Click here to view this briefing in PDF format. 

The General Data Protection Regulation 2016/679 (GDPR) requires that personal data must only be processed for the purpose for which it has been collected.  While it is established that employers are entitled to monitor employee activity, they must have a lawful basis for doing so and the purpose of their monitoring must be clearly communicated to employees.  Applying the principles of the GDPR, any use of CCTV must be necessary and proportionate.

Applying the “necessary and proportionate” test, a monitoring system used for security purposes will usually be justifiable, while the use of CCTV to monitor employees is more likely to lead to a breach of data protection law.  Covert surveillance is permitted only in very limited circumstances including where footage is kept for the purposes of preventing, detecting or investigating offences, or apprehending or prosecuting offenders.

The Data Protection Commission has noted that employers are often “tempted to use…information captured on CCTV for a whole range of purposes” and while many have justifiable reasons for deploying CCTV systems “any further use of personal data captured in this way is unlawful under the Data Protection Acts unless the data controller has at least made it known at the time of recording that images captured may be used for those additional purposes as well as balancing the fundamental rights of employees to privacy at work in certain situations, such as staff canteens and changing rooms”. This rules out covert CCTV in most cases.

Justifiable use of covert CCTV in an employment context

In López Ribalda and others v Spain, the European Court of Human Rights stressed the importance of proportionality in assessing the use of CCTV surveillance to monitor employees.  The ECtHR overruled the Spanish courts, which had held that the covert use of CCTV by a chain of Spanish supermarkets was illegal.

The employer had installed both visible and hidden cameras and notified its workers about the visible cameras only.  Unaware of the covert cameras, workers suspected of theft were shown video footage capturing their involvement in misappropriating the employer’s goods. Five employees admitted involvement in the thefts and were dismissed on disciplinary grounds.

The lower chamber of the ECtHR upheld the employees’ privacy claim, finding that the Spanish courts had failed to strike a fair balance between the employees’ right to respect for their private life and the employer’s interest in protecting its property.  In its decision the Court stated that the employer’s rights could have been safeguarded had they notified employees of the use of covert cameras in advance.

This decision was appealed to the Grand Chamber of the ECtHR and in October 2019 the initial decision was reversed.  This decision was reported in more detail in our January briefing.  The Grand Chamber found that only an overriding requirement relating to the protection of significant public or private interests could justify the lack of prior information to employees.  While it did not condone the use of covert surveillance if there was only a suspicion of misappropriation, “the existence of reasonable suspicion that serious misconduct has been committed” could provide the necessary justification.  The extent of the losses in this particular case were also taken into account.  The Court also had regard to the fact that the specific remedies available to employees under data protection legislation had not been exhausted, insofar as they could have complained to their national data protection supervisory authority.

Recent High Court Decision

The High Court recently addressed this matter in Doolin v The Data Protection Commissioner [2020] IEHC 90.  Mr Doolin made an initial complaint to the DPC arising from his employment as a craftsman’s mate at Our Lady’s Hospice and Care Service in Harold’s Cross (OLHCS).  Following the discovery of threatening graffiti in a room at OLHCS, the Gardaí advised the employer to view CCTV footage of certain dates in November 2015.  The CCTV footage showed Mr Doolin’s unauthorised entry and exit from the room on the days in question.

Mr Doolin was then called to an investigation meeting under the employer’s disciplinary policy in relation to the taking of unauthorised breaks at work (i.e. not in relation to the graffiti issue).  At the meeting, Mr Doolin admitted unauthorised entry to the room in question and to taking unauthorised breaks from work.  He was disciplined by his employer in 2016.

Complaint to the Data Protection Commission

Mr Doolin subsequently claimed that his employer had unlawfully processed his personal data from the CCTV footage and made a complaint to the DPC.

At the time, the signage in OLHCS in respect of the CCTV cameras stated: “Images are recorded for the purposes of health and safety and crime prevention.”  Mr Doolin argued that his personal data was not processed by his employer using CCTV as part of the disciplinary matter but rather was viewed for its permissible use (to prevent crime and for staff safety) and then unlawfully further processed for the purpose of the disciplinary action.

The DPC held that while Mr Doolin’s images had initially been viewed in connection with a security incident, it did not consider that the subsequent viewing in relation to disciplinary proceedings against him constituted a different purpose.  Mr Doolin appealed this decision to the Circuit Court, which upheld the decision of the DPC.

Appeal to the High Court

Mr Doolin then appealed to the High Court.  The OLHCS argued that the findings of the disciplinary investigation panel were based on Mr Doolin’s admission and not on the CCTV footage.  However, the disciplinary investigation report produced by OLHCS explicitly stated it relied, among other things, on the CCTV footage as evidence.

In the course of the High Court appeal, the DPC revised its position to reflect the fact that there had been further processing of personal data, but that the further processing related to the original purpose (i.e. security reasons arising from unauthorised entry to the room in question).The High Court found “no evidence at all” to support this reasoning. It noted that “at no point in time did OLHCS ever justify the further processing of the material gleaned from the CCTV footage in the disciplinary proceedings on the basis of security concerns.”

By August 2016, OLHCS had amended its CCTV policy to state “If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff.”

The Court noted that had OLHCS intended the CCTV material to be used for disciplinary purposes as well as for the other reasons identified in its policy, this use should have been identified. The Court noted that if the new policy was in operation at the time of the graffiti incident “none of the above difficulties would have arisen.”

The High Court held that the prior decision of the Circuit Court was incorrect, finding no evidence for the conclusion that the use of CCTV footage in his disciplinary hearing was merely for security purposes.  It also ruled that the DPC had erred in law in maintaining there was no further processing of the complainant’s personal data in the disciplinary proceedings.

In summary while the avenues for employee redress remain distinct and the misuse of employee personal data may not always undermine the integrity of a fairly administered disciplinary process, employers should ensure that they comply with data protection principles when using CCTV.

In its CCTV Guidance for Data Controllers, the DPC has reminded organisations that they must ensure:

• They have a clearly defined purpose for installing CCTV cameras;
• They have a legal basis for installing CCTV under Article 6 of the GDPR;
• The use of CCTV is necessary to achieve their purpose;
• The use of CCTV is proportionate, meaning that it will not cause an unlawful and unreasonable intrusion on privacy;
• CCTV recordings will be kept securely;
• CCTV recordings will not be kept for any longer than is strictly necessary; and
• The use of CCTV will be transparent and the necessary information will be communicated to individuals.

In practice, employers should:

• Review and update their CCTV policy on a regular basis;
• Clearly communicate the locations of CCTV cameras and the reasons for using CCTV to employees by posting notices in the relevant areas and circulating the CCTV policy;
• Avoid the use of CCTV in areas where employees have a high expectation of privacy (e.g. changing rooms), and only focus on areas of particular risk (e.g. cash points);
• Not capture footage for one purpose and then use it for another. Only use CCTV to investigate disciplinary matters on a case-by-case basis where it is necessary and proportionate to do so; and
• Conduct a data protection impact assessment before deploying CCTV cameras on their premises.

Finally, some disciplinary infractions are also crimes reportable to the Gardaí and this may be relevant to the use of covert CCTV footage for a disciplinary process.