Datatilsynet (DK) · 2025-31-2353

Skip the main navigation The Danish Data Protection Agency Issues Serious Criticism of Metro Service Date: October 27, 2026 Decision Private Companies Serious Criticism Complaint Right of Access CCTV Surveillance Exercise of Rights The Danish Data Protection Agency has issued a decision in a case where Metro Service refused to grant a citizen access to CCTV footage. The decision is relevant to all data controllers as an example of how the right of access must be observed when using CCTV. Case number: 2025-31-2353. Summary The Danish Data Protection Agency has issued a decision in a case where a citizen complained that Metro Service had refused to grant access to CCTV footage from Kongens Nytorv station in connection with a specific incident the citizen had experienced. In their request for access, the complainant had provided a general description of their appearance and details regarding specific aspects of the incident. However, due to the complainant’s personal circumstances, the incident could not be pinpointed more precisely than a 10-day period between 12:00 a.m. and 6:00 a.m. Metro Service had refused to grant the request for access, citing that it was not possible to identify the complainant, that responding to the request would be unduly time-consuming, and that public safety considerations meant that CCTV footage could not be disclosed in certain cases. Metro Service further stated that the company is reluctant to grant access to CCTV footage, as this could lead to the disclosure of blind spots. In the period following Metro Service’s notification to the complainant of the denial of the request for access, the relevant CCTV footage was deleted. The Danish Data Protection Agency Issues Serious Criticism The Danish Data Protection Agency found that Metro Service could not refuse to grant the complainant access to CCTV footage on the grounds of lack of identification, excessive time consumption, and public safety concerns. In its decision, the Data Protection Authority noted that the right of access is the general rule, and exceptions to this rule require documented and specific balancing of interests. The Authority assessed that Metro Service had not sufficiently demonstrated that it had conducted a specific balancing of the separate interests to the extent that an exception could apply in this specific case. Furthermore, the Danish Data Protection Agency found that Metro Service’s subsequent deletion of the material had been carried out in violation of data protection regulations. Among other things, the Authority emphasized that Metro Service had unlawfully deprived the complainant of the opportunity to have their right of access to the information reviewed by the Danish Data Protection Agency and the courts. In its decision, the Danish Data Protection Agency ruled that information—which, according to the established deadlines, should have been deleted—may be retained for the sole purpose of fulfilling a specific and already submitted request for access. In this context, the Danish Data Protection Agency highlighted the relationship to any other data subjects captured in the recordings, as the data subject is only entitled to receive information about themselves. In such cases, it is up to the data controller to implement technical measures, such as audio and video editing tools, to be able to comply with a request for access while ensuring that personal data concerning others is processed only for the relevant period and limited to the original purpose. Overall, the Danish Data Protection Agency assessed that there were grounds for expressing serious criticism of Metro Services’ handling of the complainant’s request for access and Metro Services’ subsequent deletion of the recordings. Data Controllers’ Compliance with the Right of Access in CCTV Surveillance Under the General Data Protection Regulation (GDPR), the individuals whose data you process have the right to access the information you process about them. Data subjects who request access must therefore receive a copy of the information being processed about them. This also applies when the processing of personal data takes place in connection with CCTV surveillance. A data controller responsible for processing personal data through CCTV surveillance cannot conclude that there is reasonable doubt regarding the data subject’s identity if the total amount of information provided about a specific natural person sufficiently identifies that person. The fact that responding to a request for access is time-consuming cannot, on its own, serve as the basis for determining whether the data subject is abusing the exercise of their rights. If, as a data controller, you wish to use technologies—such as video surveillance—to support your organization’s processing of personal data, the technology must not hinder the observance of data subjects’ rights. In general, it will not be permitted to use technological support for the processing of personal data that, in and of itself, makes it impossible to retrieve such data for the purpose of ensuring the data subjects’ rights. If a request for access cannot be granted, the data controller must be able to document why the request for access is being denied. Decision The Danish Data Protection Agency hereby revisits the case in which [the complainant’s representative] on [date] 2025—on behalf of [the complainant]—lodged a complaint with the Authority alleging that Metro Service A/S (hereinafter “Metro Service”) had refused to grant access to CCTV recordings of the complainant. 1. Decision The Danish Data Protection Agency strongly criticizes the fact that Metro Service’s handling of the request for access did not comply with the provisions of the General Data Protection Regulation[1], Article 5(1)(a), Article 12(2), Article 12(5)(b), and Article 15 of the General Data Protection Regulation (GDPR)[1], and that Metro Services’ subsequent deletion of the material did not comply with the provisions of Article 5(1)(a) and Article 15 of the GDPR, cf. Section 39 of the Data Protection Act[2] and Article 79 of the General Data Protection Regulation. Below is a detailed review of the case and a statement of reasons for the Danish Data Protection Agency’s decision. 2. Statement of Facts It appears from the case that on [27 days after the first day covered by the request], the complainant requested Metro Service to grant access to CCTV footage recorded at Kongens Nytorv Metro Station. The complainant’s request for access states that: “[…] The requested video recordings relate to a specific incident that is believed to have taken place during [a 10-day period]. The specific date is unknown, but our client states that the incident took place in the late night/early morning hours between 12:00 a.m. and 6:00 a.m. During the aforementioned incident, our client [specific sequence of events described]. To help identify the recordings/images, our client [description of the complainant’s appearance]. We request that the video recordings and/or images in question be provided from the metro company’s video surveillance system, in accordance with Article 15(3) of the General Data Protection Regulation. As mentioned above, [the complainant] was [description of the sequence of events]. We are interested in surveillance footage and/or images from the video surveillance system, starting from the moment [description of the point in the sequence of events for which access is requested]. Please also ensure that the video surveillance footage from the aforementioned incident is preserved so that it is available for a potential investigation. […]” On [32 days after the first day covered by the request], Metro Service refused to grant the request for access to the CCTV footage, providing the following justification: “[…] We at Metro Service have received your inquiry forwarded from MetroSelskabet. The information you have provided is insufficient to identify your client in our CCTV footage. There are a great many people who take the metro every day, and there are a great many who fit [the complainant’s description]; this is of no help [...].” The complainant contacted Metro Service again [later that month] and referred to the additional information regarding the incident. Metro Service upheld its denial of the request for access the [following day] with the following explanation: “[…] We assess that it is not possible to identify the person in question based on the information provided; the description is simply too generic, furthermore, we are also cautious about releasing video footage to anyone other than the police, in the interest of ensuring public safety and order, as it should not be possible to expose blind people. […]” 2.1. Metro Service’s Comments Metro Service has generally stated that it deletes CCTV footage after one month, which is why the footage had been deleted by the time the request was received. Metro Service further considers the physical description provided by the complainant