No, if it has just come to light then the time to ask is now.
Do you have a CCTV / GDPR policy and does this 3rd party access contravene the existing regulations?
The first question is who did what with who and why. Then it will be possible to determine if any contraventions have occurred which will inform the decision making on what to do about it.
Could be a GDPR contravention which has implications for the data subjects - they may need to be informed and a self-declaration of data breach submitted by PC to ICO. If you get into that sort of territory then you are quite likely running a parallel disciplinary or restoring efficiency procedure.