March 01, 2019
In 2016, the Data Protection Commission issued guidelines in relation to the use of CCTV in the workplace.
These guidelines included a requirement for a written CCTV Policy to be put in place, and that Employers are required to perform assessments which show that any use of CCTV is justified within their Organisation.
Data Controllers should complete the following steps in line with the guidelines issued by the Data Protection Commission:
-
Conduct and evaluate a Risk Assessment process
-
Complete and review a Privacy Impact Assessment
-
Develop a written CCTV Policy covering the following areas:
-
The identity of the data controller;
-
The purposes for which data are processed;
-
Any third parties to whom the data may be supplied.
-
How to make an access request;
-
Retention period for CCTV;
-
Security arrangements for CCTV.
-
Develop a Data Protection Policy dealing with CCTV devices
-
Clearly demonstrate previous incidents that have led to security / health and safety concerns that may justify the use of CCTV within the workplace
The location of cameras should be a key consideration for all Employers too. The use of CCTV to monitor areas where Employees would have a reasonable expectation of privacy would be difficult to justify, for example in restrooms. To justify use in such an area, a Data Controller would have to demonstrate that a pattern of security breaches had occurred in the area prior to the installation of the system such as would warrant constant electronic surveillance. Where such use can be justified, the CCTV cameras should never be capable of capturing images from cubicles or urinal areas.
It is important to note that any person (i.e. an Employee, Customer, Client and/or a member of the public) that could be affected by the use of fixed CCTV in must be clearly informed by signs or notices warning of the fact that image recording is in operation in that area. The sign or note should also have contact details of the Controller to whom queries or subject access requests.
Once the above steps have been completed, the Employer should also assess whether or not CCTV cameras are likely to be used in a disciplinary matter. If so, the Employer should ensure that Employees are aware of the purpose of the collection of the data and clearly indicate this in their Policy.
In the event that CCTV footage is to be used for a disciplinary matter, Employers should note that the Employee is entitled to be given the opportunity to review the evidence in advance of a disciplinary meeting in order to allow them to prepare their defence.
A final important note for consideration around CCTV in the workplace is storage limitation. Storage limitation provides that the collected data, be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. This means that the data cannot be kept for a “just in case”, a problem arises in the future. Article 5(c) of the GDPR states that data must be "adequate, relevant and limited to what is necessary);”" for the purposes for which they were obtained.} A Data Controller needs to be able to justify this retention period. For a normal security system, it would be difficult to justify retention beyond a month, there are of course exemptions which can apply here however, for example in the case of a criminal or civil investigation.
Case Law:
In a recent case (Adjudication Reference: ADJ-00012025), a Complainant was awarded €5,000 after she claimed constructive dismissal after she discovered a hidden camera.
The Complainant returned to work after a period of annual leave and while left alone in the office, she discovered a hidden camera in a smart lever arch folder placed at the reception desk, taped to the wall and pointed in the direction of her desk with an intermittent flashing light.
She detected that the lens was positioned behind a hole in the folder. She examined the camera and was concerned it was recording. Neither the folder nor camera were in situ before she left for leave a week previously.
The Complainant confronted her employers and she was told the camera was installed to see couriers and patients coming in and out. The Complainant told the Hearing that this seemed illogical as the camera was pointed at her desk and not at the entrance. One of the Respondent(s) had called her "a stupid idiot" for getting upset, and the other Respondent disclaimed all knowledge of the camera's installation.
The Complainant said she was shocked at the Respondents reaction. She worked for the remainder of the day quite upset, stressed and shocked. On returning home and consulting with her family, she felt she could not return to work. Her doctor certified she was suffering from work-related stress, and the Complainant went on sick leave.
She felt the relationship of trust and confidence with her Employer had been irreparably damaged and she handed her notice to her Employers on advice from her GP and family.
The Respondent told the Hearing the camera was installed to monitor the comings and goings of strangers as the Employee would be by herself when they were away. He stated he regretted he did not advise her of the installation and apologised to her.
The Adjudication Officer deemed rejected the Respondent’s argument that the camera was installed to protect the Employee.
In the case of constructive dismissal, the burden of proof rests with the Complainant. The Unfair Dismissals Act, 1997, section 1 outlines a “dismissal” means:
“The termination by the employee of his contract of employment with his employer whether prior notice of the termination was or was not given to the employer, in circumstances in which, because of the conduct of the employer, the employee is or would have been entitled, or it was or would have been reasonable for the employee to terminate the contract without giving prior notice of the termination to the employer”.
So what does reasonable mean? The tests for constructive dismissal were set out by Lord denning, MR in Western Excavating (ECC) v Sharp (1978) IRL322, and repeatedly set out in subsequent complaints of constructive dismissal and described thus:
“conduct which is a significant breach going to the root of the contract of employment, or which shows that the employer no longer intends to be bound by one or more of the essential terms of the contract then the employee is entitled to treat himself discharged from any further performance”.
The reasonable test was expressed as:
“an employer who conducts himself or his affairs so unreasonably that the employee cannot be fairly be expected to put up with it any longer, the employee is justified in leaving”
In this instance, the Adjudication Officer decided that the complaint was upheld as the respondent’s actions in intending to operate a concealed surveillance system amounts to a breach of the implied term of trust and confidence, and that there was a fundamental or repudiatory breach going to the root of the contract, entitling the Complainant to resign and claim constructive dismissal.
Conclusion:
The above case law is a prime example of the importance of disclosing CCTV cameras to Employees and disclosing the justification for having these cameras in the workplace. Employers are of course permitted to have CCTV cameras on site, however they should consider whether or not the location of the cameras are reasonable. For example, using CCTV to detect intruders, vandals or thieves may be reasonable but using CCTV to constantly monitor employees would be intrusive and would only be justified in special circumstances.
The above guidelines, particularly a review of internal policies/procedures, risk assessment process and privacy impact assessment, should therefore be conducted and completely thoroughly to ensure, in the event of an issue arising, that as an Employer you can rely on the footage you have and be in a position to take the necessary steps you require.
The Data Protection Commission are currently in the process of reviewing their CCTV guidelines, amongst other guidelines, but it is strongly recommended that Employer’s adhere to the above whilst always bearing in mind the principles of data protection in line with current legislation.