to be insufficient to identify the individual in question. In this regard, Metro Service notes that it has a total of [X] cameras at Kongens Nytorv Station, where a total of [Y] hours of footage would need to be reviewed. This would amount to a total of [XxY] hours of work for Metro Service. Metro Service has further stated that it is not possible to fast-forward through the footage at more than four times the normal speed, as the video will begin to stutter. Metro Service does not dispute that the matter was of particular significance to the data subject, but maintains that the refusal of the request for access is based, in part, on the fact that the CCTV footage had been deleted and, in part, on the inability to pinpoint the exact time of the incident. On [date] 2025, Metro Service issued the following statement regarding the case: “… Metro Service operates the Copenhagen Metro. Please note that Metro Service deletes video footage after one month, which is why it had been deleted by the time we received the request. Furthermore, it should be noted that the description is insufficient to identify the individual “[description of the complainant’s appearance reproduced]” within a period of [Y] hours. Metro Service needs to receive the request within a relatively short time so that we can save the footage before it is deleted, and we need to know the exact time of [the incident] so that we can review our CCTV archive for footage to identify the individual in question. A period of [Y] hours of surveillance footage is too much for Metro Service to review. Metro Service notes that the video footage related to the incident has been deleted, as video footage from stations is only stored for 30 days. Metro Service also maintains its denial of the request for access, which is somewhat irrelevant since the video footage had already been deleted. Metro Service does not dispute that [the incident the complainant experienced] is a matter of particular significance to the complainant. The reason for the denial is the lack of surveillance footage, as well as the inability to pinpoint the exact time of the incident.” On [date] 2025, Metro Service issued the following statement regarding the case: “The incident occurred during [a 10-day period] between 12:00 a.m. and 6:00 a.m. The inquiry was forwarded to Metroselskabet, which received it on [27 days after the first day covered by the request] and forwarded it to us at MetroService on [30 days after the first day covered by the request]. “The customer” received a response on [32 days after the first day covered by the request], in which the request was denied on the grounds that the information provided was insufficient to locate the person in question. The denial could have noted that the recordings had been deleted by that time, since more than 30 days had passed between the date the recordings were made [first day covered by the request] and the receipt of the request for access [the date the request was forwarded to Metro Service]. Later that month, the “customer” followed up. This inquiry is answered the following day (with a new denial)—the denial should probably have stated that the matter was so old that the surveillance footage was no longer available; this might have closed the case at that point. The [Y] hours of surveillance footage would have to be reviewed for [X] cameras located in the center aisle, meaning there were [XxY] hours of surveillance footage. However, all of it had been deleted by the time the request was received. It is true that the playback speed can be increased slightly, but as soon as it reaches 4x speed, the video will become choppy, making it impossible to identify the incident. If the individual [was involved in the incident], they must [have documentation] containing [relevant details]. It is puzzling why this was not submitted within a few days instead of such a vague description more than a month later. The recordings had already been deleted at the time the request was received on [30 days after the first day covered by the request]. Therefore, it was impossible to take steps to secure the recordings.” 2.2. The Complainant’s Comments The complainant has generally stated that they have narrowed down the incident to such an extent that it is possible to identify the data subject, and that the sequence of events was conspicuous and unusual to such an extent that the incident could be identified through a targeted review of a few key camera angles, without the need for a systematic review of all footage from the specified period. On [date] 2026, the complainant submitted the following statement regarding the case: “In the present case, the incident was narrowed down to: a precise location (the long, open central aisle at Kongens Nytorv Metro Station), a narrow time frame (the night hours from 00:00 to 06:00), and an unusual and distinctive sequence of events, in which [description of the sequence of events]. This information made it possible to identify the incident through a limited and targeted review of the surveillance footage. […]” […] Metro Service has argued that identification would require reviewing a very extensive amount of footage and would therefore be disproportionately burdensome. However, this assessment is based on a flawed premise. The incident took place in a long, open hallway without any visual barriers, and the reported sequence of events—[description of the incident]—would be clearly evident upon reviewing a limited number of camera angles. In this regard, it should be noted that the incident cannot be expected to have been captured by a single camera alone. Since the complainant also [description of the sequence of events], the sequence of events must necessarily have been recorded successively from multiple camera angles along the route through the station. […]” The complainant has further stated that the very purpose of the request for access was to shed light on the incident, including for the purpose of [the purpose of the request was to document the incident in order to exercise a right]. It has therefore not been possible for the complainant to obtain [other documentation of the incident] and thereby further specify the time frame for the request. The complainant has pointed out that Metro Service itself has referred to an internal policy regarding the deletion of CCTV recordings, which stipulates that recordings are deleted after 30 days. The complainant has further argued that all of the relevant recordings should therefore not have been deleted at the time of the request, since the recordings from [9 of the days in the period] were not 30 days old, and that Metro Service was informed on [30 days after the first day covered by the incident] and [later the following month] that the recordings were to be retained for the purpose of a possible investigation. At no point in the complainant’s correspondence with Metro Service was it stated that the recordings had been deleted. The complainant first became aware that the recordings had in fact been deleted in connection with the Danish Data Protection Agency’s consultation letter dated [date] 2025. In conclusion, the complainant states that the rejection of a request for access on grounds of public safety requires a specific and documented balancing of interests, that Metro Service has not demonstrated that there is an imminent risk of significant harm, and that Metro Service itself has acknowledged that the incident is of particular significance to the complainant. 3. Rationale for the Danish Data Protection Agency’s Decision Article 4(1) of the General Data Protection Regulation states that “personal data” means any information relating to an identified or identifiable natural person (“the data subject”); “identifiable natural person” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. According to Article 5(1)(a) of the General Data Protection Regulation, personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject. It follows from Article 15(1) of the General Data Protection Regulation that the data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed, and, if so, to access the personal data and other information specified in subparagraphs (a) through (h) of that provision. In addition, the data subject has the right to receive a copy of the personal data processed by the data controller, see Article 15(3). Data subjects who request access must therefore—as a general rule—receive a copy of the information being processed about themselves. If personal data is processed as part of CCTV surveillance, data subjects will therefore—in connection with the response to a request for access—as a general rule receive a copy of the video recordings (including any audio recordings) in which the data subject appears. It follows from Article 12(2) of the General Data Protection Regulation that the data controller is responsible for facilitating the exercise of the data subject’s rights. In the cases referred to in Article 11(2), the data controller may not