Any insurance practitioner will know that CCTV is one of the most important peices of evidence following an accident. Unlike witness recollections, footage may provide a contemporaneous record of where people were positioned, how an accident occurred and what happened immediately afterwards.
But having been captured on CCTV does not necessarily mean that a person involved in an accident is automatically entitled to receive the footage through the court discovery process.
Irish law draws an important distinction between obtaining CCTV through discovery in civil proceedings and requesting access to your own personal data under Article 15 of the GDPR.
That distinction became particularly important following the High Court decision in Dudgeon v Supermacs Ireland Ltd [2020] IEHC 600 and the subsequent response from the Irish Data Protection Commission.
For insurers, businesses, defendants and those involved in a personal injury* claim, understanding the difference can be significant.
Why Is CCTV So Important After an Accident?
CCTV frequently arises in claims involving:
- accidents in shops, supermarkets, restaurants and hotels;
- slips, trips and falls;
- road traffic accidents in car parks or near commercial premises;
- accidents involving buses or other public transport;
- workplace accidents; and
- incidents where there is disagreement about exactly what happened.
The attraction of CCTV is obvious. It may provide an objective record of an event which can later be compared with witness evidence, pleadings, medical evidence and the accounts given by the parties.
However, there are different legal routes by which CCTV might be obtained, and those routes should not be confused.
What Is Discovery?
Discovery is the process by which parties to civil litigation may be required to disclose relevant documents and material in their possession, power or procurement.
Its purpose is not to provide unrestricted access to everything that might be interesting or potentially useful. Discovery is governed by the issues arising in the proceedings and the principles of relevance, necessity and the proper administration of justice.
CCTV is capable of being discoverable. Indeed, video footage can sometimes be extremely important evidence.
However, Dudgeon v Supermacs demonstrates that the existence of relevant CCTV does not necessarily mean that a court will order its disclosure in every case.
What Happened in Dudgeon v Supermacs?
The case arose from an accident at a Supermacs restaurant in Galway in January 2017.
The plaintiff’s case was that she sat on a chair which broke and that she fell to the ground, sustaining injury. Proceedings were subsequently issued and discovery was sought, including CCTV footage from the restaurant.
The plaintiff argued that CCTV represented particularly strong evidence because it recorded events as they happened and was not dependent upon the potentially imperfect recollection of witnesses.
The request was resisted by Supermacs.
The dispute ultimately reached the High Court, where Mr Justice Barr considered the purpose for which the footage was being sought. The Court concluded on the particular facts that the CCTV was essentially being requested so that the plaintiff could verify her assertion that she had fallen to the ground before giving evidence.
The High Court upheld the refusal to order discovery of the footage.
The decision should not be interpreted as establishing that CCTV cannot be discovered in personal injury litigation. Rather, it illustrates that a request for CCTV through discovery will be considered according to the issues in the particular proceedings and the purpose and necessity of the discovery sought.
Does Dudgeon Mean an Injured Person Cannot Obtain the CCTV?
No.
This is where the distinction between discovery and data protection law becomes particularly important.
Following the decision in Dudgeon, the Irish Data Protection Commission published specific guidance entitled “CCTV, Discovery and Access Requests” on 10 February 2021.
The DPC expressly emphasised that Dudgeon concerned the law of discovery in Irish litigation.
It did not determine an individual’s separate rights under data protection law. (Homepage | Data Protection Commission)
The DPC explained that the right to access one’s own personal data is grounded in Article 15 GDPR and Article 8(2) of the Charter of Fundamental Rights of the European Union.
Crucially, the DPC stated that an individual’s right to request access to personal data does not depend upon whether that person is involved in court proceedings. (Homepage | Data Protection Commission)
Accordingly, the fact that CCTV may not be obtainable through discovery does not necessarily determine whether an individual has a separate entitlement to access personal data contained in that footage under the GDPR.
Can You Make a GDPR Request for CCTV?
Potentially, yes.
Where CCTV contains an identifiable image of an individual, that image can constitute that person’s personal data.
Article 15 GDPR provides individuals with a right of access to personal data being processed about them. In appropriate circumstances, this can include CCTV footage.
The DPC has stated that, when dealing with CCTV access requests, providing a copy of the individual’s personal data will usually require the provision of the footage itself in video format.
Where video genuinely cannot be provided, still images may sometimes be appropriate, but the controller must still provide a complete response in accordance with its obligations. (Homepage | Data Protection Commission)
This is not merely theoretical.
In a DPC case study published in relation to 2024, an individual requested CCTV following an accident involving a transport company’s bus. The company did not initially respond. Following intervention by the DPC, the company provided the requested CCTV footage to the individual. (Homepage | Data Protection Commission)
Does It Matter That the CCTV Is Wanted for a Legal Claim?
This is where a later decision of the Court of Justice of the European Union becomes particularly relevant.
In FT v DW, Case C-307/22, decided on 26 October 2023, an individual sought access to medical records under Article 15 GDPR with a view to examining potential liability arising from medical treatment.
The Court held that the GDPR does not make the provision of the first copy of personal data conditional upon the person giving reasons to justify the request.
In other words, the controller could not require the data subject to demonstrate some approved GDPR-related motive before exercising the Article 15 right. (EUR-Lex)
Although FT v DW concerned medical records rather than CCTV, the Article 15 principle is important.
A request does not cease to be an Article 15 request simply because the individual may ultimately wish to use the information when considering legal proceedings.
That creates an interesting contrast with Dudgeon.
In Dudgeon, the purpose for which the plaintiff sought the CCTV was highly relevant to the Court’s decision on discovery.
Article 15 GDPR operates under a different legal framework.
Is a Subject Access Request a Way Around Discovery?
It would be too simplistic to describe GDPR as a means of simply circumventing the rules of discovery.
