An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer enjoy Subject access rights to the footage?
3
-
2are they doing this for their job or because they want to?– user253751Mar 18 at 22:38
-
Apparently it’s not so carefully considered to that level of depth. It’s on their own initiative though and apparently just to intimidate the customer so as to make them feel like they’re doing something wrong and on record as such by recording the employee.– Seeking answersMar 18 at 23:01
-
If the employee is clever, he or she would not do that without explicit orders from the management. In many jurisdictions, recording strangers who are neither part of a news event nor minor background details would require their permission.– o.m.Mar 19 at 10:22
Add a comment
|
1 Answer
The data would be recorded and held/controlled by the retail employee, making them a controller under the Data Protection Act 2018. In Article 4 of the GDPR a controller is defined as
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (but see section 6 of the 2018 Act);
Section 6 of the 2018 Act is irrelevant to this question. In this case, it seems clear that the employee determines, on their own, the purposes and means of processing personal data by recording a customer using their personal smartphone. They control the data.
In theory, the customer would enjoy subject access rights to view the recording under Article 15 of the GDPR because the recording constitutes personal data. In reality, it seems unlikely the employee would give them access.
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data [...]
-
Wait, but if the employee was to argue that they merely wanted to use the footage to look back at and giggle about when they finished work and to show their Flatmates, then wouldn’t the data be collected and stored solely for household purposes? Mar 25 at 15:02
-
No, that's specious and Recital 18 clarifies the household exemption only applies to data 'with no connection to a professional or commercial activity'. This happened during the course of their job, and I can't see a court letting an on-duty member of staff claim the household exemption for this activity as a matter of public policy anyway.– MatthewMar 27 at 15:26
-
Oh very useful to know. Cheers! And yet it’s interesting that this connection to professional capacity still does not render the explorer the true data controller. Mar 27 at 19:07