Recital 8

(8)However, the SRB may be obliged to defer the information to data subject and other data subject’s rights to protect, in particular, its own security incident investigations involving the data from the video surveillance or access control systems.