refuse to comply with the data subject’s request to exercise their rights under Articles 15–22, unless the data controller demonstrates that it is unable to identify the data subject. When a data subject exercises his or her rights, Article 12(3) of the General Data Protection Regulation requires that a request be answered without undue delay and no later than one month after receipt. If there is reasonable doubt as to the identity of the natural person making a request, the data controller may request additional information necessary to verify the data subject’s identity, see Article 12(6) of the General Data Protection Regulation. It follows from Section 22(1) of the Data Protection Act that Article 15 of the General Data Protection Regulation does not apply if the data subject’s interest in the information is deemed to be outweighed by overriding legitimate interests, including the interests of the data subject themselves. There may thus be cases where a data controller is not obligated to provide a copy of the information being processed about a data subject or to disclose the source of the personal data. The specific comments[3] on Section 22(1) of the Data Protection Act state, among other things, the following: “The use of the term “crucial” in the provision indicates that an exception to the duty to provide information and the right of access may only be made where there is an imminent risk that the interests of private individuals will suffer significant harm.” The application of, among other provisions, Section 22(1) of the Data Protection Act, which limits the data subject’s right of access, requires the data controller to conduct a specific assessment. 3.1 Failure to Identify the Data Subject If the data subject wishes to exercise their rights and, in that connection, provides the data controller with information that makes it possible to identify them, the data controller may not refuse to respond to the data subject’s request, unless it can be demonstrated that the data controller is still unable to identify the data subject. It is the opinion of the Danish Data Protection Agency that the right of access to personal data for a data subject under Article 15 of the Data Protection Act must be viewed in light of what is defined as personal data in Article 4, No. 1, and which can be attributed to the natural person making the request. It is therefore—including in the case of video and image material—necessary to consider all relevant descriptive elements provided regarding the circumstances under which the data was created, in order to effectively assess whether the information relates to the data subject, cf. Article 12(6) of the General Data Protection Regulation. Furthermore, it is the opinion of the Danish Data Protection Agency that, for requests for access that cannot be shown to be manifestly unfounded, it would not normally be in accordance with Article 5(1), (a) of the General Data Protection Regulation to reject the request solely on the basis of a description of the data subject’s appearance when there are additional factors that qualify the personal data in relation to the request for access. The presence of additional information would normally give rise to further investigation and, if necessary, contact with the data subject, as provided for in Article 12(6). After reviewing the case information, including the description of the complainant’s appearance and the circumstances under which the personal data in question was allegedly collected, the Danish Data Protection Agency finds that Metro Service has not sufficiently demonstrated that the complainant’s description did not allow for the identification of the complainant. The Danish Data Protection Agency has placed particular emphasis on the fact that it is not only the data subject’s appearance that is described, but the entire episode that took place, including [description of the incident]. Furthermore, the incident occurred at a time when the station is generally presumed to be less crowded. This, combined with the data subject’s other description, should be considered sufficiently specific and unique that—in the Data Protection Authority’s view—it is possible to identify the incident and the data subject involved. Against this background, the Danish Data Protection Agency finds that Metro Service, by rejecting the request for access solely on the grounds of the complainant’s failure to provide identification, has not complied with the requirements of Article 15 and Article 12(2) of the General Data Protection Regulation. 3.2 Regarding Excessive Time Consumption In exceptional cases, the data controller may either reject a request from a data subject or charge a reasonable fee for responding to the request if the request is manifestly unfounded or excessive. This follows from Article 12(5) of the General Data Protection Regulation. The burden of proof that a request is manifestly unfounded or excessive lies with the data controller, and the possibility of refusing to process a request must be interpreted strictly.[4] The assessment of whether a (first) request for access can be considered excessive and thus constitutes an abuse requires, on the one hand, certain objective circumstances that must demonstrate that the purpose of the request for access is contrary to the purpose of the right of access, and, second, a subjective element, whereby the data controller, based on the specific circumstances of the case, can demonstrate that there is an intent constituting an abuse.[5] As a general rule, the right of access shall not be restricted, subject only to the workload that complying with the request may impose on the data controller.[6] However, if the data controller processes a large volume of information, it may request that the data subject, before the information is provided, specify the information or processing activities to which the request relates.[7] It appears from the email correspondence between Metro Service and the complainant that Metro Service requested further clarification of the request for access, to which the complainant responded by clarifying the information regarding the incident that the complainant had at their disposal. In this context, it appears that the complainant had only limited information available [documentation of the incident], and it was precisely for this reason that the complainant wished to use the recordings in connection with [purpose of the request]. It also appears from the case file that the complainant is a particularly vulnerable individual who has been unable to recall the date on which [description of the incident] took place, which is why the request was broad in scope. In both of its responses to the complainant and statements to the Danish Data Protection Agency, Metro Service has, despite the description, maintained that identifying the incident to which the request for access relates would require an excessive amount of time and would therefore constitute an abuse. Metro Service has further noted that it is not possible to increase the video playback speed more than fourfold without the video becoming choppy, and that it would be necessary to review [X] cameras in the center aisle to comply with the request. The Danish Data Protection Agency does not consider it sufficiently substantiated why glitches in the video would make it impossible to identify [the incident]. Furthermore, the Danish Data Protection Agency must emphasize that a data controller who wishes to use a given type of technology, in this case, video surveillance, has an obligation to ensure that the processing activities entailed by the technology do not prevent compliance with the rules regarding the rights of data subjects. Thus, in general, it will not be permitted to use technological support for processing that, in and of itself, does not enable the retrieval of specific personal data. In this regard, the Danish Data Protection Agency has emphasized that clips in the video or missing frames would not make it impossible to identify a person who [description of the sequence of events]. Similarly, the Danish Data Protection Agency does not find that Metro Service has demonstrated that it was necessary to review [X] different cameras to identify the incident. The Authority is of the opinion that the area pointed out by the complainant could have been screened using a single camera angle; had the incident been more precisely timed, that timeframe could have been applied to the additional camera angles. In this regard, the Data Protection Authority has emphasized that the central aisle at Kongens Nytorv Metro Station is long and open, where, with just a few or even a single camera angle, it would be possible to pinpoint the time of the incident and thereby identify the individual. It cannot therefore be determined, based on either objective or subjective criteria, that the complainant’s request for access would constitute an abuse as referred to in Article 12(5) of the General Data Protection Regulation. The time required alone cannot constitute an abuse, and Metro Service has not otherwise demonstrated that the request for access was submitted outside the purposes set forth in EU legislation, nor has it demonstrated that the complainant had an intent that would conflict with those purposes. In light of this, the Danish Data Protection Agency does not find that Metro Service has demonstrated that there are grounds to reject the request on the basis that it is manifestly unfounded or excessive, see Article 12(5)(b) of the General Data Protection Regulation. 