EMPRESA MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN – Complaint Upheld (Spain, 2021)

A data subject filed an access request with a transport company regarding the results of a selection process for a job. The data subject did not agree with the outcome of the process and wanted to access the videos of one of the driving tests. Since the controller did not answer, the data subject filed a complaint with the Spanish DPA (AEPD). Towards the DPA, the controller claimed that they would not give away videos since the cameras were set to only recorded the outside of the vehicles, thereby recording third persons such as passengers. The data subject compared the case to the access to written answers of an exam already decided by previous judgements. Therefore an access to the driving test videos may have the same result, especially since it would be possible to blur or pixel images of third parties concerned. The AEPD brought forward Recital 59, emphasizing the controller to facilitate data subjects the access of their rights. Furthermore, the AEPD argued that there is a legitimate interest of the data subject to access the evidence and that new techniques to anonymize images would allow to prevent harm to third parties. There is no reason why the data subject should not be able to have access to the recordings that may constitute a fundamental part of the selection process to obtain a job. Accordingly, the AEPD concluded that the controller still had the obligation to provide an answer, either by means of granting access to the data or by means of a justified refusal.