There have been numerous press reports recently on  security and safety issues in retail workplaces such as the Co-Op but what are the legal issues that employers will need to bear in mind when introducing monitoring such as CCTV in the workplace?

There are two main legal issues to bear in mind when introducing CCTV in the workplace: Privacy rights and Data Protection.

Data Protection

The use of CCTV surveillance in a workplace will involve the collection of “personal data” by recording video images of identifiable people. Employers collecting the personal data of employees in CCTV footage will need to comply with data protection legislation including the GDPR and the Data Protection Act 2018.

In order to collect personal data the employer will need to have a lawful reason for doing so. Employers have a duty to provide a safe system of work and to take reasonable care of their employees’ health and safety. The purpose for monitoring the workplace by using CCTV may be for employee security and to uncover unsafe practices, to prevent crime or misconduct, for example.  The legal basis for processing such data could therefore be a "legitimate interest" but this must be proportionate and balanced against the rights of the employees.

It is sensible to carry out a Data Protection Impact Assessment, prior to implementing CCTV, as this will ensure that use of CCTV is necessary and proportionate to the employer's aim and any risks to employees’ rights may be sufficiently mitigated.

The use of CCTV is more likely to be proportionate where such surveillance:

  • is limited to necessary areas, i.e. not toilets, private offices or areas where there is a reasonable expectation of privacy 
  • does not also include audio recording 
  • is limited in duration

Right to Privacy

Under Article 8 of the European Convention on Human Rights employees have a right to a private life and this right extends into the workplace. 

The recent European Court of Human Rights ruling in López Ribalda v Spain highlighted that a supermarket's covert surveillance of employees infringed its employees’ Article 8 rights, where the purpose of the surveillance was to identify theft by staff. The supermarket had not informed the employees about the hidden cameras.  Five employees were caught stealing on the cameras and were dismissed.  They claimed that their right to privacy had been infringed by the covert surveillance. The European Court of Human Rights agreed that the employer had not properly balanced its interest against the right of the employees to a private life.  This may have been different had the employees been aware of all cameras in the workplace.

Such covert monitoring should only be used in exceptional circumstances, where there is no less intrusive alternative and, following the case of Köpke v Germany,is it is more likely to be justified when it is specifically targeted and limited in duration. 

To minimise invasion of privacy, employees and any potential visitors should be made aware of any CCTV surveillance. 

5 Action points:

  1. Carry out a Data Protection Impact Assessment.
  2. Update your current Privacy Notice for employees to provide for the use of CCTV surveillance and how when and why you will process of such personal data.
  3. Ensure employees are fully informed of CCTV surveillance - consider introducing a CCTV Policy incorporating best practice advice from the ICO 
  4. Don't forget about visitors!  Use appropriate signage to make visitors to the workplace, as well as employees, aware of surveillance areas – this should make them aware of why it is being carried out.
  5. Ensure CCTV monitoring is targeted at areas of particular risk, confined to areas where expectation of privacy is low and does not involve the continuous monitoring of particular individuals.