Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaság – €50,000 Fine (Hungary, 2020)

A customer of the Deichmann company claimed that after an in-store purchase he did not receive the correct amount of money back from the cashier. The customer initially did not notice that he paid with a larger bill, and only later noticed and informed Deichmann. Since the facts were disputed, the customer asked the company to view the video recording in which the customer appeared as he was paying. Deichmann informed the customer that the recording can only be accessed by the police following an official request. The customer filed a police report, but the camera recording was no longer available by the time of the request. Following this situation, the NAIH conducted an ex officio investigation into the company and found that Deichmann was operating cameras extensively throughout the country, with cameras in all 129 of its stores. The DPA found that the controller had breached multiple GDPR provisions in connection to data subject access requests. Amongst these, the company did not keep separate records of the data subject requests that it had been receiving. Did the data controller fulfill its obligations under the GDPR in connection with data subject access requests? The DPA first held that the request to access the camera images does fall within the scope of Article 15(1) GDPR. Furthermore, the NAIH emphasised that the controller's claims were incorrect with regards to the footage only being accessible to the police. Apart from Article 15(3), the DPA held that the data controller must also give data subjects access to the part of the recording in which that person appears. The NAIH also pointed to the importance of Article 12(4) and offering data subjects adequate explanations on the reasons for a controller's refusal to act on a data subject's request. Regarding the deletion of the recording, the DPA held that Deichmann breached Article 18(1)(c). The controller should have kept the data following the data subject's request, until his legal claim was set