31 December 2008
An employer attempts to use CCTV for disciplinary purposes
In February 2008 I received complaints from two employees of the same company regarding their employer’s intention to use CCTV recordings for disciplinary purposes.  
In this case, the employer had used CCTV images to compile a log that recorded the employees’ pattern of entry and exit from their place of work.  The employer then notified a trade union representative that this log would be used at a disciplinary meeting.  It also supplied a copy of the log to the union representative.  The employer sent letters to each employee requesting that they attend a disciplinary meeting to discuss potential irregularities in their attendance.  The letters indicated that this was a very serious matter of potential gross misconduct and that it could result in disciplinary action, up to and including dismissal.
The employees immediately lodged complaints with my Office.  They stated that they had never been informed of the purpose of the CCTV cameras on the campus where they were employed.  They pointed out that there were no signs visible about the operation of CCTV.  On receipt of the complaints, my Office contacted the employer and we outlined the data protection implications of using CCTV footage without having an appropriate basis for doing so.  We informed the company that, to satisfy the fair obtaining principle of the Data Protection Acts with regard to the use of CCTV cameras, those people whose images are captured on camera must be informed about the identity of the data controller and the purpose(s) of processing the data.  This can be achieved by placing easily read signs in prominent positions.  A sign at all entrances will normally suffice.  If an employer intends to use cameras to identify disciplinary (or other) issues relating to staff, as in this instance, staff must be informed of this before the cameras are used for these purposes.
 
The employer accepted the views of my Office.  It informed the two employees that it was not in a position to pursue the matter of potential irregularities in attendance as it could not rely on CCTV evidence obtained in contravention of the Data Protection Acts.
 
This case demonstrates how data controllers are tempted to use personal information captured on CCTV systems for a whole range of purposes.  Many businesses have justifiable reasons, related to security, for the deployment of CCTV systems on their premises.  However, any further use of personal data captured in this way is unlawful under the Data Protection Acts unless the data controller has made it known at the time of recording that images captured may be used for those additional purposes.  Transparency and proportionality are the key points to be considered by any data controller before they install a CCTV system.  Proportionality is an important factor in this respect since the proposed use must be justifiable and reasonable if it is not to breach the Data Protection Acts.  Notification of all proposed uses will not be enough if such uses are not justifiable.
Substantial guidance is available on our website in relation to the use of CCTV in a business or in a workplace.  I would encourage all data controllers, particularly those who may already have such recording systems in place, to familiarise themselves with our guidance on this important issue.