once a suit is filed

The reason Bob requests the video from Alice Corp is not that he is concerned about his GDPR rights, it is because he wants to file a lawsuit. In fact, it would be super helpful if Bob had filed the lawsuit and served it together with the GDPR request, so there is a pending case... and added a paragraph that he demands the preservation of all evidence at that point.

In either case, the sudden deletion of the files by their DPO Charly, after Alice Corp was put on legal notice that they have to preserve evidence, is spoliation, indeed, it would be the very definition:

The intentional destruction or alteration of relevant evidence in existing or pending litigation. 1

The main remedy for spoliation is the imposition of a rebuttable presumption of fact that the lost or destroyed evidence would have been unfavourable to the party that destroyed it. This presumption can be rebutted by evidence showing that the “spoliator” did not intend to affect the litigation by destroying the evidence (McDougall v. Black & Decker Canada Inc., 2008 CarswellAlta 1686 (Alta. C.A.)).

So, we have the DPO performing spoliation, and thus the lawsuit for the beating will assume that the destroyed video showed exactly what Bob alleged that Alice Corp's security team did to him.

in DPO Charly can be further sued for destroying evidence under Section 2 (16) Criminal Justice Act 1987.

Spoliation might even happen before the case begins with filing & summons

According to an article by Chris Dale, discussion spoliation in the case of Earles v Barclays Bank Plc [2009] EWHC 2500 (Mercantile) (08 October 2009) was named as one of the best descriptions of spoliation in English law. That case indeed is illustrative, as it might be explicitly applicable to the case as described (emphasis mine):

28 [I]n this jurisdiction [Bermingham/England] as in Australia, there is no duty to preserve documents prior to the commencement of proceedings: British American Tobacco Australia Services Limited v. Cowell [2002] V.S.C.A. 197, a decision approved in this country by Morritt V.C. in Douglas v. Hello [2003] EWHC 55 at [86]. However, the leading text book in this area – Documentary Evidence by Charles Hollander QC- suggests in paragraph 10-06 of the 10th edition that "there might be cases where it was appropriate to draw adverse inferences from a party's conduct before the commencement of proceedings." In my judgment there would have to be some clear evidence of deliberate spoliation in anticipation of litigation before one could legitimately draw evidential "adverse inferences" in those circumstances. There is no such evidential basis in this case.

29 After the commencement of proceedings the situation is radically different. In Woods v. Martins Bank Ltd [1959] 1 Q.B. 55 at 60, Salmon J. said "It cannot be too clearly understood that solicitors owe a duty to the court, as officers of the court to make sure, as far as possible, that no relevant documents have been omitted from their client's list".

30 In the case of documents not preserved after the commencement of proceedings then the defaulting party risk "adverse inferences" being drawn for such "spoliation": Infabricks Ltd v. Jaytex Ltd [1985] FSR 75.

So, yes, we got it in a judgment from the High Court of Justice, Queens Bench Division, Birmingham District Registry, Mercantile Court: if it is extremely likely, that proceedings will begin shortly, destroying the video might be spoliation in anticipation of litigation, and thus be problematic even before proceedings started. As a remedy, an adverse inference might be drawn to the content of it.


  • What if Bob would simply like to see if the footage is as damning as he imagines and remembered before going through with the expenses of filing a lawsuit? This is why my question was framed only in terms of the gdpr rights. Commented Oct 12, 2022 at 21:05
  • For this reason while your answer is very informative and helpful I don't think it effectively answers the question. Commented Oct 12, 2022 at 21:05
  • Also what is meant by Alta CA? Commented Oct 12, 2022 at 21:06
  • @JosephP. Alta CA is part of the citation as Thomson Reuters lists it. With the court issuing it in Alberta... Alberta Court of Appeals ; A case is pending the moment a summons is issued.
    – Trish
    Commented Oct 12, 2022 at 21:20
  • @JosephP. I am not in the know when exactly spoliation begins with anticipated lawsuits, which is why I answered the way I did. The fact patterns (heavily beaten Bob) would be sufficient on its own to sue Alice Corp, even without the video, so personally I would choose the start litigation first.
    – Trish
    Commented Oct 12, 2022 at 21:29

In the scenario you describe, the DPO commits an offence contrary to the Data Protection Act 2018 s.173:

(3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.

(4) Those persons are—

(a) the controller, and

(b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.

The penalty for this offence (and by extension incentive not to commit it) is limited in s.196 to a fine as it is for all offences under UK GDPR.

More generally, UK GDPR creates liability for compensation from parties who breach its requirements to anyone who enjoys a benefit from those requirements so at least academically there are other possible forms of recourse available.

Also relevant to the scenario you describe is that the controller (the DPO's employer) has duties under s.70 not to interfere with his duties. Of course the DPO may still find an incentive to contravene GDPR for the benefit of his employer without any direct encouragement to do so, but the employer must take some care not to add further incentive on their part or they may attract further liability for breaching their own duties.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .