Mercury Security Distribution

The GDPR applies to the processing of personal data by controllers and processors in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of individuals in the EU by a controller or processor established outside the EU, where those processing activities relate to offering goods or services to EU citizens or the monitoring of their behaviour.

​

Where images of parties other than the requesting data subject appear on the CCTV footage the data controller needs to consider, on a case-by-case basis, whether the release of the unedited footage ‘adversely affects’ the rights or freedoms of the third parties, such as their data protection rights, trade secrets, or intellectual property rights such as copyright.