 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
Irish Data Protection Commission Case Studies |
||
|
You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> Case Study 9: Unlawful use of CCTV to remotely monitor an employee [2011] IEDPC 9 (2011) URL: http://www.bailii.org/ie/cases/IEDPC/2011/[2011]IEDPC9.html Cite as: [2011] IEDPC 9 |
||
[New search] [Help]
In October 2010, I received a complaint from an individual who stated that he considered that his personal privacy was being affected in his workplace through the inappropriate use of a CCTV system which his employer had installed. The complainant was employed by Westwood Swimming Ltd in Leopardstown as an administrator. In support of his complaint the individual cited two separate occasions, three months apart, when he received phone calls from his employer who was not on the premises at the time. In both of these phone calls the employer allegedly described to him what he had been doing at a particular time, i.e. that he was conversing with and working on a computer used by an individual from the office next door (who had a different employer). The complainant stated that subsequent to these incidents he had received two separate written warnings. He also stated that the CCTV system was installed without prior staff notification as to the reason for its installation or its purpose.
My Office contacted Westwood Swimming Ltd and we informed it of its obligations under the Acts in respect of CCTV usage. We advised that any monitoring must be a proportionate response by an employer to the risk he or she faces taking into account the legitimate privacy and other interests of workers. We further advised that in terms of meeting transparency requirements, staff must be informed of the existence of the CCTV surveillance and also of the purposes for which personal data are to be processed by CCTV systems. We provided it with copies of our guidance material on the use of CCTV and staff monitoring. It was asked to outline how the processing of personal data as complained of complied with the Acts and to give details of any signage that was in place on the premises informing individuals that there was CCTV in operation and its purpose.
Westwood Swimming Ltd in response stated that the CCTV system was installed with the priority focus being security of the office due to the amount of cash and credit card slips with customer information on hand. It informed us that a secondary purpose for the CCTV was the fact that it had received numerous complaints from its customers stating that the office was not open or that the office was open and
unattended which gave it further concern for the security of cash/credit cards. It confirmed that its staff had not been informed in writing of the installation and purpose of the CCTV. However, it indicated that staff were well aware of the reasons behind the new system as the cameras were overt and the recorder and screen showing views and recordings were in the office in full view of both staff and clients. It stated that the system was installed during working hours in full view of the staff and no query, question or complaint was received from either the staff or clients. It also referred to having signage in place informing people of CCTV being in operation. In this regard, it provided us with a copy of a notice posted at its main entrance listing the various services available at the centre. While it was noted on the bottom of the signage that CCTV cameras were in operation it gave no indication as to its purpose.
Westwood Swimming Ltd acknowledged that the CCTV footage had been reviewed by it in respect of the incidents cited by the complainant.
After consideration of the response received from Westwood Swimming Ltd, my Office informed it that we were satisfied that it had used a CCTV system to monitor an employee and that such monitoring was in breach of the Data Protection Acts. We asked that it immediately confirm to us that it would cease the practice of monitoring employees by remotely accessing the system from a live feed or by any other means. In response, it provided us with a commitment that its employees would not be monitored remotely or by other means using CCTV. It confirmed that the cameras in the office would be removed, any disciplinary actions taken against the employee concerned on foot of the use of CCTV would be discarded, and that it would ensure that the employee would not suffer as a result of any information seen on camera.
At the request of the complainant, I issued a formal decision on this matter in March 2011 which stated that the leisure centre contravened Section 2(1)(c)(ii) of the Data Protection Acts by the further processing of CCTV images which were stated to have been obtained for security purposes in a manner incompatible with that purpose. These contraventions occurred in the two instances when the CCTV was used to monitor the performance of the complainant in the course of his employment.
The improper use of CCTV to monitor employees is a matter of increasing concern to me. Even where employers have sought to legitimise the use of CCTV to monitor staff by referring to it in their company handbook, the position remains that transparency and proportionality are the key points to be considered by any data controller before using CCTV in this manner. We would only expect CCTV footage to be reviewed to examine the actions of individual staff members in exceptional circumstances of a serious nature where the employer could legitimately invoke the provisions of Section 2A (1) (d) of the Acts ("the processing is necessary for the purposes of the legitimate interests pursued by the data controller ?except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject."). This was clearly not the case in the circumstances which formed the basis of this complaint.