This decision emphasizes that a controller cannot delete personal data for which an access request has been made, even if the initially planned retention period has expired, as such deletion hinders the exercise of the data subject's rights and their right to an effective remedy.

Facts and context

The Danish Data Protection Authority (Datatilsynet) issued a decision severely criticizing Metro Service A/S for breaches related to the right of access and data retention following an access request.

The case originated from a complaint by an individual who was denied access to video surveillance recordings concerning them after an incident at a metro station.

Reasons for the decision

The authority found several breaches by the company:

• Obligation to guarantee the right of access (Article 15 of the GDPR): Metro Service refused access citing three grounds deemed unacceptable. First, the authority considered that the information provided (exact location, 10-day time slot, description of the incident and the person's appearance) was sufficient to allow identification, even if complex. Second, the argument of excessive workload was rejected, with the authority recalling that choosing a surveillance technology entails the obligation to have the technical means to search the data and respond to data subjects' rights. Finally, the public security exception was not upheld as it was not supported by a concrete and documented risk analysis, as required by the Danish Data Protection Act (§ 22, paragraph 1).
• Obligation to facilitate the exercise of rights (Article 12 of the GDPR): By refusing the request based on unfounded justifications and without demonstrating a real inability to identify the data subject, Metro Service failed to facilitate the exercise of the data subject's rights. The authority also noted that the controller cannot merely assert a reasonable doubt about identity without requesting the additional information necessary to confirm it, pursuant to Article 12, paragraph 6.
• Obligation of fair processing and limitation of retention (Article 5 of the GDPR): The authority found that deleting video recordings after receiving the access request constituted a breach of the principle of fair processing (Article 5, paragraph 1, point a). Even if the 30-day retention period had expired for some data, the controller was obliged to retain relevant recordings solely to respond to the access request. By deleting the data, Metro Service deprived the complainant of the possibility to assert their right of access before the supervisory authority and courts, thus infringing their right to an effective remedy (Article 79 of the GDPR).

Authority's decision

Consequently, the authority issued a severe criticism against Metro Service A/S.

Lessons learned

This decision reminds that:

• once an access request is received, the data concerned must be retained beyond their usual retention period solely to process this request and allow for possible remedies;
• the allegedly excessive or complex nature of an access request is not sufficient to reject it; the controller must concretely demonstrate their inability to identify the person or the manifestly unfounded nature of the request;
• the choice of a processing technology, such as video surveillance, must not hinder the exercise of data subjects' rights, and the controller must implement the necessary technical means to extract relevant data.