In November 2018, we received a complaint from a data subject in relation to an access request for his personal data comprising CCTV footage for a particular time and date, made to a golf club, the data controller.

The data subject provided us with initial correspondence from the golf club asking him why he required the footage and subsequent correspondence informing him that it had discovered a problem with the CCTV system software and was unable to provide him with the requested footage .

This complaint was deemed potentially capable of being amicably resolved under Section 109 of the Data Protection Act 2018 .

As part of the amicable resolution process, we sought an explanation from the golf club as to why the requested CCTV could not be provided to the complainant . The golf club informed us that its CCTV system was not operational on the date for which the data subject had requested footage, and that this had only been discovered when it sought to comply with the access request . The DPC was not satisfied with the generality of this explanation and required a more detailed written explanation on the issues affecting the CCTV, which could also be shared with the complainant . In response to this request, we were supplied with a letter from the golf club’s security company that outlined the issues with the CCTV system, including the fact that the hard drive on the CCTV system had failed and that the system had not been in use for some time. The DPC was satisfied with the technical explanation provided and golf club agreed that this letter could be shared with the complainant. The complainant was satisfied with the explanation, leading to an amicable resolution.

This case illustrates that even when working towards the facilitation or arrangement of an amicable resolution of a complaint, the DPC still expects account- ability on the part of the controller or processor, and will scrutinise explanations and reasons given as to non-compliance with its obligations in order to ensure that the position put forward is verifiable and demonstrable.