Recreated source · decision excerpt
PDPC decision excerpt — the Access Obligation (section 21)
Faithful recreation of the highlighted excerpt from the Commission's written decision (MCST 4599). The original is a public PDPC decision; no personal identifying details were added.
Findings and Basis for Determination — the Access Obligation under section 21 of the PDPA
11. Section 21 of the PDPA (the “Access Obligation”) requires an organisation to provide as soon as reasonably possible, upon request by an individual, personal data about the individual that is in its possession or under its control.1 By the time the Complainant filed his complaint with the Commission on 4 May 2024, the CCTV Footage had been overwritten and was no longer in the Organisation’s possession or under its control. The Commission therefore was not able to make a determination on whether the Complainant should have been provided access to the CCTV Footage. Nevertheless, the Commission has made the following observations on the Organisation’s handling of the Access Request. In denying the Access Request, the Organisation sought to rely on the exception in section 21(3)(c) of the PDPA, which states that an organisation must not provide an individual with the individual’s personal data …