3.3 Regarding Metro Service’s reference to public safety. The Danish Data Protection Agency emphasizes that the restriction in Section 22(2) of the Data Protection Act requires a specific balancing of the conflicting interests, and that, as a general rule, this must be conducted separately for each piece of information, with the result that the data controller may only withhold the information regarding the processing that is covered by the conflicting public or private interests. This exception cannot, therefore, be applied generally and should only be applied where a specific balancing of interests has led to the conclusion that the consideration of overriding public interests outweighs the data subject’s interest in accessing their personal data. The Danish Data Protection Agency must therefore emphasize that the Agency’s decision of June 18, 2019[8], cannot be invoked as a general exception to the obligation to grant access, but must be viewed solely as an expression of a specifically assessed exception to the general rule that access must be granted. In this case, the Danish Data Protection Agency has taken into account that Metro Service refers to considerations of public safety and order as part of its email correspondence with the complainant. The primary consideration given weight is that it must not be possible to reveal blind spots. However, this case does not concern the identification of blind spots, but rather the opposite—namely, the recording of a specifically described active situation in a given area, which, according to the information provided, could have been covered by multiple cameras. The Danish Data Protection Agency has further emphasized that, in this specific case, no footage of the situation has even been found; therefore, the specific assessment regarding the given camera position and the public safety considerations that the specific camera angle and position might entail, weighed against the data subject’s rights, has not been carried out. In conclusion, the Danish Data Protection Agency finds that the complainant has specifically outlined the circumstances surrounding [the sequence of events and the purpose of the request for access]. Based on this, the Danish Data Protection Agency finds that Metro Service has not demonstrated circumstances that would indicate that the necessary specific balancing of the separate interests has taken place, which is sufficient to allow the exceptions in Section 22, paragraph 2, to be invoked. 3.4. Regarding the deletion of CCTV footage It is the Danish Data Protection Agency’s view that the principle of transparency set forth in Article 5(1)(a) of the General Data Protection Regulation, in conjunction with the data controller’s ability to respect the data subject’s rights, requires that a data controller implement measures enabling personal data—even temporarily—to be retrieved and retained in connection with requests for access. This is particularly important in cases where, due to a specified retention period, the personal data would otherwise have to be deleted before the request for access has been fully processed, because in such cases the deletion —in effect—would make it impossible to grant access to the personal data.[9] When a data subject has requested access to information about themselves and thereby exercised their rights under Article 15, and the data controller does not comply with the request, the data controller is —in the opinion of the Danish Data Protection Agency—is, as a general rule, obligated to ensure that the data subject can still exercise their rights under Section 39 of the Data Protection Act and Article 79 of the General Data Protection Regulation.As a general rule, the data subject must have the opportunity to exercise his or her right to lodge a complaint with the Danish Data Protection Agency regarding the failure to comply with the request, cf. Section 39 of the Data Protection Act, or to bring the matter before a court, see Article 79 of the General Data Protection Regulation, with a view to ordering the data controller to comply with the data subject’s request. It is the opinion of the Danish Data Protection Agency that it is contrary to the principles of lawfulness, fairness, and transparency set forth in Article 5(1)(a) of the General Data Protection Regulation if the data controller deletes information about the data subject immediately or shortly after the data subject’s request for access is denied, as the data controller thereby effectively deprives the data subject of the opportunity to have the Data Protection Authority and the courts verify whether the data subject is entitled to access the information. The Danish Data Protection Agency assumes—in accordance with Metro Services’ explanation—that CCTV footage recorded by Metro Services is deleted after 30 days: Since the footage is deleted after 30 days, at the time of the complainant’s request for access, only CCTV footage from [prior to the period for which access was requested] should have been deleted, and thus not for the days covered by the request for access. The Danish Data Protection Agency therefore finds that Metro Services—following the complainant’s inquiry—should have identified the relevant CCTV footage from the period between [the specified 10-day period] and subsequently retained it, in accordance with Metro Service’s own statements regarding its internal guidelines on the deletion of CCTV footage. The Danish Data Protection Agency notes that such information, after the otherwise established deletion deadline has passed, may be retained for the sole purpose of fulfilling a specific request for access. However, the Danish Data Protection Agency must emphasize that if other data subjects appear in the recordings, they must be taken into account—in part because complainants requesting access are only entitled to receive information about themselves. It is up to Metro Service itself to implement technical measures—such as audio and/or video editing tools that enable, for example, “masking” and/or scrambling—in order to comply with a request for access, and to ensure that personal data concerning others is processed only for a period that is relevant and limited to the original purpose.[10] The Danish Data Protection Agency finds that Metro Service A/S, by deleting the CCTV recordings —after receiving the request for access—unlawfully deprived the complainant of the opportunity to have the Data Protection Authority or the courts determine whether the complainant was entitled to access the information. The Danish Data Protection Agency must therefore—on the whole—pursuant to Article 58(2)(b) of the General Data Protection Regulation, issue a serious criticism of Metro Service, for failing to respond to the complainant’s request for access in accordance with Article 5(1)(a), Article 12(2), Article 12(5)(b), and Article 15 of the General Data Protection Regulation; and that Metro Service’s subsequent deletion of the data did not comply with the provisions of Article 5(1)(a) and Article 15 of the General Data Protection Regulation, see Section 39 of the Data Protection Act and Article 79 of the General Data Protection Regulation. [1] Regulation (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). [2] Act No. 502 of May 23, 2018, on supplementary provisions to the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the Data Protection Act). [3] Bill No. 68, FT 2017/18, the specific comments on Section 22 of the bill [4] C-526/24 – Brillen Rottler, Paragraph 35. [5] C-526/24 – Brillen Rottler, Paragraphs 35, 36, and 40, and C-416/23 – Österreichische Datenschutzbehörde, Paragraph 59. [6] EDPB Guidelines 01/2022 on the rights of data subjects—the right of access, version 2.1, adopted on March 28, 2023, Section 6.1. [7] Recital 63 of the General Data Protection Regulation [8] Decision of the Danish Data Protection Agency dated June 18, 2019, Case No. 2018-832-0009 [9] EDPB Guidelines 01/2022 on the Rights of Data Subjects—the Right of Access, Version 2.1, adopted on March 28, 2023, Section 2.3.3. [10] EDPB Guidelines 3/2019 on the use of video equipment for the processing of personal data, version 2.0, adopted on January 29, 2020, para. 94 The Danish Data Protection Agency Carl Jacobsens Vej 35 2500 Valby Tel. 33 19 32 00 dt@datatilsynet.dk About Us About the Danish Data Protection AgencyPressWebsitePrivacy PolicyAccessibility Statement Quick Links Guidance on the