Cy Data Commissioner: Pop Life Electric Shops Ltd (

The Cypriot DPA held that the footage from a CCTV system of an individual shall be handled as subjects to Article 4(1) of GDPR Regulation.

The Cypriot Data Protection Authority held that the footage from a CCTV system of an individual shall be handled as subjects to Article 4(1) of GDPR Regulation. The meaning of that conclusion is that the Data Controller is obligated to provide access to the affected individual.


The Complainer had an accident outside a store, and an Action has been filed subsequently. Access to the video footage records has been requested from the Complainer’s lawyer, but as an out-of-court procedure and before any court order to produce relevant evidence to the trial.

Initially, the Company, as the Data Controller, has rejected the above request on the ground that if a trial is taking place, then Article 55(3) of GDPR is triggered. The Company believed that this article suspends the obligation to provide access to personal data.

The Cypriot DPA intervened and informed the Company for his erred in law. Article 55(3) suspends the competence of supervisory authorities, not the obligations of legal subjects. The Company’s reaction was the forwarding a small extract of the footage from only one camera, when more cameras were available too, at least under the views of the claims made by the Complainer. The Complainer still was feeling dissatisfaction and re-asked for the support of the Cypriot Commissioner.


One of the Controller’s allegation was that his CCTV system maintains footage only for one month and only that particular extract has been separated and that because it was also requested from their lawyer and their insurance partner, immediately after the action has been notified to them. The rest of the footage remained to the CCTV system until the automated clean-up.

The Cypriot Commissioner for Personal Data Protection asked for corroborating evidence about the allegation that the CCTV system save the footage only for that duration. The confirmation came by a letter from the Company who has installed the CCTV system in the store.

When the Cypriot Commissioner for Personal Data Protection has been convinced for those allegations, held that, in these circumstances, the Complainer enjoyed her right of access, even if she received only an extract of the footage.

Article 4(1) of GDPR | Article 12(3) οf GDPR | Article 15 of GDPR | Article 53(3) of GDPR | Article 38 of GDPR | Article 39 of GDPR

This case summary was first published on GDPRHub

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Δημήτρη Δημηρίου v. Cyprus Popular Bank Public Co Limited κ.α. (2018), Πολιτική Έφεση υπ’ αριθμόν E151/156

Το Ανώτατο Δικαστήριο αφού υποβάθμισε τα παραδοσιακά κριτήρια σε βοηθητικά κριτήρια, αποφάνθηκε ότι οι προτεινόμενες τροποποιήσεις δικογράφων δεν προσθέτουν κάτι στην δικαστική κρίση.

Athena Varianes v. Dr. Andreas Vorkas, appeal 269/2006

Cyprus Law on medical negligence - The appellant had filed a legal action against her doctor. The doctor is an eye specialist and well-known for his services to treat nearsightedness with laser surgeries. When the patient arrived home, she could already feel nuisances on both her eyes. There is still doubt as to whether patient's eye sight may ever fully recover.

Slowakische Republik v. Achmea BV, C-284/16

Όταν Διμερή Συνθήκη μεταξύ Κρατών μελών επικαλύπτει το Ενωσιακό Δίκαιο & η θέση των ρητρών διαιτησίας στην ΕΕ

Peter Gauweiler v. Deutscher Bundestag, C-62/14

Κατά τις διορθωτικές παρεμβάσεις της ΕΚΤ δεν πρέπει να παρακινεί τα κράτη-μέλη να παραιτούνται από την επιβαλλόμενη εκ συνθηκών εξυγίανση των δημόσιων οικονομικών τους.