CCTV, a Personal Email and a Deletion Request

Do not send the clip to a personal email address. The request is informal, out-of-hours and not the correct channel. The officer should:

1. Verify identity: take the sergeant's name, station, Garda number and a contact number; say the request will be processed under the organisation's law-enforcement request procedure.
2. Preserve, do not delete: protect the original footage and note the camera, date/time range and incident. If the system overwrites after 30 days, export a copy now to the secure evidence store so it is not lost.
3. Notify the site manager/DPO/security manager and ask for the written request. A formal Garda request should come in writing or through the agreed contact point, not a personal email.
4. Make a working copy only with authorisation. Record who exported it, when, from which camera, to which device, and the hash/verification if the system provides one. Give the copy to the Garda through the proper channel and keep a receipt.
5. Do not edit or enhance the footage beyond normal playback; do not send it via personal phone or messaging app.

Reasoning: CCTV footage is personal data and may become evidence in a criminal case. An informal personal-email transfer risks data breach, loss of chain of custody and allegations of tampering. Cooperation with An Garda Síochána is important, but it must be documented. If the sergeant insists, the officer should refer him to the DPO/security manager and not handle it alone.

Do not delete it. The resignation does not erase the alleged theft or the need for evidence.

• The footage may be relevant to a criminal investigation, an internal disciplinary process, an insurance claim or a future civil claim. A 'litigation hold' or preservation instruction should apply once an allegation is made.
• The 30-day retention period is a maximum, not a command to destroy evidence earlier. Data protection law requires storage limitation, but it also permits retention where necessary for legal claims or a legal obligation. Deleting to protect the supervisor or the company could amount to obstruction or a data breach.
• The officer should politely refuse and explain: 'I cannot delete it; it has been preserved for the Garda/HR process.' Record the instruction, the time and the manager's words.
• Escalate immediately to the DPO, security manager or HR and, if the manager persists, to a more senior manager. If the officer is pressured, keep a copy of the request.
• The final decision on retention should be documented, with a review date. If HR needs a clip, provide a controlled copy through the proper procedure, not the original.

Key point: The officer's duty is to preserve evidence, not to help the company avoid embarrassment.

Records

• Shift log: operator name, licence number, shift start/end, system checks, cameras offline, visitors to the control room.
• Incident log: time 21:05, camera number, what was observed, who was notified, and the decision to preserve.
• CCTV export/access log: who requested the footage, authority, purpose, date/time range, camera, format, recipient, receipt, hash/verification, and who handled it.
• Garda request log: sergeant's details, time of call, advice given, written request received, disclosure authorised by whom.
• Data protection/retention note: preservation instruction, review date, deletion authorisation.
• Manager's deletion request: exact words, time, officer's response and escalation.

Risks of a blank log

• No evidence that the officer was on duty or that the footage was preserved lawfully.
• Weak chain of custody: the defence can argue the clip was edited, accessed by unauthorised people or not the original.
• Breach of PSA standards and GDPR accountability; the contractor may be unable to show lawful processing.
• The officer has no protection if the manager later denies giving the instruction.

Action: complete the log retrospectively only as a factual note, marked with the time of writing; do not pretend it was written contemporaneously. Report the blank log and the deletion request to the security manager/DPO.