GDPRFile a Complaint with the Danish Data Protection AgencyCall UsNewsletterThe National Whistleblower Scheme Follow us The Danish Data Protection Agency on LinkedIn SearchSearch Clear Load More The Danish Data Protection Agency issues serious criticism of Metro Service Date: October 27, 2026 Decision Private Companies Serious Criticism Complaint Right of Access CCTV Surveillance Exercise of Rights The Danish Data Protection Agency has issued a decision in a case where Metro Service refused to grant a citizen access to CCTV footage. The decision is relevant to all data controllers as an example of how the right of access must be observed when using CCTV. Case number: 2025-31-2353. Summary The Danish Data Protection Agency has issued a decision in a case where a citizen complained that Metro Service had refused to grant access to CCTV footage from Kongens Nytorv station in connection with a specific incident the citizen had experienced. In their request for access, the complainant had provided a general description of their appearance and details regarding specific aspects of the incident. However, due to the complainant’s personal circumstances, the incident could not be pinpointed more precisely than a 10-day period between 12:00 a.m. and 6:00 a.m. Metro Service had refused to grant the request for access, citing that it was not possible to identify the complainant, that responding to the request would be unduly time-consuming, and that public safety considerations meant that CCTV footage could not be disclosed in certain cases. Metro Service further stated that the company is reluctant to grant access to CCTV footage, as this could lead to the disclosure of blind spots. In the period following Metro Service’s notification to the complainant of the denial of the request for access, the relevant CCTV footage was deleted. The Danish Data Protection Agency Issues Serious Criticism The Danish Data Protection Agency found that Metro Service could not refuse to grant the complainant access to CCTV footage on the grounds of lack of identification, excessive time consumption, and public safety concerns. In its decision, the Data Protection Authority noted that the right of access is the general rule, and exceptions to this rule require documented and specific balancing of interests. The Authority assessed that Metro Service had not sufficiently demonstrated that it had conducted a specific balancing of the various interests to justify applying an exception in this particular case. Furthermore, the Danish Data Protection Agency found that Metro Service’s subsequent deletion of the material had been carried out in violation of data protection regulations. The Authority emphasized, among other things, that Metro Service had unlawfully deprived the complainant of the opportunity to have their right of access to the information reviewed by the Danish Data Protection Agency and the courts. In its decision, the Danish Data Protection Agency ruled that information—which, according to the established deadlines, should have been deleted—may be retained for the sole purpose of fulfilling a specific and already submitted request for access. In this context, the Danish Data Protection Agency highlighted the relationship to any other data subjects captured in the recordings, as the data subject is only entitled to receive information about themselves. In such cases, it is up to the data controller to implement technical measures, such as audio and video editing tools, to be able to comply with a request for access while ensuring that personal data concerning others is processed only for the relevant period and limited to the original purpose. Overall, the Danish Data Protection Agency assessed that there were grounds for expressing serious criticism of Metro Services’ handling of the complainant’s request for access and Metro Services’ subsequent deletion of the recordings. Data Controllers’ Compliance with the Right of Access in CCTV Surveillance Under the General Data Protection Regulation (GDPR), the individuals whose data you process have the right to access the information you process about them. Data subjects who request access must therefore receive a copy of the information being processed about them. This also applies when the processing of personal data takes place in connection with CCTV surveillance. A data controller responsible for processing personal data through CCTV surveillance cannot conclude that there is reasonable doubt regarding the data subject’s identity if the total amount of information provided about a specific natural person sufficiently identifies that person. The fact that responding to a request for access is time-consuming cannot, on its own, serve as the basis for determining whether the data subject is abusing the exercise of their rights. If, as a data controller, you wish to use technologies—such as video surveillance—to support your organization’s processing of personal data, the technology must not hinder the observance of data subjects’ rights. In general, it will not be permitted to use technological support for the processing of personal data that, in and of itself, makes it impossible to retrieve such data for the purpose of ensuring the data subjects’ rights. If a request for access cannot be granted, it is the data controller who must be able to document why the request for access is being denied. Decision The Danish Data Protection Agency hereby returns to the case in which [the complainant’s representative] on [date] 2025—on behalf of [the complainant]—lodged a complaint with the Authority alleging that Metro Service A/S (hereinafter “Metro Service”) had refused to grant access to CCTV recordings of the complainant. 1. Decision The Danish Data Protection Agency strongly criticizes the fact that Metro Service’s handling of the request for access did not comply with the provisions of the General Data Protection Regulation[1], Article 5(1)(a), Article 12(2), Article 12(5)(b), and Article 15 of the General Data Protection Regulation; and that Metro Services’ subsequent deletion of the material did not comply with the provisions of Article 5(1)(a) and Article 15 of the General Data Protection Regulation, see Section 39 of the Data Protection Act[2] and Article 79 of the General Data Protection Regulation. Below is a detailed review of the case and a statement of reasons for the Danish Data Protection Agency’s decision. 2. Statement of Facts The case file shows that on [27 days after the first day covered by the request], the complainant requested Metro Service to grant access to CCTV footage recorded at Kongens Nytorv Metro Station. The complainant’s request for access states that: “[…] The requested video recordings relate to a specific incident that is believed to have taken place during [a 10-day period]. The specific date is unknown, but our client states that the incident took place in the late night/early morning hours between 12:00 a.m. and 6:00 a.m. During the aforementioned incident, our client [specific sequence of events described]. To help identify the recordings/images, our client [description of the complainant’s appearance]. We request that the video recordings and/or images in question be provided from the metro company’s video surveillance system, in accordance with Article 15(3) of the General Data Protection Regulation. As mentioned above, [the complainant] was [description of the sequence of events]. We are interested in surveillance footage and/or images from the video surveillance system, starting from the moment [description of the point in the sequence of events for which access is requested]. Please also ensure that the video surveillance footage from the aforementioned incident is preserved so that it is available for a potential investigation. […]” On [32 days after the first day covered by the request], Metro Service refused to grant the request for access to the CCTV footage, citing the following reasons: “[…] We at Metro Service have received your inquiry forwarded from MetroSelskabet. The information you have provided is insufficient to identify your client in our CCTV footage. There are a great many people who take the metro every day, and there are a great many who fit [the complainant’s description]; this is of no help [...].” The complainant contacted Metro Service again [later that month] and referred to the additional information regarding the incident. Metro Service upheld its denial of the request for access the [following day] with the following explanation: “[…] We assess that it is not possible to identify the person in question based on the information provided; the description is simply too generic, furthermore, we are also cautious about releasing video footage to anyone other than the police, out of consideration for ensuring public safety and order, as it must not be possible to expose blind people. […]” 2.1. Metro Service’s Comments Metro Service has generally stated that it deletes CCTV footage after one month, which is why the