Reasons for monitoring
Employers monitor employees by CCTV for a variety of reasons. It might, for example, be done for reasons of employee safety. However, there are many other instances where it may be viewed as potentially intrusive. Therefore, employers must have good reasons for doing so, otherwise, risk being in breach of data protection laws.
If, for example, an employer was constantly, remotely watching staff to ensure that tasks were being carried out, this would likely be viewed as heavy-handed and impermissible. If, however, an employee was working at a cash register and the employer wished to deter potential thieves, this would be reasonable and proportionate.
Prior warning and reasons
Employees must be told in advance that CCTV monitoring is occurring. They should also be told where and why it is being carried out. The Data Protection Commission, the state watchdog, warns employers that if the use of CCTV has been justified for a specific purpose such as security or health and safety, it should not be used for a further purpose such as monitoring staff attendance, performance or for disciplinary purposes.
Risks
If an employer fails to properly implement the correct data protection procedures, employees could possibly bring a successful data protection claim against an employer. Further, the use of CCTV in disciplinary proceedings may not be permitted if improperly obtained.
Data protection impact assessment
It is useful in such circumstances for employers carry out data protection impact assessments to protect the business and the integrity of any potential disciplinary proceedings. The General Data Protection Regulation, the GDPR, provides a framework for undertaking these types impact assessments. They essentially involve identifying the purpose of the CCTV, the legal basis for the collection of personal data, and then looking at whether the collection of the personal data is necessary and proportionate. There must also be a clear timeframe for retention of the recordings. Files should be maintained containing these impact assessments. Template impact assessments are easily obtainable, if the business does not have a dedicated Data Protection Officer.
It is the responsibility of each employer to ensure compliance with data protection laws, if employees are being recorded by CCTV. Undertaking data protection impact assessments may assist employers in determining whether the use of CCTV to monitor employers is permissible. Maintaining a written record of the impact assessment should ensure that any decisions to monitor employees with CCTV can be justified, if necessary.