In the Data Protection Commissioner (DPC) Annual report one case study looks at the use of CCTV footage in a disciplinary process. The DPC were contacted by an individual who complained that their employer used CCTV footage as part of the disciplinary process which led to their dismissal. They said that this was a breach of their personal privacy and they were not given prior notice that CCTV footage could be used as part of the disciplinary process. The DPC conducted an investigation.
The individual was employed as a security officer. They were responsible for monitoring the CCTV system in a control room and safeguarding the client’s premises. This was the specific purpose of their contract of employment. The employee had been asked to read a set of ‘Standing Operating Procedures’ (SOP) which indicated that CCTV footage could be used in an investigative process and the employee was asked to sign a document to confirm that they had read and understood the responsibilities of their role.
As part of the contract with the client, the business was required to conduct routine audits of employee access cards. Whilst conducting one of these audits, the business spotted data irregularities in relation to the employee concerned. The data on their card differed from the employee’s fellow night officers’ and these irregularities did not arise from technical glitches. As a result of a further investigation, they identified that the employee had been absent from the control room for prolonged periods of time on several separate occasions.
When they invited the employee into an investigation meeting to give their version of events, the employee disputed the accuracy of the access card. The business felt it had no option but to obtain CCTV stills as it was the only independent way to verify the access card data. At a later stage in the investigation, the employee admitted that they had left the control room to go into another room to lie down so that they could get relief from back pain.
Based on the evidence of the employee’s access card, the CCTV footage and the investigative meetings with the employee, the employee was subsequently disciplined and dismissed from their role.
Data Protection Commissioner findings
The DPC spoke to both parties to see if the business had breached the privacy rights of the employee. The business advised that they had a legitimate interest to process the personal data from the CCTV footage which was based on a contractual obligation to ensure the client’s premises was properly safeguarded. If an adverse incident occurred due to a prolonged absence of the assigned security officer from the control room, this could leave the company exposed to a breach of contract. In addition, this would cause significant financial and reputational consequences for the business.
Under the Data Protection Act, a data controller can process an individual’s personal data on the basis of legitimate interest if the following conditions are met:
• there must be a legitimate interest justifying the processing;
• the processing of personal data must be necessary for the realisation of the legitimate interest;
• the legitimate interest must prevail over the rights and interests of the data subject.
The DPC were satisfied that the business had a legitimate interest for using the CCTV footage to investigate and verify if the employee had been absent for prolonged periods. They saw that the use of the CCTV footage was necessary and proportionate due to the seriousness of the allegation as it was the only independent method of verifying the accuracy of the access card data. They factored in the potential risk of damage to the business’s reputation and the need to ensure the security of its client’s premises. Based on these factors, the DPC found in favour of the business. In this case, the right to use CCTV footage took precedence over the employee’s right to privacy. Finally, the DPC were satisfied that the employee had received adequate notice that CCTV footage may be used for disciplinary procedures if necessary.
- Businesses should document the purpose for using CCTV footage.
- If they wish to rely on CCTV footage as evidence for a disciplinary investigation, they need to make this transparent to all employees.
- Businesses could take an additional step and ask employees to sign a declaration that they have read and understood their policy on the use of CCTV footage.
The monitoring of employees through workplace CCTV needs to be treated with caution. Whilst an employer has a legitimate interest in protecting the business through monitoring, a balance is needed between the legitimate rights of employers and the personal privacy rights of its employees. Before making the decision to monitor or use CCTV as a disciplinary tool, an employer should assess whether the same objectives can be achieved through other means first. Any monitoring activity should be transparent to workers, communicated to them and the use of monitoring needs to be fair and proportionate.
If you would like more information on putting together a CCTV policy or have any other HR issues your business may have, please contact Helen at SFA on 01 605 1668 or at firstname.lastname@example.org or visit the advice section on our website www.sfa.ie/advice