An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer enjoy Subject access rights to the footage?
The data would be recorded and held/controlled by the retail employee, making them a controller under the Data Protection Act 2018. In Article 4 of the GDPR a controller is defined as
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (but see section 6 of the 2018 Act);
Section 6 of the 2018 Act is irrelevant to this question. In this case, it seems clear that the employee determines, on their own, the purposes and means of processing personal data by recording a customer using their personal smartphone. They control the data.
In theory, the customer would enjoy subject access rights to view the recording under Article 15 of the GDPR because the recording constitutes personal data. In reality, it seems unlikely the employee would give them access.
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data [...]