However, a recent case has highlighted the problems you can face if your monitoring infringes employees’ privacy. Read on to find out what the law says and how you can strike the right balance between the needs of your business and workers’ rights.
Understand Your Legal Duties
When you use CCTV, there are 3 legal obligations you need to comply with:
1. Data Protection: You must comply with the EU General Data Protection Regulation (GDPR) and UK Data Protection
Act 2018 (DPA). The Information Commissioner’s Office (ICO) has issued two sets of guidance on how to ensure your CCTV monitoring meets data protection principles (the Employment Practices Code and the CCTV Code) and you could face fines if you fail to follow these. If employees are concerned that the footage you hold of them breaches their privacy, they can make a subject access request (SAR) and responding to this will take up valuable time and resources.
2. Human Rights: Employees have a right to privacy under the Human Rights Act 1998. The tribunals will consider this when deciding whether monitoring was proportionate.
3. Mutual Trust and Confidence: You should not act in a way which is likely to destroy or damage the relationship of mutual trust and confidence between you and your employees. If you do, your employees could resign and claim constructive unfair dismissal.
7 Steps to Minimise CCTV Risks
Under the GDPR, you don’t need to obtain employees’ consent to monitor them. However, you must have a legitimate business reason for using CCTV which outweighs employees’ right to privacy.
To get this balance right, you should complete these steps:
Step 1. Carry Out an Impact Assessment
The ICO recommends you carry out an impact assessment to weigh up whether the benefits of using CCTV justify the adverse impact on employees. This assessment should identify:
- Why you intend to use CCTV monitoring.
- What benefits you expect.
- What adverse effects you expect.
- Whether you might achieve your objectives in other ways (such as human supervision or training).
- How you plan to comply with your legal obligations (e.g. by notifying employees of the monitoring, limiting the extent of the monitoring, storing the footage securely and releasing a copy promptly if an employee makes a SAR).
- Why the monitoring is justifiable.
It’s advisable to keep a record of this assessment in case you need it as evidence in an employment tribunal claim.
Step 2. Notify Employees of the Monitoring
The ICO says you should make employees aware of any CCTV cameras in the workplace. The best way to do this is to put up prominent, clearly legible signs at the entrance to the zone under surveillance, backed up by further signs within the area. Signs should be more prominent and more frequent in areas where people might not expect surveillance.
The signs should say:
- Where the cameras are.
- Why you have them.
- Who employees should contact if they have a query.
When giving your reasons for monitoring, bear in mind that you can’t then rely on the footage for a different purpose. For example, if you say you’ve installed CCTV to protect employees’ safety, you shouldn’t use the footage to discipline an employee who regularly arrives late or spends too long chatting with colleagues. This is a breach of data protection laws and the employee might also resign and claim constructive unfair dismissal.
Step 3. Comply with the GDPR when Handling Footage
The data protection principles state that any information which you hold on employees, including CCTV images, must be:
Used fairly and lawfully.
Used for limited, specific purposes.
Used in in a way that is adequate, relevant and not excessive.
Kept for no longer than is absolutely necessary.
To ensure your monitoring isn’t excessive, you should avoid installing CCTV in areas where employees would expect to have a high level of privacy, such as rest areas, toilets and changing rooms. You should also try to adjust cameras to avoid accidentally capturing footage that employees could see as intrusive – such as a view of someone’s computer screen.
Typically, it wouldn’t be necessary to keep CCTV footage for longer than 2 to 4 weeks unless the police were investigating a crime. Erasing the footage regularly (usually by recording over it) will also make it easier to respond to a SAR as there will be fewer images to disclose.
Step 4. Ensure You Can Respond Promptly to SARs
Employees have the right to ask for a copy of any CCTV images which clearly identify them. You must usually respond within 30 days and you can’t usually charge for the information. You should consider whether you need to mask, blur or pixelate any other individuals on the footage to protect their privacy. This is likely to require the input of a specialist company and you’ll need a written contract with it that specifies how it will use and protect the images. Fortunately, the ICO says that in most cases any intrusion on other individuals will be minimal and obscuring their identity won’t be necessary.
Warning: It’s a criminal offence to destroy information to prevent its disclosure. You may, therefore, need to act quickly to stop footage being recorded over if you receive a SAR. Otherwise, the employee could complain to the ICO, which would investigate whether the erasure was intentional.
Step 5. Draw Up a Written Policy
It’s a good idea to put a policy in place that sets out why you have CCTV and how you’re avoiding unnecessary intrusion. If employees are reassured that you don’t have ulterior motives, they’re less likely to object or make a SAR, particularly if the CCTV is there to protect them from intruders or attackers. You should go through the policy during employees’ induction and make it available on your website or intranet.
Step 6. Train Staff Involved in Monitoring
You should make sure security staff or managers who may view CCTV footage understand they are an under an obligation to keep what they have seen confidential and to store it safely.
Step 7. Give Offenders the Chance to Respond
You may want to rely on CCTV footage in disciplinary proceedings – for example, if it reveals theft or gross misconduct. In this case, you should show the employee the recordings and give them a chance to explain themselves. Otherwise, they might be able to ask the ICO to prevent you from using the images. A still image is unlikely to be sufficient evidence of misconduct.
Covert Surveillance: 8 Tips to Get it Right
The ICO’s Employment Practices Code states that: It will be rare for covert monitoring of workers to be justified. It should therefore only be used in exceptional circumstances.’ If you do decide to go ahead, you must do the following:
- Have grounds to suspect that there is criminal activity or gross malpractice.
- Be satisfied that notifying individuals about the monitoring would prevent you from detecting or stopping the crime.
- Obtain authorisation from senior management.
- Only use covert monitoring as part of a specific investigation with a set timeframe.
- Minimise any intrusion on innocent workers.
- Avoid using covert monitoring in areas which workers expect to be private.
- Disregard and, if possible, delete footage that is not relevant to your investigation, unless it reveals other criminal activity or malpractice.
- Limit the number of people involved in the investigation and set clear rules on who will see the footage.
The perils of failing to follow national guidance on covert monitoring have been highlighted by a recent case that came before the European Court of Human Rights (ECtHR), which is summarised below.
The Price of Getting Covert Surveillance Wrong
The ECtHR has recently held that a Spanish supermarket that set up hidden CCTV cameras to monitor suspected thefts by staff breached employees’ right to privacy (López Ribalda v Spain  1874/13). After discovering irregularities with stock levels, the employer installed both visible cameras intended to detect theft by customers and hidden cameras to monitor cashiers. It didn’t tell staff about the hidden cameras, which recorded all the cashiers at all times over several weeks.
The footage showed five employees stealing goods, whom the supermarket dismissed. The employees were unsuccessful in claiming unfair dismissal. They then turned to the ECtHR, which agreed that the covert surveillance violated their right to privacy. The court held that the employer was entitled to investigate the thefts but the way it did this breached the guidance issued by Spain’s equivalent of the ICO. It had not done enough to safeguard its employees’ rights – for example, it could have:
- Targeted the surveillance only at those people who were under suspicion.
- Only recorded for limited periods.
- Given the employees general information that covert monitoring might be used.
The court did not award damages for financial loss arising from the dismissals but it did award each employee €4,000
for non-financial loss.
Achieving the Right Balance
CCTV can be a useful tool but it’s important to respect employees’ right to privacy. Having a clear policy in place and following the steps above can help you to comply with your legal obligations, reassure employees and enable you to rely on footage as evidence when you need to.