What to do if someone asks for camera footage: customers, neighbors and insurers

First step: secure the recording

Whoever asks, the first thing to do is prevent the recording from being deleted. Recorders overwrite the oldest recording when the disk is full. If you do not export the relevant time range and copy it to a safe place on the day the request arrives, the footage can be lost a few days later.

When exporting, also take a few minutes before and after the incident. Check whether the device clock is correct; if it is wrong, write the difference in a note. Also record who made the copy and when. This information will help you if the request later turns into an official process.

Do not keep the copied recording on a computer that everyone can access or in a messaging group. Unauthorized people reaching the recording may count as a separate data breach.

If the person visible in the recording asks for their own footage

Law No. 6698 on the Protection of Personal Data gives a person the right to ask for information about data processed about them. A customer who fell and got hurt in your store, or an employee involved in an argument, may want to see or get the recording of that moment. This is treated as a data subject request.

The request is expected to be made in writing or by the methods set by the Personal Data Protection Board. As the data controller, the business must answer the request within thirty days at the latest. Do not hand over a recording without verifying the requester's identity. Also file the request and your answer; if a complaint comes up later, you may need to show how you handled the process.

If other people are also visible in the recording, their images are not given to the requester. Either a copy is given with the other faces blurred, or the person is allowed to view the recording at the business. If this is not technically possible, consult a legal expert about what to do.

Expert note: Ask your installer whether your recording system has a face blurring or area masking feature when exporting. This feature makes answering data subject requests much easier.

If a neighbor or another third party asks

This is the most common situation: the neighbor's car was scratched at night, your camera sees the street, and they ask for the recording. Or the window of the shop across the street was broken. Sending the recording by phone with good intentions seems easy but is risky. The recording also contains passersby, neighbors and license plates that have nothing to do with the incident.

The right way is to tell the neighbor to file a complaint with law enforcement and to secure the recording on your side. When law enforcement or the prosecutor's office officially asks for it, you hand over the recording. That way the footage stays in the hands of the people concerned with the incident and is used for a specific purpose.

Letting someone view a recording and giving it are also different things. Showing the neighbor the incident on screen and confirming that it was recorded is a more limited kind of sharing than handing over a copy. Even so, before making this decision, check who else is visible in the recording.

If an insurance company or an adjuster asks

If there was damage at your business and you need the recording for your own insurance, sharing the footage that shows the damage on your side is often part of your own claim. Here too, the right approach is to hide the other people visible in the recording and give only the time range related to the incident.

If someone else's insurance company, for example the insurer of a vehicle that had an accident in front of your business, asks for the recording, this request is like a third-party request. Do not give the recording without an official letter and a legal basis; if needed, refer the requester to law enforcement or the judicial process.

If one of the parties to an accident asks, as a driver, for their own footage, this is similar to a request from a person visible in the recording. But the other party's vehicle and plate are in the same footage too. If there is a dispute between the parties, giving the recording to one and not the other pulls you into the argument. In such cases, securing the recording and waiting for the official request is the safest way.

If law enforcement and the prosecutor's office ask

When the police, gendarmerie or the prosecutor's office asks for a recording as part of an investigation, you hand it over. Make sure the request is official, that is, check the officer's ID and that the request is made in writing or with a record.

Paying attention to the following during the handover prevents disputes that could come up later:

• Give the original file unchanged, in the device's own export format
• Include the player program with the file
• State the device clock difference in writing
• Have the record state which cameras and which time range were handed over
• Keep a copy for yourself
• Note the name and unit of the officer who received it

What not to do

However striking the incident is, do not share the recording on social media. Even if it is to identify a thief, spreading the footage can both violate the rights of other people in the recording and make a possible judicial process harder.

Sending the recording to messaging groups, having employees watch it and comment, or passing it around to find out who someone is carries the same risk. Only authorized people at the business should see the recording, and it should be shared only for a specific purpose.

Keeping recordings longer than necessary can also be a problem. Set the retention period with a written policy and delete the copies you set aside for the incident once the process is over.

Explain these rules to your employees too. A request for a recording often comes to an employee at the register or the door, and the employee may show the recording on their phone with good intentions. Making sure requests are always referred to the business owner or the designated person prevents uncontrolled sharing from the start.

What to do to be prepared

So you do not panic when a request arrives, prepare three things in advance. First, a list of the people who can access the recordings, with a separate user password for each. Second, at least two people who know how to export a recording. Third, the business's camera privacy notice and an address showing where data subject requests should be sent.

This article gives general information; we recommend getting support from a lawyer or a KVKK consultant for your business's specific situation. In the systems it installs, Desa Bilişim sets up user permissions and export and masking settings together with you at handover.

Frequently asked