The use of hidden cameras did violate the right to privacy of employees who were dismissed for theft, according to the European Court of Human Rights.

The facts

A Spanish supermarket, MSA, identified discrepancies between stock levels and what was supposedly being sold in store. The monthly losses ranged from around €7,500 to €24,000. As part of an investigation, it installed surveillance cameras. Some of these cameras, aimed at detecting customer theft, were pointed towards the entrances and exits of the supermarket, and were visible. Other cameras, which zoomed in on the checkout counters and covered the area behind the cash desk, were hidden. These were aimed at detecting thefts by employees. MSA gave its workers prior notice of the installation of the visible cameras. Neither the workers nor the company’s staff committee were informed of the hidden cameras.

Five employees were caught on video stealing items and helping customers and co-workers to steal. These employees were dismissed. They challenged their dismissal in the Spanish Employment Tribunal. The employees objected to the use of the covert video surveillance, arguing that it had breached their right to protection of their privacy. The Employment Tribunal ruled that the dismissals were fair. The main evidence supporting the fairness of their dismissals was the recordings resulting from the covert surveillance, as well as witness statements. The Employment Tribunal found that the use of covert video surveillance in the workplace without prior notice had been in compliance with Spanish law. The employees appealed to the High Court, which upheld the Employment Tribunal’s decisions, holding that the covert video surveillance had been justified (in that there had been reasonable suspicion of theft), appropriate to the legitimate aim pursued, necessary and proportionate.

The employees brought claims against Spain to the European Court of Human Rights (ECHR). They argued that the covert video surveillance in the workplace ordered by their employer had breached their rights under Article 8 of the European Convention of Human Rights and that the use in the Spanish courts of data obtained by covert surveillance had seriously interfered with their rights under Article 8. (Article 8 states that "everyone has a right to respect for his private and family life, his home and correspondence", and that a public authority should not interfere with this right except "such as is in accordance with the law and as necessary in a democratic society" in the interests of (among other things) the detection of crime.)

Some of the employees had signed settlement agreements, and they claimed that these were invalid because they had been signed under duress. Ultimately, the ECHR decided against them. This alert does not cover the issues relating to the settlement agreements.

Referring to previous cases, the ECHR observed that covert video surveillance of an employee in their workplace is a considerable intrusion into their private life. The right to privacy was therefore engaged. Again following previous case law, the court pointed out that Article 8 does not only exist to protect individuals against arbitrary interference by public authorities. Article 8 also imposes positive obligations on the state to adopt measures designed to secure respect for private life between individuals, and between individuals and private companies.

The ECHR therefore had to examine whether Spain had struck a fair balance between the employees' right to respect for their private life and both their employer's interest in the protection of its property rights, and the public interest in the proper administration of justice. Weighing up the competing factors, the ECHR noted that covert surveillance was carried out in the context of a reasonable suspicion of theft, which warranted investigation. On the other hand, MSA had not notified employees that surveillance cameras had been installed, or of other rights under the data protection legislation, and had breached Spanish data protection law. The Spanish data protection law applicable at the time gave individuals a reasonable expectation of privacy. The ECHR noted that this surveillance was not targeted at particular individuals, but at all staff working on the cash registers, and was carried out potentially for weeks, without a limit in time, and during all working hours. This was contrasted with previous case law, where covert surveillance (which was found not to have breached Article 8 rights) was targeted at two individuals and limited to two weeks.

The ECHR did not therefore agree with the Spanish courts that the surveillance had been justified. It considered that MSA's rights could have been safeguarded by other means, including by informing the employees in advance of the installation of a video surveillance system and providing them with the information prescribed by the data protection legislation. There had therefore been a breach of the right to privacy. The ECHR awarded €4,000 to each applicant (a decision with which three of the seven judges disagreed, considering that under the circumstances, the finding of a violation of Article 8 was sufficient, without any financial award).

What does this mean for employers?

In light of the significant amount of money that MSA believed was being stolen, employers might see this as a harsh decision.

However, this decision does not change the law, nor does it mean that employers cannot, under any circumstances, conduct covert monitoring in the workplace. Covert monitoring should only be carried out in exceptional cases. Before conducting covert monitoring, employers should conduct an impact assessment so that they can show clearly why, at the time, open monitoring was not thought to be sufficient, and why covert monitoring is necessary. The monitoring should be carried out for as short a period as possible, and it should be limited to areas where the employer can show it is necessary and (if possible) targeted at individual employees. Covert monitoring in areas where employees have a high expectation of privacy, e.g. toilets or changing areas – will hardly ever be permissible. The monitoring should affect as few individuals as possible. The Information Commissioner's Code in the UK gives useful guidance on carrying out an impact assessment.

Information Commissioner's Code and Lopez Ribalda and others v Spain