footage had been deleted by the time the request was received. Metro Service further considers the physical description provided by the complainant to be insufficient to identify the individual in question. In this regard, Metro Service notes that it has a total of [X] cameras at Kongens Nytorv Station, where a total of [Y] hours of footage would need to be reviewed. This would amount to a total of [XxY] hours of work for Metro Service. Metro Service has further stated that it is not possible to fast-forward through the footage at more than four times the normal speed, as the video will begin to stutter. Metro Service does not dispute that the matter was of particular significance to the data subject, but maintains that the refusal of the request for access is based, in part, on the fact that the CCTV footage had been deleted and, in part, on the inability to pinpoint the exact time of the incident. On [date] 2025, Metro Service issued the following statement regarding the case: “… Metro Service is responsible for the operation of the Copenhagen Metro. Please note that Metro Service deletes video footage after one month, which is why it had been deleted by the time we received the request. Furthermore, it should be noted that the description is insufficient to identify the individual “[description of the complainant’s appearance reproduced]” within a period of [Y] hours. Metro Service needs to receive the request within a relatively short time so that we can save the footage before it is deleted, and we need to know the exact time of [the incident] so that we can review our CCTV archive for footage to identify the individual in question. A period of [Y] hours of surveillance footage is too extensive for Metro Service to review. Metro Service notes that the video footage related to the incident has been deleted, as video footage from stations is only stored for 30 days. Metro Service further upholds its denial of the request for access, which is somewhat irrelevant since the video footage had already been deleted. Metro Service does not dispute that [the incident the complainant experienced] is a matter of particular significance to the complainant. The reason for the denial is the lack of surveillance footage, as well as the inability to pinpoint the exact time of the incident.” On [date] 2025, Metro Service issued the following statement regarding the case: “The incident occurred during [a 10-day period] between 12:00 a.m. and 6:00 a.m. The inquiry was forwarded to Metroselskabet, which received it on [27 days after the first day covered by the request] and forwarded it to us at MetroService on [30 days after the first day covered by the request]. “The customer” received a response on [32 days after the first day covered by the request], in which the request was denied on the grounds that the information provided was insufficient to locate the person in question. The denial could have noted that the recordings had been deleted by that time, since more than 30 days had passed between the date the recordings were made [first day covered by the request] and the receipt of the request for access [the date the request was forwarded to Metro Service]. Later that month, the “customer” followed up. This inquiry is answered the following day (with a new denial)—the denial should probably have stated that the matter was so old that the surveillance footage was no longer available; this might have closed the case at that point. The [Y] hours of surveillance footage would have to be reviewed for [X] cameras located in the center aisle, meaning there were [XxY] hours of surveillance footage. However, all of it had been deleted by the time the request was received. It is true that the playback speed can be increased slightly, but as soon as it reaches 4x speed, the video will become choppy, making it impossible to identify the incident. If the individual [was involved in the incident], they must [have documentation] containing [relevant details]. It is puzzling why this was not submitted within a few days instead of such a vague description more than a month later. The recordings had already been deleted at the time the request was received on [30 days after the first day covered by the request]. Therefore, it was impossible to take steps to secure the recordings.” 2.2. The Complainant’s Comments The complainant has generally stated that they have narrowed down the incident to such an extent that it is possible to identify the data subject, and that the sequence of events was conspicuous and unusual to such an extent that the incident could be identified through a targeted review of a few key camera angles, without the need for a systematic review of all footage from the specified period. On [date] 2026, the complainant submitted the following statement regarding the case: “In the present case, the incident was narrowed down to: a precise location (the long, open central aisle at Kongens Nytorv Metro Station), a narrow time frame (the night hours from 00:00 to 06:00), and an unusual and distinctive sequence of events, in which [description of the sequence of events]. This information made it possible to identify the incident through a limited and targeted review of the surveillance footage. […]” […] Metro Service has argued that identification would require reviewing a very extensive amount of footage and would therefore be disproportionately burdensome. However, this assessment is based on a flawed premise. The incident took place in a long, open hallway without any visual barriers, and the reported sequence of events—[description of the incident]—would be clearly evident upon reviewing a limited number of camera angles. In this regard, it should be noted that the incident cannot be expected to have been captured by a single camera alone. Since the complainant also [description of the sequence of events], the sequence of events must necessarily have been recorded successively from multiple camera angles along the route through the station. […]” The complainant has further stated that the very purpose of the request for access was to shed light on the incident, including for the purpose of [the purpose of the request was to document the incident in order to exercise a right]. It has therefore not been possible for the complainant to obtain [other documentation of the incident] and thereby further specify the time frame for the request. The complainant has pointed out that Metro Service itself has referred to an internal policy regarding the deletion of CCTV recordings, which stipulates that recordings are deleted after 30 days. The complainant has further argued that all of the relevant recordings should therefore not have been deleted at the time of the request, since the recordings from [9 of the days in the period] were not 30 days old, and that Metro Service was informed on [30 days after the first day covered by the incident] and [later the following month] that the recordings were to be retained for the purpose of a possible investigation. At no point in the complainant’s correspondence with Metro Service was it stated that the recordings had been deleted. The complainant first became aware that the recordings had in fact been deleted in connection with the Danish Data Protection Agency’s consultation letter dated [date] 2025. In conclusion, the complainant states that the rejection of a request for access on grounds of public safety requires a specific and documented balancing of interests, that Metro Service has not demonstrated that there is an imminent risk of significant harm, and that Metro Service itself has acknowledged that the incident is of particular significance to the complainant. 