Under GDPR, employers are entitled to monitor employee activity if they have a lawful basis for doing so and the purpose of their monitoring is clearly communicated to employees in advance-before any data is recorded the data subject must be warned. A system used to monitor the building for security purposes will usually be easy to justify. The use of CCTV systems in other circumstances – for example, to constantly monitor employees – can be more difficult to justify and could involve a breach of the Data Protection Acts. Should an employee object to the use of CCTV cameras in a particular area, the GDPR test  places the burden on the employer to demonstrate that it has “compelling legitimate grounds” for processing that override the employees’ rights, or for the establishment, exercise or defence of legal claims.

Employee monitoring by CCTV surveillance should be confined to those areas where the risk of infringing employees’ privacy rights is low. The use of CCTV cameras that constantly monitor a select group of employees in a particular area are more likely to be deemed intrusive than those that monitor all employees in a general entrance area.

There should be signs telling the employee where the cameras are located
• easy to read,
• well lit,
• positioned in places, where they can be easily seen.
• There should be some contact details for the person/organisation which is processing of the data (owner of the premises, security company).

The employer must clearly state the reason for using CCTV if it’s not obvious. The purpose of CCTV should be clearly communicable to employees by way of Privacy Notice. In line with the GDPR requirements, employers are under a duty to employees to make this clear and unambiguous.

The general assumption for CCTV usage in the workplace is for security purposes, but the use for monitoring employee performance or conduct is not an obvious reason. Therefore, employees must be clearly given notice prior to having their personal data recorded for this purpose. Also, when CCTV is installed for health and safety reasons, this should be made known to the employees.

Employers should have a written CCTV policy, which includes the following information:

• The identity of the company holding the CCTV footage,
• The reasons why CCTV footage is being used,
• Any third parties the footage may be given to,
• How you can request to see the footage held of you,
• How long the footage can be held for,
• How the footage will be secured

Employers must have a valid reason to use CCTV to monitor the workplace. They must also consider whether the use of the CCTV is reasonable. For example, using CCTV to constantly monitor employees could be intrusive and would only be justified in special circumstances, as opposed to using CCTV to detect criminal behaviour.

Covert surveillance-collecting someone’s data or monitoring them without them knowing -is only allowed in very special circumstances, where the data will be used to detect, prevent or investigate crime or to apprehend and prosecute offenders. This practice is generally forbidden:

• It is only justified if the employee or the workplace are relevant to a criminal investigation.
• Covert surveillance must be focused and can only last for a short period of time. If no evidence is found within a reasonable, but short period of time, the employer should stop the covert surveillance.
• A specific written policy must be put in place to allow for covert surveillance.  It must detail the purpose and justification for reaching for this method and provide details of the procedures, measures and safeguards that will be implemented while this type of surveillance is ongoing.

Ultimately, the final objective of the covert surveillance should be the involvement of An Garda Siochana or other prosecution authorities who can investigate any alleged criminal offences.

The location of cameras is a key consideration. Use of CCTV to monitor areas where employees or any individual would have a reasonable expectation of privacy would be difficult to justify. Toilets are an obvious example. To justify use in such an area, the employer would have to demonstrate that a pattern of security breaches had occurred in the area prior to the installation of the system such as would warrant constant electronic surveillance.

The use of CCTV in disciplinary matters is a grey area, but the general position is that the use of CCTV in disciplinary matters is inadmissible unless there are exceptional or special circumstances justifying the surveillance. The employee should be notified in advance of the presence of the cameras and that the images may be used in disciplinary proceedings. Any use of CCTV must be proportionate and justifiably necessary.

Case-law:
1. Deegan v Dunnes Stores [2014] 2 JIEC 2506
EMPLOYMENT APPEALS TRIBUNAL

The respondent’s head of security told the Tribunal how he had arranged for two CCTV cameras, one in the retail area, and the other in the food preparation area, to be installed in the days before 25 September 2011. This was in response to a request from the store manager. He confirmed that the staff were not told of the installation of these cameras. The technician who had operated the CCTV alerted the witness to seven incidents involving the claimant on 25 September and a further incident on 27 September 2011.

The witness attended the store on 6 October 2011 at the request of the store manager and met the claimant, who declined the opportunity to be accompanied, for an investigation meeting the following morning. The witness was accompanied by the technician, the store manager and the store human resource manager.

The respondent’s store manager gave evidence in relation to the employee purchases policy. In that regard employees who purchase food on the premises should get their receipt signed by a store manager. The witness told the Tribunal that he became aware that there were serious breaches of company policy in the deli area of the store in relation to the employee purchases policy. Accordingly, CCTV cameras were installed. On viewing CCTV footage recorded on the cameras he invited the claimant to attend an investigation meeting on 7 October 2011. He gave evidence that the claimant was asked if she wished to have a colleague present with her when she came to the meeting room and she declined this offer. The claimant was shown CCTV footage and admitted to consuming food without payment. This was in clear breach of the employee purchases policy which the claimant had said she understood and in which she had received regular training.

