Covert surveillance often involves an employer monitoring an employee through the use of CCTV. The current position adopted by the Data Protection Commissioner (the “DPC”), as published in the recently revised Guidelines on CCTV Usage (the “Guidelines”), is as follows:
There have been a number of cases whereby the DPC has found that employers have breached the Data Protection Acts 1988-2003 in circumstances where the employer failed to inform employees in advance of covert monitoring or where the monitoring was disproportionate (Case Study 9/2011) or where covert monitoring was used and there was no actual involvement or intention to involve the Guards (Case Study 6/2008).
Based on the current Guidelines and case studies to date, covert recording should only be carried out in exceptional cases to investigate criminal activity or equivalent malpractice and where the company intends to involve, and does involve, An Garda Síochána. It will be important that before any recording is carried out that an organisation puts in place a CCTV policy and that policy addressed each of the requirements set out in the Guidelines as referred to above.
Finally, it is important to recognise that data protection and privacy law is an increasingly complex area of law which is constantly evolving. A number of high profile and significant decisions have been handed down by the European Courts over the last number of years which have fundamentally challenged the status quo in relation to data protection law. It is likely that covert recording in the workplace will be the subject of challenge either at a local level or at a European level in the next number of years. If this does occur, the DPC may be required to revise her Guidelines so that greater protection is provided to employees. For that reason, before organisations engage in any covert monitoring, employers are strongly advised to take legal advice. This is particularly important in circumstances where the DPC will have the power to award significant fines under the General Data Protection Regulations 2016 which comes into force in May 2018. Under those Regulations, depending on the category of the offence, the DPC can impose fines of up to €10,000,000 or 2% of global turnover, whichever the higher, or up to €20,000,000 or 4% of global turnover, whichever the higher). More importantly, individuals will have a right to claim compensation for breach of their data protection rights. Finally, the Data Protection Acts are due to be replaced with new legislation when the Regulations come into effect. The issue of covert recording will need to be revisited again in light of this new legislation which is expected to be published in late 2017/2018.
Website by Open