A commercial and residential property management company notified the DPC that an employee of a security company whose services they retained had used their personal mobile phone to record CCTV footage of two members of the public engaged in an intimate act, which had been captured by the management company’s security cameras.

The video taken was subsequently shared via WhatsApp to a limited number of individuals . The business advised the DPC that they communicated to staff who may have received the footage that they must delete it and requested no further dissemination of the video .

Both the property management company and the security company were able to demonstrate that adequate policies and procedures did exist, however appropriate oversight and supervision to ensure compliance with these policies and procedures were lacking .

Following recommendations made by the DPC to the property management company, the company has subsequently engaged with its staff to deliver further data protection training with an emphasis on personal data breaches . In addition, further signage was displayed prohibiting the use of personal mobile devices within the confines of the CCTV control room .