The investigation meeting concluded and was followed approximately 15 minutes later by a disciplinary meeting conducted by the witness. The allegations were again put to the claimant who said that she knew that she had done wrong and was sorry. The claimant was informed that it was a very serious matter and she was suspended with pay pending a further disciplinary meeting scheduled for the following day, 8 October 2011. The witness told the Tribunal that he had no further involvement in the matter, he was going on annual leave and he handed the matter over to the assistant store manager known as (LM).
He gave further evidence that there was a general problem in the deli area concerning food being consumed without payment. There were issues with employees other than the claimant and they were all treated in the same manner.

(LM) gave evidence that she conducted the disciplinary hearing with the claimant on 8 October 2011. She told the Tribunal that she offered the claimant the opportunity of having a work colleague present at the meeting and this offer was declined. She gave evidence that she recounted the events of the investigation hearing and the first disciplinary hearing including the CCTV footage. She stated that the claimant confirmed that she understood the employee purchases policy and admitted to consuming food without payment. She said she was sorry and she knew what she had done was wrong. The meeting was adjourned for 10/15 minutes and then re-convened. The claimant was then informed that due to the seriousness of the breaches of the company’s policies and procedures her contract of employment was terminated with immediate effect. The claimant was given 7 days to appeal this decision and she did not exercise this right of appeal.

Claimant’s Case:
The claimant commenced working for the respondent company as a deli assistant on 18 September 2007. She accepted that she attended an induction training process and was provided with a copy of the company’s policies and procedures. She also received regular refresher training courses in relation to these procedures. She enjoyed her work and had a good rapport with the customers. She had no issues/difficulties in her workplace and worked alongside 8/9 other employees.

On 7 October 2011 while at her workplace she was called to attend a meeting with the Store Manager and the Human Resources Manager. She received no advance notification of this meeting. She was asked a number of questions in relation to purchasing and consuming food on the premises and confirmed that she understood the employee purchases policy. She was shown CCTV footage from her workplace area and admitted to consuming food without payment. She did not see any malice in her actions and described to the Tribunal that she would have eaten a chip, goujon or chicken wing. She told the Tribunal that food which is not purchased/consumed is thrown out at the end of each day. She told the Store Manager that she was sorry for what she had done.

She was told that she was suspended with pay and told to report for a further meeting at 11am on the following morning, 8 October 2011. She was due to report for work at 2pm that day and understood that she would receive a telling off at the meeting at 11am. She met with (LM) on the morning of 8 October 2011. She again admitted that she had done wrong. (LM) then left the room for a few minutes and returned informing her that she was dismissed from her employment. She told the Tribunal that she then became upset and left the workplace.

The Tribunal was provided with documentary evidence in relation to her efforts to secure alternative employment since her dismissal.

Determination
The Tribunal carefully considered the evidence adduced at the hearing. It was accepted that there was a consumption of food issue in the deli area for some time. Once this was highlighted to management the company’s method of dealing with this was to install covert CCTV cameras to monitor same. Once such footage was collated in this case the claimant’s actions were immediately investigated.

The Tribunal acknowledges the seriousness of the issue and the fact that the claimant admitted taking and eating the food. However, the Tribunal is of the view that the investigation and disciplinary process actually invoked by the company fell short of acceptable practice.

In those circumstances the Tribunal finds that the claimant was unfairly dismissed but is satisfied that she contributed by 2/3 to the fact of her dismissal. The Tribunal awards the claimant the sum of €8,800.00 under the Unfair Dismissals Acts 1977 to 2007.

The Tribunal also awards the claimant the sum of €511.98 this sum being the equivalent of two week’s pay under the Minimum Notice and Terms of Employment Acts 1973 to 2005.

2. The Cormac Doolin Case

Cormac Doolin, from Crumlin in Dublin, was disciplined after it was discovered a number of staff at Our Lady’s Hospice were taking unauthorised breaks during working hours. Judge Jacqueline Linnane ruled his rights under the Data Protection Acts were not breached during a criminal investigation.

The CCTV cameras were set up after the “disturbing” ¬discovery that the words “Kill all whites — ISIS is my Life” had been scratched on the wall of the Crumlin hospice staff break room. The Circuit Civil Court heard the Gardai had been called in and officers advised the hospice to view CCTV -coverage in connection with a criminal investigation.

