Use of CCTV Footage in Disciplinary Hearings
The crossover of data protection and employment law continues to be important when considering the use of CCTV in disciplinary processes.
Background
The case concerned a security incident arising out of disturbing graffiti being found on the property of the employer. The employer contacted the Gardaí, who recommended that the employer review CCTV footage to identify the perpetrator. During the CCTV review an employee, Mr. Doolin, was identified entering and exiting a tearoom at certain times, indicating that he was taking unauthorised breaks. A disciplinary process was initiated, and a sanction was issued.
Mr. Doolin complained to the Data Protection Commission (DPC) that his employer had unlawfully processed his personal data, as the employer’s CCTV policy indicated that the purpose of CCTV monitoring was for security and crime prevention and not disciplinary purposes.
The DPC dismissed the complaint, on the basis that the footage had only been processed once to investigate the graffiti incident, which was a security incident, and that the employer subsequently relied on Mr. Doolin’s admissions during the investigation.
The Circuit Court dismissed Mr. Doolin’s appeal of the DPC’s decision, observing that Mr. Doolin had admitted a breach of security and that disciplinary action was taken against him for security purposes.
The High Court overturned the Circuit Court decision, on the basis that there was no evidence that the disciplinary action was carried out for security purposes. The employer relied on the CCTV footage and a table was included in the investigation report that set out his times of entry and exit to the tearoom.
The decision of the Courts
It found that the processing was not for a related purpose and was incompatible with the specified purpose of security reasons. It noted that the original purpose of attempting to detect the perpetrator of offensive graffiti was irrelevant to the incidental monitoring of Mr. Doolin taking unauthorised breaks, there was no evidence that the taking of unauthorised breaks was a security issue. In this case, it was clear that Mr Doolin’s data was used for a purpose other than, and incompatible with, the specified purpose, and was therefore unlawful.
Conclusion
Employers should continue to follow best practice in the use of CCTV footage in the workplace by:
- Reviewing and updating their policy on a continuous basis
- Conducting a data protection impact assessment before deploying CCTV cameras in the workplace
- Deploying CCTV in areas of particular risk, and not where employees have a high expectation of privacy
- Clearly communicating the location of CCTV cameras
- Not as a matter of course capturing footage for one purpose and using it for another
- Clearly communicating to employees that footage captured may be used not only for security purposes but also the employee investigations and disciplinary proceedings
- Ensuring CCTV review is conducted in a manner that allows any subsequent issues to be dealt with in a manner compliant with natural justice; consider who will review the footage, and avoid overlap with those charged with conducting HR investigations.
