The lift-lobby clip that reached 180 phones
A residents' welfare association in a Mohali society of 412 flats asks for your help. A 47-second clip from a lift-lobby camera, recorded on 9 February at 21:14, appears to show a resident's domestic worker putting a mobile phone into a bag. The clip was copied by a security guard onto his personal phone, forwarded to the RWA WhatsApp group of 180 members, and from there to at least two other groups. The RWA secretary now wants you to (a) send a 'better, zoomed' copy to the neighbour who made the complaint, (b) keep the original footage 'until the matter is settled, maybe a year', and (c) post a still image on the notice board so residents 'know who to watch'. The camera also captures the doorway of the flat opposite, and the society's notice states only that CCTV is installed 'for security purposes'.
1. Analyse the three requests and the past handling of the clip against privacy and data-protection requirements, and say which you would refuse and why.
Read the worked answer
The society is a Data Fiduciary for this footage, and the guard's personal-phone copy is already an unauthorised disclosure and a security failure under the DPDP Act framework: purpose limitation, data minimisation, storage limitation and reasonable security safeguards are all engaged.
(a) Zoomed copy to the neighbour - refuse. The neighbour is a complainant, not an authorised recipient. Disclosure to a third party with no need-to-know has no lawful basis, and a 'zoomed' version is a derived, altered artefact with no provenance, no hash and no audit trail. If a criminal allegation is being made, the route is a written police request; the clip then goes out with a receipt and a chain-of-custody entry.
(b) 'Keep it a year' - refuse as framed, replace with a legal hold. Open-ended retention breaches storage limitation. The correct step is to preserve this one clip for a defined period, for a stated purpose, with a review date and a named custodian.
(c) Notice-board still - refuse outright. That is publication of identifiable personal data to an unrestricted audience, with defamation and even physical-safety risk, and the notice 'for security purposes' does not authorise it.
Also flag the framing. The camera also captures the opposite flat's doorway, so the footage contains third-party personal data that must be masked before any legitimate release, and the guard's handset copy should be collected or its deletion witnessed and documented.
2. Write the practical remedial plan you would put to the RWA, covering access control, release procedure and retention.
Read the worked answer
Access and handling
- NVR and client access on unique named accounts; the shared 'admin' login retired. Export function disabled for all but two named office-bearers.
- Personal phones banned in the control room; no photography of monitors. Guard briefings signed by each guard.
- An export register: date, requester, purpose, camera, time range, hash, recipient, signature. Nothing leaves the office without an entry.
Release procedure
- Written request only, stating purpose and legal basis; approval by the RWA managing committee; refusal where the purpose is gossip, 'awareness' or informal identification.
- Every release masked for third-party areas, watermarked, and accompanied by a short written note on what the clip does and does not show. Police requests handled in writing with a receipt.
Retention
- A stated retention period (for example 30 days rolling) written into the society's notice and signed at induction, with an exception route: a specific clip goes on legal hold for a defined period with a review date.
Governance and repair
- Update the CCTV notice to state purpose, retention and who to contact; set up a simple grievance route so residents do not escalate to WhatsApp.
- Document the existing spread of the clip for the record, ask the RWA to post a takedown request in the groups, and note the worker's right to raise a grievance - the association's exposure grows with every further forward.