Categories
Data Protection

The Use of CCTV in Disciplinary Hearings in the Workplace-Interesting High Court Decision (February 2020)

The conflict of rights in the workplace between employer and employee concerning the use of cctv in the workplace, and its use in disciplinary processes, was dealt with by the High Court in February 2020. The case was Doolin v The Data Protection Commissioner [2020] IEHC 90 and it was an appeal from the Circuit Court where Doolin, the employee, had lost.

The purpose of CCTV gathering in this workplace was for “security purposes”. On that basis Doolin argued that the employer could not use that CCTV footage in a disciplinary process.

Generally, the use of CCTV in the workplace must be “necessary and proportionate”. This means it should only be used for the stated purposes, unless it has been made clear at the outset that the gathering of the cctv data may be used for these other purposes-for example investigating offences or prosecuting offenders or disciplinary procedures.

The Grand Chamber of the European Court of Human Rights has held that the use of covert surveillance in the workplace may be justified if reasonable suspicion of serious misconduct has occurred. You can read a blog post here about Lopez Ribalda and others v Spain.

The key takeaways from that case are

  1. The employee’s right to privacy in the workplace is not absolute
  2. The employer’s action must be viewed in the light of the specific facts of the case and whether the steps taken by the employer were in pursuit of a legitimate aim and were necessary and proportionate.

Doolin v The Data Protection Commissioner [2020] IEHC 90

Doolin had been disciplined in the workplace arising from the taking of unauthorised breaks in the workplace. These had become apparent when the employer had found threatening graffiti in Our Lady’s Hospice and Care Service in Harolds Cross and had been advised by an Gardai to monitor who had access to the room in question.

This was how the question of unauthorised breaks by Doolin arose.

Doolin complained to the Office of Data Protection Commission about the use of CCTV in the disciplinary process and the unlawful use of his personal data.

The Data Protection Commissioner held that the purpose of gathering the CCTV was advised in advance as “for the purpose of health and safety and crime prevention”. Because the original viewing of the CCTV was for a security purpose-that is, to try to find out who was posting the graffiti-the subsequent viewing of the data for the disciplinary process against Doolin was not for a different purpose.

Doolin appealed this decision to the Circuit Court who upheld the decision of the Data Protection Commissioner. Doolin then appealed to the High Court.

The High Court agreed with Doolin insofar as it held that if the employer had intended to use CCTV in disciplinary proceedings in the workplace it should have made this clear in its data protection policy. It changed its policy in later years to reflect this but this was not the case at the time Doolin was disciplined.

The High Court held that the Circuit Court and the Data Protection Commissioner were incorrect in finding that no further processing of the data had occurred in the disciplinary process.

Interestingly, it found that if the data protection policy had reflected, as it later did, that cctv could be used for “for the purpose of a disciplinary investigation” it would have been acceptable to discipline Doolin with the assistance of the cctv; but that was not the case when Doolin was subjected to the disciplinary.

The High Court held, inter alia,

I am therefore overturning the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the disciplinary action, in which information derived from the CCTV footage was used, was carried out for security purposes.

The High Court also concluded,

The information used by the Panel to arrive at their conclusion that the Applicant had taken unauthorised breaks derived inter alia from both the CCTV footage and fob access records. Accordingly, it is indisputable that the information contained in the CCTV footage was used for the disciplinary proceedings, which use constituted a different purpose from the one for which the data was originally collected. The fact that it was not downloaded for use does not mean no further processing took place.

Conclusion

For the reasons set out in the Decision,

I: (a) allow the appeal against the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the use of the CCTV footage or material derived from it in the disciplinary hearing was for security purposes;

 (b)  conclude that the DPC made an error of law in holding that no further processing took place as this conclusion was founded upon an incorrect interpretation of “processing” having regard to the terms of s.2(1)(c)(ii). 

64. Having regard to the above, I uphold the appeal and set aside the conclusions of the DPC in the Decision to the effect that no contravention of s.2(1)(c)(ii) occurred. 

65. I am conscious that s.26 simply provides for an appeal to the High Court on a point of law but does not prescribe what should happen in the event of a successful appeal. I therefore propose to hear the parties on the form of Order, including whether the matter should be remitted to the DPC. [Note: At a costs hearing on 25 February 2020, the parties indicated that no remittal should be made to the DPC and an Order was made in the terms of paragraph 63 above].

Read the full decision in Cormac Doolin and The Data Protection Commissioner and Our Lady’s Hospice and Care Services 2019/2011CA.

Categories
Employment Law Procedures and Policies

Using CCTV and Data Protection-the Facts You Should Know

cctv-data-protection

Is CCTV being operated in your workplace?

Are you an employer who is considering introducing CCTV?

The Data Protection Commissioner has issued updated guidelines in December, 2015 in respect of the use of CCTV.

Because recognisable images captured by CCTV systems are considered to be “personal data”, as defined by the Data Protection Acts in Ireland, and are subject to the provisions of Data Protection legislation.

Justification of CCTV System

This means that a data controller must be able to justify use of a CCTV system. Sometimes this is easy, for example, using CCTV to keep an eye on a building for security reasons.

However, the use of CCTV to watch employees, students, or customers can be harder to justify.

But that is the first question to be answered: is the use of a CCTV system justified?

Proportionality

The second question to be looked at, assuming the system is justified, is what will the system be used for?

