Third party CCTV footage and the GDPR
What every employer should know
The General Data Protection Regulation were introduced in Ireland, and throughout the EU, on the 25th May 2018. Now , over a year later many employers are still realising the impact which the legislation has had on employment law in Ireland, particularly in the area of data protection and workers rights. In this article we examine the use of third party CCTV footage in disciplinary proceedings.
Can I, as an employer, use 3rd party CCTV footage in disciplinary proceedings ?
Under Article 6 of the General Data Protection Regulation, you can if you have a legal basis for processing the data.
What does that mean in ordinary workplace situations ?
The GDPR outlines a number of legal bases which may apply.
The simplest is where the employee consents to the processing of data. An employee who is involved in an alleged incident, which may result in a disciplinary hearing, is not likely to give consent.
Where that is the case,and consent is not forthcoming, we need to look at the legitimate interests basis.
What is the legitimate interests basis for processing CCTV footage?
Article 6 (f) of the GDPR states that processing of personal data is permitted when that "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…."
If an employer can establish that they have legitimate interests to pursue through the processing of the data then it will be permitted.
This is probably best explained in an example. The Data Protection Commission (DPC) is the national independent authority for upholding the Data Protection Rights of the individual in Ireland. It considered the question of legitimate interests in Case Study 2 of its Annual Report 25 May - 31 December 2018.
The case involved the provision of CCTV footage by a bar to an employer. It examined the Data Protection Acts 1988 and 2003 ( The Acts)
The DPC received a complaint against a bar alleging that it had disclosed the complainant’s personal data, contained in CCTV footage, to his employer without his knowledge or consent and that it did not have proper CCTV signage notifying the public that CCTV recording was taking place.
The background
A workplace social event provided by the employer had taken place in the bar . The complainant was an employee of the empoloyer hosting the workplace event and had attended the event in this capacity. An alleged assault took place during the event involving the complainant and another employee.
When the employer discovered this it had to investigate the matter fully. In order to do so a HR officer from the emplolyer obtained permission from the Bar manager to view and obtain a copy of the CCTV footage which contained images of the alleged assault. The employer felt that this was necessary in order to investigate the incident and to protect its interests in the event of a claim for personal injuries being made against the employer.
The DPC considered whether there was a legal basis, under the grounds of the ‘legitimate interests’ of the data controller or a third party under Section 2A(1)(d) of the Acts, for the bar to process the complainant’s personal data by providing the CCTV footage to the employer organisation. This provision allows for the processing that is ‘necessary for the purposes of the legitimate interests
pursued by the data controller or by a third party or parties to whom the data are disclosed except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject’.
The DPC took into consideration the judgment of the CJEU in the Riga regional security police
case in which the CJEU had considered the application of Article 7(f) of the Data Protection Directive (95/46/EC) on which Section 2A(1)(d) of the Acts is based, and identified
three conditions that the processing must meet in order to justify the processing as follows:
a) There must be the existence of a legitimate interest justifying the processing;
b) The processing of the personal data must be necessary for the realisation of the legitimate interest; and
c) That interest must prevail over the rights and interests of the data subject.
The DPC took into account that as the incident had occurred during the employer organisation’s
workplace social event, the employer might have been liable for any injuries to any employee that could have occurred during the incident. Accordingly, the CCTV was processed in furtherance of the employer organisation’s obligation to protect the health and safety of its employees.
As the CJEU has previously held that the protection of health is a legitimate interest, the DPC was satisfied that there was a legitimate interest justifying the processing.
The DPC also considered that the disclosure of the CCTV in this instance was necessary for the legitimate interests pursued by the employer organisation so that it could investigate and validate allegations of wrongdoing against the complainant.
The DPC considered, in line with the comments of Advocate General Bobek in the Riga regional
security police case, that it was important that data protection is not utilised in an obstructive fashion where a limited amount of personal data is concerned. In these
circumstances the DPC considered that it would have been unreasonable to expect the bar to refuse a request by the employer organisation to view and take a copy of the CCTV footage, against a backdrop of allegations of a serious assault on its premises, especially where the personal
data had been limited to the incident in question and had not otherwise been disclosed
The DPC considered that it was reasonable, justifiable and necessary for the bar to process the CCTV footage by providing it to the employer organisation, and that the legitimate interest of the employer organisation took precedence over the rights and freedoms of the complainant, particularly given
that the processing did not involve sensitive personal data and there had not been excessive processing.
On the facts, the DPC was also satisfied that the bar currently had adequate signage alerting patrons to the use of CCTV for the purpose of protecting staff and customers and preventing crime, and that in the absence of any evidence to the contrary offered by the complainant, the complainant had been on notice of the use of CCTV at the time in question.
The lesson to be learned
As an employer you should consider carefully the reason why you are seeking third party CCTV footage. Do you have the employee's consent? If not, are you protecting a legitimate interest ? If in doubt contact us using the orange Yes! Tell Me More button below. It could save you a lot of trouble later.
For more on GDPR see
Data Protection Commission - Annual Report 25 May - 31 December 2018 ,>Download here
Download CCTV Guidance Data Controllers here:
