Oct 13 2023

Can you request recorded images of a parking lot if your vehicle has been damaged?

Do you wonder if you can request recorded images of a parking lot if your vehicle has been damaged? Although the license plate of a vehicle is considered as personal data, due to the fact that it would be associated to a specific person (the driver and/or owner of said vehicle) and, therefore, said person would be identified or identifiable in terms of the General Data Protection Regulation, the truth is that requesting to view the video surveillance cameras of a parking lot to verify if your vehicle has suffered any damage would be possible and would be part of the right to access the data of the users.

Resolution of the AEPD giving rise to the right to request the recorded images

A recent resolution of the Spanish Data Protection Agency (AEPD) has agreed with a user who, after being refused by a parking lot to access the recorded images showing his vehicle on the premises, filed a complaint in this regard with the aforementioned authority.

In this regard, and after detecting an anomaly in the condition of his vehicle, the user proceeded to request the company that managed the parking lot to view all the recordings and images captured by the video surveillance cameras installed on the premises for this purpose, in order to check the condition of the car upon entering the parking facilities and determine whether the vehicle was damaged during the time it was parked and, if so, to identify the perpetrator or the person who caused the damage.

However, the company claimed that it could not provide such information because the images and recordings could display personal data or information of other users and, unless such request was made by a judicial or administrative authority, it was not possible to provide the information requested by the user.

However, once the request was made by the AEPD, it could be verified that the company did not include in its response to the user all the information required by article 15 of the RGPD and did not offer a “reasoned” refusal. Therefore, the AEPD upheld the user’s claim and required the company in question to comply with the duly exercised right of access.

Duty of the company managing the parking lot

The company that manages the parking lot must provide the user with the images or recordings requested, making, in advance, the necessary arrangements to anonymize the data of other users that may appear in such recordings or images.

In addition, it must provide all the information referred to in Article 15 of the RGPD and, in the event that the user’s personal data do not exist or are not being processed, or even in those cases in which the user’s request is not properly grounded, the company must deny the request in a reasoned manner, clearly stating the reasons why it does not proceed to consider the right exercised.

Legal considerations regarding the right of Access

Article 15 of the GDPR expressly stipulates that users shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him/her are being processed and, if so, the right of access to such data and to the following information:

The purposes of the data processing.
The categories of personal data.
The recipients or categories of recipients to whom the personal data have been or will be disclosed.
The expected storage period of the personal data or, if this is not possible, the criteria used to determine this period.
The existence of the right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning the data subject, or to object to such processing.
The right to lodge a complaint with a supervisory authority.
Information on the origin of the data where it has not been obtained from the data subject.
The existence of automated decisions, including profiling.

At Letslaw by RSM our team of Data Protection lawyers will advise you on everything you need.