3. Rationale for the Danish Data Protection Agency’s Decision Article 4(1) of the General Data Protection Regulation states that “personal data” means any information relating to an identified or identifiable natural person (“the data subject”); “identifiable natural person” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. According to Article 5(1)(a) of the General Data Protection Regulation, personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject. It follows from Article 15(1) of the General Data Protection Regulation that the data subject has the right to obtain confirmation from the data controller as to whether personal data concerning him or her are being processed, and, if so, to access the personal data and other information specified in subparagraphs (a) through (h) of that provision. In addition, the data subject has the right to receive a copy of the personal data processed by the data controller, see Article 15(3). Data subjects who request access must therefore—as a general rule—receive a copy of the information being processed about themselves. If personal data is processed as part of CCTV surveillance, data subjects will therefore—in connection with the response to a request for access—as a general rule receive a copy of the video recordings (including any audio recordings) in which the data subject appears. It follows from Article 12(2) of the General Data Protection Regulation that the data controller is responsible for facilitating the exercise of the data subject’s rights. In the cases referred to in Article 11(2), the data controller may not refuse to comply with the data subject’s request to exercise their rights under Articles 15–22, unless the data controller demonstrates that it is unable to identify the data subject. When a data subject exercises his or her rights, Article 12(3) of the General Data Protection Regulation requires that a request be answered without undue delay and no later than one month after receipt. If there is reasonable doubt as to the identity of the natural person making a request, the data controller may request additional information necessary to verify the data subject’s identity, see Article 12(6) of the General Data Protection Regulation. It follows from Section 22(1) of the Data Protection Act that Article 15 of the General Data Protection Regulation does not apply if the data subject’s interest in the information is deemed to be outweighed by overriding legitimate interests, including the interests of the data subject themselves. There may thus be cases where a data controller is not obligated to provide a copy of the information being processed about a data subject or to disclose the source of the personal data. The specific comments[3] on Section 22(1) of the Data Protection Act state, among other things, the following: “The use of the term “crucial” in the provision indicates that an exception to the duty to provide information and the right of access may only be made where there is an imminent risk that the interests of private individuals will suffer significant harm.” The application of, among other provisions, Section 22(1) of the Data Protection Act, which limits the data subject’s right of access, requires the data controller to conduct a specific assessment. 3.1 Failure to Identify the Data Subject If the data subject wishes to exercise their rights and, in that connection, provides the data controller with information that makes it possible to identify them, the data controller may not refuse to respond to the data subject’s request, unless it can be demonstrated that the data controller is still unable to identify the data subject. It is the opinion of the Danish Data Protection Agency that the right of access to personal data for a data subject under Article 15 of the Data Protection Act must be viewed in light of what is defined as personal data in Article 4, No. 1, and which can be attributed to the natural person making the request. It is therefore—including in the case of video and image material—necessary to consider all relevant descriptive elements provided regarding the circumstances under which the data was created, in order to genuinely assess whether the information relates to the data subject, cf. Article 12(6) of the General Data Protection Regulation. Furthermore, it is the Danish Data Protection Agency’s view that, for requests for access that cannot be shown to be manifestly unfounded, it would normally not be in accordance with Article 5(1) (a) of the General Data Protection Regulation to reject the request solely on the basis of a description of the data subject’s appearance when there are additional factors that qualify the personal data in relation to the request for access. The presence of several other pieces of information would normally give rise to further investigations and, if necessary, contact with the data subject, as provided for in Article 12(6). After reviewing the case information, including the description of the complainant’s appearance and the circumstances under which the personal data in question was allegedly collected, the Danish Data Protection Agency finds that Metro Service has not sufficiently demonstrated that the complainant’s description did not allow for the identification of the complainant. The Danish Data Protection Agency has placed particular emphasis on the fact that it is not only the data subject’s appearance that is described, but the entire episode that took place, including [description of the incident]. Furthermore, the incident occurred at a time when the station is generally presumed to be less crowded. This, combined with the data subject’s other description, should be considered sufficiently specific and unique that—in the Data Protection Authority’s view—it is possible to identify the incident and the data subject involved. Against this background, the Danish Data Protection Agency finds that Metro Service, by rejecting the request for access solely on the grounds of the complainant’s failure to provide identification, has not complied with the requirements of Article 15 and Article 12(2) of the General Data Protection Regulation. 3.2 Regarding Excessive Time Consumption In exceptional cases, the data controller may either reject a request from a data subject or charge a reasonable fee for responding to the request if the request is manifestly unfounded or excessive. This follows from Article 12(5) of the General Data Protection Regulation. The burden of proof that a request is manifestly unfounded or excessive lies with the data controller, and the possibility of refusing to process a request must be interpreted strictly.[4] The assessment of whether a (first) request for access can be considered excessive and thus constitutes an abuse requires, on the one hand, certain objective circumstances that must demonstrate that the purpose of the request for access is contrary to the purpose of the right of access, and, second, a subjective element, whereby the data controller, based on the specific circumstances of the case, can demonstrate that there is an intent constituting an abuse.[5] As a general rule, the right of access shall not be restricted, subject only to the workload that complying with the request may impose on the data controller.[6] However, if the data controller processes a large volume of information, it may request that the data subject, before the information is provided, specify the information or processing activities to which the request relates.[7] It appears from the email correspondence between Metro Service and the complainant that Metro Service requested further clarification of the request for access, to which the complainant responded by clarifying the information regarding the incident that the complainant had at their disposal. In this context, it appears that the complainant had only limited information available [documentation of the incident], and it was precisely for this reason that the complainant wished to use the recordings in connection with [purpose of the request]. It also appears from the case file that the complainant is a particularly vulnerable individual who has been unable to recall the date on which [description of the incident] took place, which is why the request was broad in scope. In both of its responses to the complainant and statements to the Danish Data Protection Agency, Metro Service has, despite the description, maintained that identifying the incident to which the request for access relates would require an excessive amount of time and would therefore constitute an abuse. Metro Service has further noted that it is not possible to increase the video playback speed more than fourfold without the video becoming choppy, and that it would be necessary to review [X] cameras in the center aisle to comply with the request. The Danish Data Protection Agency does not consider it sufficiently substantiated why glitches in the video would make it impossible to identify [the incident]. Furthermore, the Danish Data Protection Agency must emphasize that a data controller who wishes to use a given type of technology, in this case, video surveillance, has an obligation to ensure that the processing activities entailed by the technology do not prevent compliance with the rules regarding the rights of data subjects. Thus, in general, it will not be permitted to use technological support for processing that, in and of itself, does not enable the retrieval of specific personal data. In this regard, the Danish Data Protection Agency has emphasized that clips in the video or missing frames will not make it impossible to identify a person who [description of the sequence of events]. Similarly, the Danish Data Protection Agency does not find that Metro Service has demonstrated that it was necessary to review [X] different cameras to identify the incident. The Authority is of the opinion that the area pointed out by the complainant could have been screened using a single camera angle; had the incident been more precisely timed, that timeframe could have been applied to the additional camera angles. In this regard, the Data Protection Authority has emphasized that the central aisle at Kongens Nytorv Metro Station is long and open, where, with just a few or even a single camera angle, it would be possible to pinpoint the time of the incident and thereby identify the individual. It cannot therefore be determined, based on either objective or subjective criteria, that the complainant’s request for access would constitute an abuse as referred to in Article 12(5) of the General Data Protection Regulation. The time required alone cannot constitute an abuse, and Metro Service has not otherwise demonstrated that the request for access was submitted outside the purposes set forth in EU law, nor has it demonstrated that the complainant had an intent that would conflict with those purposes. In light of this, the Danish Data Protection Agency does not find that Metro Service has demonstrated that there are grounds for rejecting the request on the basis that it is manifestly unfounded or excessive, see Article 12(5)(b) of the General Data Protection Regulation. 