Employers should only use CCTV data for specific, explicit and legitimate purposes. The Court of Appeal recently held in Data Protection Commissioner v Doolin that CCTV footage is data and should only be used in a manner that is compatible with its intended purpose as outlined in the company’s CCTV/data privacy policies. This case was taken by the DPC but the employer’s use of CCTV footage in a disciplinary context was a central issue. While this decision will be of interest to data privacy practitioners, our review focuses on employers’ obligations during disciplinary investigations.

An employee was subject to disciplinary proceedings on the basis that he took unauthorised work breaks. His conduct in taking unauthorised work breaks was first inadvertently detected when the employer examined CCTV footage of the staff break room (on advice from the Gardai), because of a separate security issue. The company’s policy clearly stated that CCTV footage was for security purposes and a disciplinary investigation was not referenced in the policy.

Key takeaways for employers

Employers must identify the purpose of their investigations

In this case, the employee’s CCTV data was used for essentially two different purposes, a security investigation and a disciplinary investigation. The Court held that there were two purposes and consequently two potential outcomes for the employee. Employers who conduct employee related investigations should only do so for specified purposes and in accordance with company policies. Employers should always ask themselves what is the intended outcome of this investigation? If the outcome and purpose of an investigation are the same, then the investigation it likely to be legitimate.

Employers should only use CCTV footage in accordance with their policies

Employers’ use of CCTV data must match what it says in their CCTV policies and CCTV signs. In this case the employer’s actions did not match their policies. CCTV signs displayed on company property noted that “images are recorded for the purposes of health and safety and crime prevention”. The CCTV policy contained similar wording.

The employer initially complied with this policy by gathering the images through CCTV for the security investigation. However, the subsequent use of the employee’s image for a disciplinary investigation made the employer’s use incompatible with the policy. The Judge stated that the disciplinary investigation originated from a security issue. The admissions made by the employee during the security investigation directly led to the disciplinary investigation. While the employee’s conduct could have been discovered through the inspection of fob/ clock in/out records, it was obvious that the employer only discovered the unauthorised breaks because of a review of CCTV data in connection with the security issue.

Employers must remember to notify their employees

It is important for employers to understand that the fact that data was used for a different purpose did not mean that this was automatically unlawful. The further use of the CCTV footage was illegal because it was done for a different, incompatible reason. Critically, this was done without notifying the employee.

This is an important decision for employers because it highlights the need to adhere to data privacy obligations during disciplinary investigations. Employers can use CCTV data during disciplinary investigations, if provided for in their disciplinary and CCTV policies.

This decision does not stop employers from using CCTV footage, however employers must be extremely careful when using CCTV data when conducting investigations and applying its disciplinary procedures.

Nine key takeaways for employers

1. Ensure that CCTV policies clearly outline how the company will use employee data.
2. Keep policies and procedures up to date.
3. Make your employees aware of your policies.
4. Employees should have a reasonable expectation that their data will be used in a certain way.
5. CCTV policies should be easily accessible such as on the company’s intranet.
6. Ensure that managers/HR officials who conduct disciplinary investigations do so in compliance with all company policies (to include CCTV/data privacy policies).
7. Employers should remember that they cannot use CCTV footage for reasons incompatible with the original stated purpose of the data.
8. Employers will be found to have processed their employee’s data illegally, where they engage in activity that is incompatible with the original purpose of gathering the data.
9. Employers are always required to follow procedures when conducting disciplinary investigations, this is especially true when an employee’s data is being relied on in the disciplinary process.

For more information on successfully conducting disciplinary investigations, contact a member of our Employment & Benefits team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.