DPA seriously criticises Metro Service over refused CCTV access

In 2025 a citizen complained to DatatilsynetDatatilsynet after Metro Service refused access to CCTV footage from Kongens Nytorv stationDatatilsynet relating to a specific incident. The request, sent through a representative, gave a generic description of the citizen's appearanceDatatilsynet together with concrete details of the episode, narrowed to ten given days between 00:00 and 06:00. It invoked GDPR Article 15(3) and asked that the footage be preserved for a possible investigation.

Metro Service, which operates the Copenhagen Metro, refused twiceDatatilsynet. It argued the description was too generic to identify anyone among the many daily passengersDatatilsynet, that searching the station's cameras would take excessive time, and that footage goes only to the police out of concern for public safety and blind spots. It also said footage is deleted after 30 daysDatatilsynet and was already gone when the request arrived.

In a decision dated 27 October 2026Datatilsynet, Datatilsynet issued serious criticismDatatilsynet under GDPR Article 58(2)(b). Handling the request breached Article 5(1)(a), Article 12(2), Article 12(5)(b) and Article 15, and the subsequent deletion breached Article 5(1)(a) and Article 15, read with databeskyttelseslovens § 39 on complaints to the authority and GDPR Article 79 on proceedings before a court.

On identification, there is no reasonable doubt where the totality of information about a specific person individualises that person sufficiently. A generic appearance description combined with a described episode at a precise place, in a narrow night-time window, with a striking course of events, can meet that test. Reasonable doubt entitles the controller to ask for more information confirming identity, not to refuse outrightDatatilsynet, and Article 12(2) obliges the controller to facilitate rights, with requests answered within a month under Article 12(3)Datatilsynet.

The remaining refusal grounds fail too. Whether a first request is manifestly unfounded or excessive under Article 12(5)(b) is for the controller to prove and is interpreted strictly; time spent alone does not make a request abusive, per EDPB Guidelines 01/2022. A security exception under databeskyttelseslovens § 22, stk. 2 needs a concrete balancing for each item, and the authority's 2019 Metro decision is no general exemption. The blind-spot argument missed its target: the request concerned a described active situation in an open passage that several cameras could have covered, and since no material about the situation had even been retrieved, the concrete assessment never took place.

On deletion, Article 5(1)(a) together with the duty to honour data-subject rights requires measures to retrieve and keep data temporarily for rights requests, especially where a fixed deadline would otherwise erase it before the request is fully handled. After a refusal the controller must as a rule preserve the material so the citizen can complain to Datatilsynet or go to courtDatatilsynet; deleting in immediate connection with the refusal cuts off that review. On Metro Service's own 30-day account only pre-window footage should have been gone, so the ten days' material should have been identified and kept. Overdue footage may be retained for the isolated purpose of fulfilling a filed request, and where others appear the requester gets only their own data, with the controller deploying redaction such as masking to protect third parties.

For CCTV operators, the points are to assess the whole identification picture, document a concrete per-item balancing before invoking security, and freeze requested footage on receipt so a refusal can still be reviewed.

Legal basis: GDPR Article 5(1)(a), Article 12(2), (3) and (5)(b), Article 15, Article 58(2)(b) and Article 79, with databeskyttelseslovens §§ 22 and 39.