Failure to meet the response deadline to a request for access to video surveillance recordings, resulting in their deletion, constitutes a double violation of the right of access (Article 15) and the right to restriction of processing (Article 18), as the retention of images was justified by the complainant's legitimate interest in using them for legal action.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against ACVIL APARCAMIENTOS, S.L.U. (including the imposition of a fine of €90,000) for breaches related to the handling of a right of access request to video surveillance images.

The procedure was initiated following a complaint filed on 13 December 2024, concerning the company's refusal to provide video recordings following an incident that occurred in one of its car parks between 12 and 19 February 2024.

Reasons for the decision

• Obligation to guarantee the right of access (Article 15 of the GDPR): The company failed to meet its obligation to respond to the access request made on 23 February 2024 within the legal one-month deadline. Its first response, dated 4 April 2024, was not only late but refused access by referring the requester to law enforcement. The authority considered that the complainant's legitimate interest in obtaining the images to identify the person responsible for the damage to their vehicle and to take legal action prevailed. The company's argument that the request was excessive due to the volume of hours to be reviewed (3,072 hours) was dismissed, as the delay in response precisely led to the deletion of the images and the impossibility of fulfilling the request.
• Obligation to respect the right to restriction of processing (Article 18 of the GDPR): The complainant had explicitly requested, from the first communication, the retention of the recordings for potential legal action. The authority considered that this request constituted an exercise of the right to restriction of processing, justified by the need to retain data for the establishment, exercise, or defense of legal claims. By deleting the images before deciding on the request and due to its late response, the company violated this obligation, depriving the complainant of the necessary evidence for their recourse.

Authority's decision

Consequently, the authority imposed a fine of €90,000 on ACVIL APARCAMIENTOS, S.L.U., after applying a reduction for acknowledgment of responsibility and voluntary payment on an initial amount of €150,000.

Furthermore, the authority ordered the company to implement, within three months, mechanisms ensuring that requests to exercise rights are processed within legal deadlines and that recordings are not deleted before a decision is made on these requests.

Lessons learned

This decision confirms / specifies / recalls that:

• The legitimate interest of a victim to identify the perpetrator of damage to initiate legal action is a valid reason to request access to video surveillance recordings.
• A request to retain video surveillance images for litigation purposes must be treated as a request for restriction of processing within the meaning of Article 18 of the GDPR, which imposes an obligation not to erase the data concerned.
• Failure to meet the one-month deadline to respond to an access request, if it results in the permanent deletion of the requested data, constitutes a serious violation of the right of access.
• Claiming the allegedly excessive nature of an access request to a large volume of video recordings is not a valid reason to refuse to process it, especially when the requester has limited their request to a specific period and event.