GDPR Update │CCTV Footage & Retention Periods │ Appeal Case 26/2017

Key Findings

• CCTV footage capturing individuals is 'processing' of 'personal data'.
• CCTV footage must not be kept for longer than is necessary
• As a general rule, 7-days is the maximum. Reasonable exceptions may be authorised.

On the 5th October 2018 the Maltese Court of Appeal (Inferior Competence) decided Appeal No 26/2017 in the names of Maltapost PLC Vs Kummissarju Ghall-Informazzjoni u l-Protezzjoni tadData. In so doing, the Court annulled a decision of the Information and Data Protection Appeals Tribunal and confirmed that the Information and Data Protection Commissioner ("IDPC") was right to establish that CCTV footage should, as a general rule, be deleted after 7 days. It also agreed that the IDPC was correct to establish, by way of exception, a 20-day retention period for a high-risk area in view of the special circumstances and the nature of work carried out in that area.