CCTV In The Workplace & Data Privacy

The question often arises as to whether the monitoring of employees and workplaces by CCTV involves the processing of personal data and whether it is permissible under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018.

In the first instance, it is important to note the basic principle that footage captured by way of electronic recording through CCTV or otherwise that captures images of a private individual, would constitute that individual’s personal data pursuant to data privacy laws. On that basis, it is important that any such collection of CCTV footage meets the requirements of data privacy legislation and the GDPR. 

The first issue to consider is whether or not there is a legitimate basis for the employer collecting, controlling and processing that personal data, that is the CCTV footage. The typical grounds for justification would be if the employee consents or if the monitoring is necessary for the legitimate interests of the employer, for example in respect of security and preventing theft. Accordingly, the first requirement for an employer is that the employment contracts of all its employees are reviewed to ascertain whether or not employees have consented, and whether the data privacy policies specify that CCTV recording may take place.

Following that, employers need to be conscious of general principles applicable to the processing of personal data. With respect to CCTV, employers should assess any employee monitoring activities and ensure that:-

• the processing activity is necessary and there is a legal basis for the activity;
• it is proportionate to aim being achieved and to any concerns raised; and
• the monitoring is transparent to employees.

These are general principles required by that a privacy legislation, and the interpretation of whether an employer has complied with these basic principles is very much a question for each particular situation. For example, the requirement for transparency would require that employers clearly communicate to their employees the basis on which CCTV recording takes place. It is imperative that employees are aware that monitoring is taking place.

It is also important to ensure that the monitoring does not do anything that goes beyond what is necessary and proportionate in the circumstances. For example, CCTV systems that are legitimately installed for security reasons should not then be used to monitor an employee’s performance.  That would be disproportionate and unnecessary to protect against theft. It is also important to note that it may not be possible to utilise the CCTV footage in any disciplinary proceedings arising from any performance -related issues with respect to an employee. The CCTV footage should only be used for the specific purpose for which it was installed, that is for example security. By way of example, the footage could be used in respect of proceedings involving an employee accused of theft, however, it would be a lot more difficult to justify if there is an issue with an employee taking excessive breaks that the CCTV has happened to capture.

This will often be a balancing exercise for the employer.  The employer needs to balance the legitimate interests of the employer to protect its business as against the employees’ entitlement to privacy.