The better analysis is that the two rights have different legal foundations and different purposes.
Discovery is part of the court process. It concerns disclosure between litigating parties and is controlled by the rules and principles governing civil proceedings.
A Subject Access Request concerns an individual’s statutory right to obtain access to their own personal data.
The Data Protection Commission’s response to Dudgeon could hardly be clearer on that distinction: the fact that litigation exists does not, by itself, remove the right to request access to personal data. (Homepage | Data Protection Commission)
Equally, Article 15 is not unlimited.
The GDPR itself contains qualifications, including protection for the rights and freedoms of others, and Irish legislation contains circumstances in which data protection rights may lawfully be restricted.
Any refusal therefore requires consideration of the actual legal basis relied upon. A blanket response that CCTV will not be provided simply because personal injury proceedings are contemplated or underway may not adequately address the separate Article 15 issue.
What If Other People Appear on the CCTV?
This is a common practical issue.
An access request concerns the requester’s personal data. It does not automatically entitle that individual to unrestricted personal data relating to everybody else who appears on the recording.
That does not necessarily justify withholding the entire recording.
The DPC’s CCTV guidance explains that where other identifiable people appear, a controller may need to pixelate or otherwise de-identify those individuals before supplying the footage. (Homepage | Data Protection Commission)
Controllers therefore need to consider whether third-party rights can be protected through editing or redaction rather than assuming that the presence of another person automatically prevents disclosure.
How Quickly Should CCTV Be Requested?
As early as possible.
Many CCTV systems operate according to retention periods and footage may eventually be overwritten in the ordinary course of operation.
If an accident has occurred and CCTV is likely to be relevant, consideration should therefore be given promptly to identifying who controls the system and requesting that relevant footage is preserved.
Once a valid access request has been made, the GDPR generally requires a response within one month. The DPC has also emphasised the importance of preserving relevant footage while an access request is being dealt with. (Homepage | Data Protection Commission)
For insurers and businesses operating CCTV systems, appropriate procedures for identifying, preserving, reviewing and redacting footage can therefore be important both from a claims-handling and data-protection perspective.
Obtaining CCTV Is Not the Same as Having an Unrestricted Right to Publish It
There is another important distinction.
Even where CCTV is disclosed during civil litigation, the recipient does not ordinarily acquire an unrestricted right to circulate or publish it.
Documents and information produced through discovery are generally subject to an implied undertaking that they will be used only for the purposes of the proceedings in which they were disclosed.
We have previously looked in detail at this issue in our article Discovery, Implied Undertakings and Contempt of Court: A Conor McGregor Saga, following the High Court proceedings concerning CCTV used in the Nikita Hand litigation. (Lacey Solicitors)
The important point is that:
the right to obtain evidence and the right to publish or disseminate that evidence are two different questions.
CCTV obtained on discovery must be handled in accordance with the obligations attaching to the discovery process. Material obtained through a data protection request may raise different issues, but receipt of personal data should not be treated as an unrestricted licence to publish footage containing other individuals or otherwise interfere with their rights.
The Position for Insurers and Businesses
For insurers, retailers, hospitality businesses, transport operators and other organisations dealing with accident claims, Dudgeon should not be treated as authority for a general policy of refusing CCTV requests whenever litigation is anticipated.
The first question should be: what legal route is being used to seek the footage?
A request for voluntary discovery, a formal discovery application and an Article 15 access request are not the same thing.
Businesses should also distinguish between:
a dispute over whether CCTV must be disclosed as evidence in litigation; and
an individual’s separate request to obtain personal data held about them.
Conflating the two can create unnecessary difficulty and potentially expose a controller to a complaint to the Data Protection Commission.
The Position for Someone Involved in an Accident
For a person seeking CCTV following an accident, the practical starting point is to identify quickly who owns or controls the camera.
The request should identify the accident as accurately as possible, including the date, approximate time, location and any information that assists the controller in identifying the requester on the footage.
It may also be sensible to request expressly that the footage is preserved pending determination of the request.
Where litigation is contemplated, the appropriate route to obtaining evidence will depend upon the circumstances of the particular case. A Subject Access Request and discovery should not automatically be treated as interchangeable.
CCTV, GDPR and Litigation: The Key Distinction
The aftermath of Dudgeon v Supermacs demonstrates why CCTV disputes require careful analysis.
The High Court was entitled to consider the proper purpose and necessity of a discovery application within civil litigation.
The Data Protection Commission subsequently made clear that this did not determine the separate right of a person to request access to their own personal data under Article 15 GDPR.
The later decision of the CJEU in FT v DW reinforces the point that an Article 15 requester does not generally have to provide a particular reason to justify exercising the right of access. (EUR-Lex)
For both insurers and those bringing claims, the starting point should therefore be to identify which legal right is actually being exercised.
Discovery and data access can sometimes concern exactly the same piece of CCTV footage.
They are not, however, the same legal process.
Lacey Solicitors Insurance Lawyers Dublin
Lacey Solicitors advises insurers, businesses and individuals in relation to insurance litigation and personal injury* proceedings throughout Ireland.
Our Dublin office is at Ormond Building, 31–36 Ormond Quay Upper, Dublin 7, D07 EE37, and can be contacted on +353 1 513 4375.
In contentious business, a legal practitioner shall not charge any amount in respect of legal costs expressed as a percentage or proportion of any damages (or other moneys) that may become payable to his or her client or purport to set out the legal costs to be charged to a junior counsel as a specified percentage or proportion of the legal costs paid to a senior counsel. A legal practitioner shall not without the prior written agreement of his or her client deduct or appropriate any amount in respect of legal costs from the amount of any damages or moneys that become payable to the client in respect of legal services that the legal practitioner provided to the client.
