The right of access includes the right to obtain a copy of telephone and video recordings in which the data subject appears, subject to the rights of third parties.

Facts and context

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a sanction decision against Tineretului Veterinary Hospital SRL, including the imposition of a fine of 5,242 lei (approximately €1,000), for breaches related to the data subject's right of access.

The case originated from a complaint by a natural person concerning the management of their request for access to their personal data by the establishment.

Grounds for the decision

• Obligation to respect the right of access (Article 15 of the GDPR): The authority found that the controller did not properly handle the data subject's request. The data subject requested a copy of a telephone conversation with an employee as well as video recordings showing them on the premises during a specific time interval. By not providing these copies, the controller failed to comply with the obligation to respond to an access request, in violation of paragraphs 1 and 3 of Article 15 of the GDPR.

Decision of the authority

Consequently, the authority imposed a fine of 5,242 lei (approximately €1,000) on Tineretului Veterinary Hospital SRL.

Furthermore, the authority ordered the controller to provide the complainant with a complete response, including a copy of the requested telephone conversation and video recordings, subject to their availability and taking into account the European Data Protection Board (EDPB) Guidelines 3/2019 on the processing of personal data through video devices. The controller was also instructed to adopt or revise its internal procedures regarding the management of data subject requests (Articles 12 to 22 of the GDPR) and to ensure regular training of its staff on this matter.

Lessons learned

This decision reminds that:

• The right to obtain a copy of data, provided for in Article 15(3) of the GDPR, extends to audio (telephone conversations) and video recordings in which the data subject is identifiable.
• A response to an access request must be complete and provide all information and copies requested by the data subject, not merely a confirmation of processing.
• The implementation of clear internal procedures for managing rights requests and staff training are essential organizational measures to ensure effective respect for data subjects' rights.