The Commissioner of the GRA has published two guidance notes which provide information and guidance on the use of Closed Circuit Television (CCTV) and Subject Access Requests (SARs) under the Data Protection Act 2004 (DPA) and the General Data Protection Regulation 2016/679 (GDPR). 

The Commissioner first issued a guidance document in relation to CCTV in 2007.

A statement from the GRA follows below: 

However, the expanded use and capability of CCTV systems since then has society- wide implications and unless such systems are used with proper care and consideration, they can give rise to concerns that an individual's privacy is being unreasonably eroded. Further, the Commissioner has come across several CCTV operations in Gibraltar which do not comply with data protection laws and raise concern. 

The document provides good practice guidance for those involved in operating CCTV and other surveillance camera devices, to better understand their responsibilities and obligations in regard to data protection when using CCTV. 

A significant number of the enquiries received, and investigations undertaken, by the Commissioner’s office relate to SARs. For this reason, the Commissioner took the decision to publish further guidance on SARs, updating the guidance published in 2007. 

The document sets out key points that organisations need to be mindful of when handling SARs and provides practical tips to assist organisations ensure that they are DPA and GDPR compliant when responding to SARs.