In a judgment delivered on 5th October 2018, in the names of Maltapost plc vs Information and Data Protection Commissioner, the Maltese Court of Appeal (Inferior Jurisdiction) decided an appeal from a decision of the Maltese Information and Data Protection Appeals Tribunal.
In a 2015 decision concerning Maltapost's use of CCTV cameras on their premises, the Maltese Information and Data Protection Commissioner ("IDPC") had decided that generally, a maximum retention period of seven (7) days shall apply to CCTV footage, with an extension allowed only in exceptional cases. Following this decision, Maltapost appealed to the Data Protection Appeals Tribunal. The Tribunal agreed with Maltapost's argument that the retention periods imposed by the IDPC were too short and considering the sensitive nature of Maltapost's operations, the Tribunal approved, as a general rule, a two (2) year retention period with a possibility of extending this further in exceptional circumstances to seven (7) years. The Court of Appeal quashed the Tribunal's decision and in confirming the IDPC's original position on the matter, it emphasised the following:
- CCTV footage which identifies individuals can be considered processing of personal data;
- Personal data cannot be kept for a period longer than necessary;
- Generally, a maximum retention period of seven (7) days shall apply to CCTV footage, with extensions only allowed in exceptional circumstances. In fact, the Court of Appeal agreed with the IDPC's original decision that as an exceptional scenario, a retention period of only twenty (20) days could be allowed for CCTV footage capturing Maltapost's "Data Management System Area";
- Where CCTV footage is relevant to an investigation, a copy of the relevant extract of such footage may be retained until such investigation is concluded.
This document does not purport to give legal, financial or tax advice. Should you require further information or legal assistance, please do not hesitate to contact Mamo TCV Advocates.