The Use Of CCTV In The Workplace

The expanded use of CCTV systems has society-wide implications. Unless such systems are used with proper care and consideration, they can give rise to concern that the individual’s “private space” is being unreasonably eroded.

Recognisable images captured by CCTV systems are “personal data”. They are therefore subject to the provisions of the Data Protection Acts.

Generally, most employers will have a CCTV policy in place in order to protect staff, customers, suppliers, company property, the premises in order to ensure the health and safety of all stakeholders and to ensure that all company policies are adhered to at all times. Some employers will use CCTV as evidence for the purpose of disciplinary action if there has been a breach of company policies or procedures, or any other misconduct. However, this may not be in keep with Irish Data Protection legislation as it currently stands. According to the office of the Data Controller “recognisable images captured by CCTV systems are ‘personal data’. They are therefore subject to the provisions of the Data Protection Acts.”

Using a CCTV system to constantly monitor employees is highly intrusive and would need to be justified by reference to special circumstances. If the monitoring is for health and safety reasons an employer would need to demonstrate that the installation of CCTV was proportionate in addressing health and safety issues that had arisen prior to the installation of the system.

The Office of the Data Commissioner has stated that a balance must be struck between the privacy considerations of the individual (employee) and the legitimate interests of an organisation when using CCTV in the workplace. CCTV may be used legitimately under the Data Protection Acts for security related purposes in certain circumstances but any use beyond this would need to be fully justifiable and evidence-based with a very high threshold for such evidence.

A system used to control the perimeter of a building for security purposes will usually be easy to justify. The use of CCTV systems in other circumstances – for example, to constantly monitor employees, customers or students – can be more difficult to justify and could involve a breach of the Data Protection Acts.

Therefore, an employer would need to be able to demonstrate a strong justification for using CCTV for the monitoring of staff. Such a use would require a documented series of events that would justify the use of CCTV for this purpose and the context in which the footage would be accessed. This may include repeated shorts on a till, or the disappearance of stock etc. However, the use of CCTV to continually monitor an employees’ performance or to monitor the use of their personal phone while on duty etc. would be in breach of the Act.  Notifying employees that it is company policy to use CCTV for the purpose of monitoring and performance management would not be considered in line with the legislation.

Correct procedure means that the CCTV system is being accessed only in the course of an investigation of a specific and serious complaint or incident, and would, therefore, be less likely to give rise to data protection concerns. However, on-going access to the system, for the purposes of monitoring employee as they conduct their daily duties would not be consider compliant with the Data Protection Acts.

Furthermore the location of cameras is a key consideration. Use of CCTV to monitor areas where employees or any individual would have a reasonable expectation of privacy would be difficult to justify. Toilets and rest rooms are an obvious example. To justify use in such an area, the employer would have to demonstrate that a pattern of security breaches had occurred in the area prior to the installation of the system such as would warrant constant electronic surveillance. Where such use can be justified, the CCTV cameras should never be capable of capturing images from cubicles or urinal areas.

Cameras placed so as to record external areas should be positioned in such a way as to prevent or minimise recording of passers-by or of another person's private property.

The Act states that data "shall not be kept for longer than is necessary for" the purposes for which they were obtained. An employer needs to be able to justify this retention period. For a normal security system, it would be difficult to justify retention beyond a month, except where the images identify an issue – such as a break-in or theft - and is retained specifically in the context of an investigation of that issue. It is essential that any information captured by the CCTV system should be stored in a secure environment with a log of access kept. Access should be restricted to authorised personnel.