3.3 Regarding Metro Service’s reference to public safety. The Danish Data Protection Agency emphasizes that the restriction in Section 22(2) of the Data Protection Act requires a specific balancing of the conflicting interests, and that, as a general rule, this must be conducted separately for each piece of information, with the result that the data controller may only withhold the information regarding the processing that is covered by the conflicting public or private interests. This exception cannot, therefore, be applied generally and should only be applied where a specific balancing of interests has led to the conclusion that the consideration of overriding public interests outweighs the data subject’s interest in accessing their personal data. The Danish Data Protection Agency must therefore emphasize that the Agency’s decision of June 18, 2019[8], cannot be invoked as a general exception to the obligation to grant access, but must be viewed solely as an expression of a specifically assessed exception to the general rule that access must be granted. In this case, the Danish Data Protection Agency has taken into account that Metro Service refers to considerations of public safety and order as part of its email correspondence with the complainant. The primary consideration given weight is that it must not be possible to reveal blind spots. However, this case does not concern the identification of blind spots, but rather the opposite—namely, the recording of a specifically described active situation in a given area, which, according to the information provided, could have been covered by multiple cameras. The Danish Data Protection Agency has further emphasized that, in this specific case, no footage of the situation has even been found; therefore, the specific assessment regarding the given camera position and the public safety considerations that the specific camera angle and position might entail, weighed against the data subject’s rights, has not been carried out. In conclusion, the Danish Data Protection Agency finds that the complainant has specifically outlined the circumstances surrounding [the sequence of events and the purpose of the request for access]. Based on this, the Danish Data Protection Agency finds that Metro Service has not demonstrated circumstances that would indicate that the necessary specific balancing of the separate interests has taken place, which is sufficient to allow the exceptions in Section 22, paragraph 2, to be invoked. 3.4. Regarding the deletion of CCTV footage It is the Danish Data Protection Agency’s view that the principle of transparency set forth in Article 5(1)(a) of the General Data Protection Regulation, in conjunction with the data controller’s ability to respect the data subject’s rights, requires that a data controller implement measures enabling personal data—even temporarily—to be retrieved and retained in connection with requests for access. This is particularly important in cases where, due to a specified retention period, the personal data would otherwise have to be deleted before the request for access has been fully processed, because in such cases the deletion —in effect—would make it impossible to grant access to the personal data.[9] When a data subject has requested access to information about themselves and thereby exercised their rights under Article 15, and the data controller does not comply with the request, the data controller is —in the opinion of the Danish Data Protection Agency—generally obligated to ensure that the data subject can still exercise their rights under Section 39 of the Data Protection Act and Article 79 of the General Data Protection Regulation.As a general rule, the data subject must have the opportunity to exercise their right to lodge a complaint with the Danish Data Protection Agency regarding the failure to comply with the request, cf. Section 39 of the Data Protection Act, or to bring the matter before a court, see Article 79 of the General Data Protection Regulation, with a view to ordering the data controller to comply with the data subject’s request. It is the Danish Data Protection Agency’s view that it is contrary to the principles of lawfulness, fairness, and transparency set forth in Article 5(1)(a) of the General Data Protection Regulation if the data controller deletes information about the data subject immediately or shortly after the data subject’s request for access is denied, as the data controller thereby effectively deprives the data subject of the opportunity to have the Data Protection Authority and the courts verify whether the data subject is entitled to access the information. The Danish Data Protection Agency assumes—in accordance with Metro Services’ explanation—that CCTV footage recorded by Metro Services is deleted after 30 days: Since the footage is deleted after 30 days, at the time of the complainant’s request for access, only CCTV footage from [prior to the period for which access was requested] should have been deleted, and thus not for the days covered by the request for access. The Danish Data Protection Agency therefore finds that Metro Services—following the complainant’s inquiry—should have identified the relevant CCTV footage from the period between [the specified 10-day period] and subsequently retained it, in accordance with Metro Service’s own statements regarding its internal guidelines on the deletion of CCTV footage. The Danish Data Protection Agency notes that such information, after the otherwise established deletion deadline has passed, may be retained for the sole purpose of fulfilling a specific request for access. However, the Danish Data Protection Agency must emphasize that if other data subjects appear in the recordings, they must be taken into account—in part because complainants requesting access are only entitled to receive information about themselves. It is up to Metro Service itself to implement technical measures—such as audio and/or video editing tools that enable, for example, “masking” and/or scrambling—in order to comply with a request for access, and to ensure that personal data concerning others is processed only for a period that is relevant and limited to the original purpose.[10] The Danish Data Protection Agency finds that Metro Service A/S, by deleting the CCTV recordings —after receiving the request for access—unlawfully deprived the complainant of the opportunity to have the Data Protection Authority or the courts determine whether the complainant was entitled to access the information. The Danish Data Protection Agency must therefore—on the whole—pursuant to Article 58(2)(b) of the General Data Protection Regulation, issue a serious criticism of Metro Service, for failing to respond to the complainant’s request for access in accordance with Article 5(1)(a), Article 12(2), Article 12(5)(b), and Article 15 of the General Data Protection Regulation; and that Metro Service’s subsequent deletion of the data did not comply with the provisions of Article 5(1)(a) and Article 15 of the General Data Protection Regulation, see Section 39 of the Data Protection Act and Article 79 of the General Data Protection Regulation. [1] Regulation (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). [2] Act No. 502 of May 23, 2018, on supplementary provisions to the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the Data Protection Act). [3] Bill No. 68, FT 2017/18, the specific comments on Section 22 of the bill [4] C-526/24 – Brillen Rottler, Paragraph 35. [5] C-526/24 – Brillen Rottler, Paragraphs 35, 36, and 40, and C-416/23 – Österreichische Datenschutzbehörde, Paragraph 59. [6] EDPB Guidelines 01/2022 on the rights of data subjects—the right of access, version 2.1, adopted on March 28, 2023, Section 6.1. [7] Recital 63 of the General Data Protection Regulation [8] Decision of the Danish Data Protection Agency dated June 18, 2019, Case No. 2018-832-0009 [9] EDPB Guidelines 01/2022 on the Rights of Data Subjects—the Right of Access, Version 2.1, adopted on March 28, 2023, Section 2.3.3. [10] EDPB Guidelines 3/2019 on the use of video equipment for the processing of personal data, version 2.0, adopted on January 29, 2020, para. 94