Barrister Eddie N Walsh representing Doolin, said it was during this viewing that bosses at Our Lady’s Hospice discovered a number of its staff were taking the extra unsanctioned breaks. He said he had no problem with the CCTV being used in relation to the probe into the ISIS graffiti as it was a security matter, but he stated, that using this information — only viewed for a criminal probe — to take action against his client had been a break of his data protection rights. The fact that the additional information was recovered to take disciplinary action against Doolin was a breach of his rights under Irish data laws. He was appealing a decision of the Data Protection Commissioner. Judge Linnane said she did not believe there was a breach of data rights as the footage was viewed with the intent of solving a criminal matter and to identify who had written the graffiti.The judge said disciplinary action had been taken because Doolin and his colleagues were in an “unauthorised place at an unauthorised time”.

3. Case presented in the Annual Report of the Data Protection Commissioner of Ireland 2015-Supermarket’s excessive use of CCTV to monitor member of staff

A former staff member of a supermarket submitted a complaint to the Office of the Data Protection Commissioner regarding her employer’s use of CCTV. The complainant informed them that she had been dismissed by her employer for placing a paper bag over a CCTV camera in the staff canteen. She said that the reason for her covering the CCTV camera was that when she was on an official break in the staff canteen, a colleague styled her hair. The complainant also stated that the camera was placed in the corner of the staff canteen and there was no signage to inform staff that surveillance was taking place. She said that she was never officially advised of the existence of the camera nor had her employer ever informed her of the purpose of the CCTV in the canteen. In its response to our investigation, the supermarket informed us that the complainant was dismissed for gross misconduct, which occurred when she placed the bag over the camera in the canteen to prevent her actions being recorded and thereby breaching the store’s honesty policy as outlined in the company handbook. The supermarket owner informed us that the operation of CCTV 24 Annual Report of the Data Protection Commissioner of Ireland 2015 cameras within the retail environment was to prevent shrinkage, which can arise from customer theft, waste and staff theft. He stated that it was also used for health and safety, to counter bullying and harassment and for the overall hygiene of the canteen. In relation to the incident concerning the complainant, the owner informed us that, on the day in question, the store manager noticed some customers acting suspiciously around the off-licence area and that on the following day CCTV footage was reviewed. It was during the viewing of the footage in relation to suspicious activity in the off-licence area that he noticed the complainant putting a bag over the camera. Following an inspection by one of our Authorised Officers, we informed the supermarket owner that, in our view, there was no justification from a security perspective for having a camera installed in the canteen area. The complainant in this case declined an offer of an amicable resolution and she requested a formal decision of the Commissioner. The decision by the Commissioner in January 2015 found that the supermarket contravened Section 2(1)(c)(iii) of the Data Protection Acts, 1988 and 2003, by the excessive processing of the complainant’s personal data by means of a CCTV camera in a staff canteen. Data controllers are tempted to use personal information captured on CCTV systems for a whole range of purposes. Many businesses have justifiable reasons, usually related to security, for the deployment of CCTV systems on their premises but any further use of personal data captured in this way is unlawful under the Data Protection Acts unless the data controller has at least made it known at the time of recording that images captured may be used for those additional purposes, as well as balancing the fundamental rights of employees to privacy at work in certain situations, such as staff canteens and changing rooms.

4. López Ribalda and others v Spain

A recent judicial decision of the European Court of Human Rights has reinforced the importance of applying the proportionality principle under the current Data Protection Directive when assessing the lawfulness of using CCTV surveillance to monitor employees.

The ECtHR decision in López Ribalda and others v Spain held illegal an employer’s covert use of video surveillance in a chain of Spanish supermarkets and reaffirmed the principles of transparency, proportionality and lawful monitoring.

The background to the case concerned five supermarket workers who were being monitored by their employer for the purposes of investigating possible theft. The employer installed both visible and hidden cameras and communicated notice to its workers about the visible cameras only. Unaware of the covert cameras, all the workers suspected of theft were shown video footage capturing their involvement in misappropriating the employer’s goods. The five employees admitted involvement in the thefts and were dismissed on disciplinary grounds.

In the case before the ECtHR, the employees argued that the use of the covert video evidence in the unfair dismissal proceedings had infringed both their privacy rights and their right to a fair trial under the ECHR. The court rejected the fair trial claim but upheld the employees’ privacy claim finding that the Spanish courts had failed to strike a fair balance between the employees’ right to respect for their private life and the employer’s interest in protecting its property. The majority of the bench found that the employer’s rights could have been safeguarded if they had notified their employees in advance of the covert cameras.

The above is intended for information purposes only, and is not intended to be relied upon as legal advice. Please contact us on 01 – 676 3257 for advice specific to your needs. We, at Fitzsimons Redmond, are happy to discuss with you any questions and concerns you might have in relation to the use of CCTV in the workplace.

By Eva Mitchell, intern at Fitzsimons Redmond