One issue which keeps coming up on data protection in the employment context is how and whether employers can access CCTV footage recorded by third parties when investigating potential disciplinary incidents.
Can employers use third-party CCTV footage in disciplinary proceedings?
Yes, if data controllers have a legal basis for the processing of personal data under Article 6 of the General Data Protection Regulation (GDPR).
Although consent of the data subject is an accepted legal basis for processing data, an employee involved in an incident is unlikely to provide such consent to the processing of CCTV footage where he or she is the subject of disciplinary proceedings.
Employers and third parties are therefore most likely to seek to rely on the legitimate interests ground as the legal basis for the processing of CCTV footage. Under Article 6(f) of the GDPR, processing of personal data is permitted where:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data….”
Has the legitimate interests ground been considered by the Data Protection Commissioner (DPC)?
The DPC considered the provision of CCTV footage by a bar to an employer in Case Study 2 of its Annual Report 25 May – 31 December 2018. A complaint was made against the bar, as data controller, alleging that it had disclosed the complainant’s personal data, in the form of CCTV footage, to his employer without his consent or knowledge. While the complaint was considered in light of the Data Protection Acts 1988 and 2003 (the “Acts”), the legal bases set out in the Acts are broadly replicated in the GDPR.
The DPC examined whether the bar as data controller or the employer had a legitimate interest under s. 2A(1)(d) of the Acts. The DPC had regard to the decision of the Courts of Justice of the European Union (the CJEU) in Rīgas (Case C-13/16), wherein the CJEU considered the legitimate interest basis under the Data Protection Directive (95/46/EC). The CJEU identified three pre-conditions when relying on the legitimate interests ground:
- there must be a legitimate interest justifying the processing;
- the processing of the personal data must be necessary for the realisation of the legitimate interest; and
- the interest must prevail over the rights and interests of the data subject.
Was the employer able to rely on the legitimate interests ground?
Yes. The DPC determined that the employer had a legitimate interest in obtaining the bar’s CCTV footage as it was investigating an incident which occurred during a work-related social event. The DPC also considered that the employer had a legitimate interest to protect the health and safety of its employees as it might have been liable for any injuries suffered by an employee during the incident.
The DPC concluded that in the context within which the data was sought, it was reasonable, justifiable and necessary for the bar to process the CCTV footage to enable the employer to properly investigate the incident. This legitimate interest took precedence over the data protection rights of the data subject who had made the complaint.
Employers should consider whether an argument can be sustained that they have a legitimate interest before using third-party CCTV footage in disciplinary proceedings against employees.
Contributed by: Alicia Compton and Richard Smith
Follow us @WFEmploymentLaw and @WilliamFryLaw
