Police University College – Complaint Upheld (Finland, 2022)

The data subject requested a video recording of their screening test from the Finnish Police University College (controller). However, the controller refused to provide a copy because the video showed other students participating in the exam. Furthermore, according to the controller, it was technologically not possible to make a copy of the video recording that would only show the data subject. So instead, the controller provided the data subject with a written explanation of the test results and invited them to view the video recording at the controller's facilities. The controller justified its decision by Article 15(4) GDPR, according to which the right to obtain a copy shall not adversely affect the rights and freedoms of others. The controller also considered that Article 15(3) GDPR gives it a margin of discretion as to the form in which it can provide access to personal information. After the data subject complained, the Finnish DPA evaluated whether the granting of video recording would adversely affect the rights and freedoms of other persons appearing in the recording within the meaning of Article 15(4) GDPR. The DPA held first that giving a piece of written information about the screening test results does not release the controller from its obligation to provide a copy of the video recording. Further, the controller cannot use the protection of third parties as a mere excuse to prevent the data subject from having legal access to their data. Instead, the controller must sufficiently demonstrate that providing a copy of the video recording would, in fact, adversely affect others. Finally, if such a risk exists, the controller must balance conflicting interests considering the individual case circumstances and the risks' likelihood and severity. In particular, the controller should consider applying technical measures such as video anonymisation to preserve the privacy of other persons. Consequently, the DPA ordered the controller to provide the data subj