Q
We have received a Subject Access Request (SAR) from a passenger that includes a request for CCTV footage from the vehicle. Do we have to provide this?
A
Complying with SARs can take significant time and resource, and requests for CCTV footage can complicate matters.
If an operator receives an SAR from a passenger (a data subject) that includes a request for CCTV footage, the likelihood is that it will have to comply with the request; however, data protection legislation does allow an exemption whereby CCTV may not have to be provided if, as is likely to be the case here, other passengers’ faces are visible in the footage.
This does not mean this exemption can be applied across the board to all SARs that include CCTV footage, as, if the following can be achieved, operators must still comply with the SAR: (i) the consent of the other passengers can be obtained; or (ii) it is reasonable to disclose the information.
If the consent of other passengers cannot be obtained, operators should consider if they can, for example, blur out the faces of other passengers.
If the consent of other passengers cannot be obtained, operators should consider if they can, for example, blur out the faces of other passengers
If this process can be done without significant cost and time being incurred, the SAR will have to be complied with, as this is likely to meet the “reasonable” threshold mentioned above.
If the other passengers’ faces cannot be effectively blurred, operators should consider whether there are other means of redacting the faces of other passengers.
The exemption under which CCTV may not have to be provided is not a blanket exemption but is a useful consideration if an SAR becomes excessive in terms of devoting resources to comply with the request.
That said, operators should still consider each SAR on a case-by-case basis and ensure data subjects are not denied access to other personal data when making a request that includes CCTV footage.
Q
Civil penalties for employing illegal workers increased recently. What are my obligations and how do I avoid a penalty?
A
On 13 February, the civil penalty for employing an illegal worker rose from £15,000 to £45,000 per employee for a first breach, and £20,000 to £60,000 per employee for a repeat breach (within three years).
To establish a statutory excuse against liability for a civil penalty, a right to work (RTW) check must be undertaken in accordance with Home Office guidance.
If an RTW check has not been undertaken and you are found to be employing an illegal worker, a civil penalty will likely be imposed.
You must therefore conduct RTW checks on all potential employees — to satisfy yourself the individual is allowed to work in the UK — and retain evidence of the checks that you have undertaken.
Do not make any assumptions about an individual’s RTW in the UK and treat all job applicants in the same way (to avoid any potential discrimination issues).
There are three ways to conduct an RTW check: a manual check (which enables operators to accept original documents from List A or List B of the government’s RTW checklist), an RTW check using identity document validation technology via the services of an identity service provider, and a Home Office online check (using a share code that can be input into the relevant gov.uk webpage).
If none of the above checks can be undertaken, operators can contact the Home Office employer-checking service.
You must retain evidence of the RTW check undertaken. The check must also be undertaken in the presence of the prospective worker (either in-person or via video call) and follow-up RTW checks should be diarised if necessary (for example, if a worker holds limited permission to remain).
[Answers by Laura Hadzik, Partner; Gemma Tracey, Partner; James Harvey, Solicitor]
- For a free legal consultation with JMW Solicitors, contact Laura Hadzik on laura.hadzik@jmw.co.uk/0345 450 7726
- Email your legal questions for future issues to routeone on editorial@route-one.net