Is the use of CCTV proportionate?

If it is used to capture images of attempted burglars or other undesirables, there is no problem with the test of proportionality.

However, if it is used to monitor employees, showing that it is proportional can be more problematic, although not impossible, for example for health and safety reasons.

But whatever the reason, use of CCTV needs to be justified in the particular circumstances. This justification would generally arise from issues which have arisen prior to the installation.

Where will the cameras be located? What sort of images will be captured? The use of CCTV cameras in toilets, and other locations where you could reasonably expect privacy, will be difficult.

However, even where they can be justified in toilets they should never be used to capture images from urinals or cubicles.

Carry Out an Assessment

The Data Protection Commissioner’s office recommends that detailed assessments be carried out prior to the installation of cctv cameras. It also recommends the following steps:

  • A Risk Assessment
  • A Privacy Impact Assessment
  • A Specific Data Protection policy drawn up for use of the devices in a limited and defined set of circumstances only (this policy should include documented data retention and disposal policy for the footage)
  • Documentary evidence of previous incidents giving rise to security/health and safety concerns
  • Clear signage indicating image recording in operation.

Warning to Data Subject

Before any data is recorded the data subject must be warned.

This warning can generally be achieved by placing signs in prominent positions.

If it is obvious that the purpose of the data collection is security it will suffice that the sign states that CCTV is in operation and a contact number should be provided.

If the purpose is not obvious then the data subjects should be warned beforehand. This would be especially true if CCTV was being used to monitor staff conduct or performance, as this would not be an obvious purpose.

Written CCTV Policy

A written CCTV policy should be in place and it should contain

  1. The identity of the data controller
  2. The purpose of the data processing
  3. Any 3rd parties to whom it is made available
  4. How to make an access request
  5. The retention period of the CCTV
  6. The security arrangements for the CCTV

Data should not be kept for longer than necessary.

Longer than 1 month in the case of CCTV would be hard to justify.

Access to the data should be restricted to authorised personnel, and it should be stored in a safe place.

Supplying Images to an Garda Siochána

Supplying, as opposed to permitting viewing of, CCTV images to an Garda Siochana should be by written request which states that a criminal investigation is being carried out.

If a verbal request is acceded to, where there is a degree of urgency, a formal written request should be obtained afterwards.

Rights to Access Data

When a data subject requests CCTV images he should supply a time frame of the recording. This would refer to specific days and/or hours but a general request for all CCTV data held would not be acceptable.

Where images of parties other than the requesting data subject appear on the CCTV footage the onus lies on the data controller to pixelate or otherwise redact or darken out the images of those other parties before supplying a copy of the footage or stills from the footage to the requestor.

Alternatively, the data controller may seek the consent of those other parties whose images appear in the footage to release an unedited copy containing their images to the requester.

It would be unacceptable for the data controller to claim that he cannot pixelate images or provide copies for technical reasons, or that he cannot provide images to be viewed on the requester’s device.

If the data controller chooses to use this technology he needs to be able to comply with the data protection consequences.

Hidden Cameras

Generally, the use of hidden/covert surveillance is forbidden, except on a case by case basis to prevent or detect offences or crimes. Any covert surveillance should be specific, limited, and for a short period.

Security Companies

Security companies acting on behalf of clients are considered to be “data processors”.

Their clients are the data controllers. Data processors have specific obligations placed on them by the data protection acts, for example to prevent unauthorised access to the data and ensuring security of the data.

Also certain data processors must have an entry in the public register maintained by the Data Protection Commissioner. (See section 16 Data Protection act, 1988)

The processing of personal data kept by an individual and concerned solely with the management of his/her personal, family or household affairs or kept by an individual for recreational purposes is exempt from the provisions of the Acts.

However, this would not allow recording of a public space, and neighbour has a constitutional and common law right to privacy. They could enforce this right by taking a civil court action.

What to Do Now

  1. Carry out an assessment,
  2. draw up a written CCTV policy,
  3. obtain professional advice if you are unsure or unclear about your rights or obligations.

The use of CCTV in disciplinary matters

A question I am often asked is about the use of CCTV footage in disciplinary proceedings.

This is a grey area but the general position is that the use of CCTV in disciplinary matters is inadmissible unless there are exceptional or special circumstances justifying the surveillance. The employee should be notified in advance of the presence of the cameras and that the images may be used in disciplinary proceedings.

Any use of CCTV must be proportionate and justifiably necessary.

Normally an employer can easily justify the use of CCTV for security reasons and to prevent loss of stock/theft, and so forth. However, attendance, misconduct, and disciplinary issues are less straightforward.

Transparency and proportionality

Employees do have personal privacy rights when they go to work and CCTV monitoring must be carried out with regard to the basic data protection principles of transparency and proportionality. Thus, the employer must alert the employee to the use of CCTV and the purpose of the monitoring and special circumstances would need to exist if the employer wants to monitor attendance or staff conduct.

In a 2014 case Karen Deegan v Dunnes Stores [2014] the employee was awarded €9,300 for her unfair dismissal as the employer relied on CCTV footage to find her guilty of misconduct in circumstances where the employee was unaware of the CCTV cameras.

However, the Circuit Court later overturned this decision when Dunnes Stores appealed the decision and the Judge found that there were substantial grounds which justified the employer’s decision.