Last month we looked at monitoring in the workplace by way of covert recordings. This month we turn to monitoring by way of CCTV in the workplace, and in particular how it can be used to an employer's advantage and how best to manage the associated risks.
What use can CCTV have for employers?
Employers may install CCTV for various reasons including:
- Security: to prevent theft, violence, and other crime.
- Health and safety: to routinely check that health and safety rules are being complied with and/or so that footage is available in the event of a specific breach.
- Protecting business interests: e.g. to prevent misconduct.
- Assess and improve productivity: e.g. to monitor patterns or to incentivise employees to work harder.
- Compliance with legal and regulatory obligations (most likely in the financial services sector)
There are three key legal obligations which employers must bear in mind when using CCTV:
- Mutual trust and confidence: Employers should not act, without reasonable and proper cause, in a way which is likely to destroy or damage the relationship of mutual trust and confidence between themselves and employees. If they do so, there is a risk that employees will resign and claim constructive dismissal.
- Data Protection Act 1998 (the "DPA"): employers should act in accordance with the DPA and its eight key principles. The Information Commissioners Office (the "ICO") enforces the DPA and a breach may lead to sanctions and bad publicity for employers. Employers should also be conscious of the increased risk of receiving subject access requests ("SARs") from employees where monitoring is used, as employees may become nervous about the data which their employer holds and are more likely to apply to the ICO for disclosure of such data. It will inevitably waste valuable time to deal with and responding to SARs and ICO investigations.
- Human Rights Act 1998 (the "HRA"): employers in the public sector should be particularly aware of the right to privacy which their employees have under the HRA as it applies directly to them. However, as tribunals and courts are expected to take it into account when making decisions, it is still important for employers in the private sector to consider this right, and to ensure their monitoring is not disproportionate or intrusive.
Managing the risk
So how can employers avoid the risks and strike the right balance when it comes to CCTV?
The Employment Practices Code (a code of practice published by the ICO) sets out detailed guidance on the use of CCTV in the workplace, including:
- Carry out an Impact assessment. The ICO recommends carrying out an impact assessment which can be invaluable in justifying the use of CCTV. Whilst assessments will vary on a case by case basis, we would recommend always documenting the assessment in case proof is later required. The assessment should identify:
- the purpose behind the monitoring and likely benefits;
- the likely adverse impacts;
- alternative ways in which the purpose might be achieved (e.g. supervision or training);
- the obligations which will arise from monitoring (e.g. notifying employees, managing data in accordance with the DPA, risk of SARs etc.);
- whether the decision would ultimately be justifiable.
- Ensure those involved in monitoring are aware of their obligations. These individuals should also be subject to strict confidentiality and security obligations.
- Make employees aware of the nature and extent of the monitoring and the reasons for it in a written policy.
- It is advisable to have a policy in place which is readily available for employees (e.g. on the company intranet) and to provide training on it. It is useful to get employees to sign to acknowledge they have read the policy however note that consent should not be relied upon and there is no substitute for carrying out an impact assessment.
- If an employer makes clear and can explain their reasons for monitoring, employees are unlikely to object. If however it is stated that CCTV will be used to detect crime and it is then used for other reasons, e.g. to monitor the amount of work done by employees, there is a risk that employees may resign and claim unfair constructive dismissal for breach of trust and confidence.
- Be clear what levels of privacy an employee can and cannot expect. The use of CCTV in break areas, restrooms and changing rooms would be hard to justify however in a public entrance, where expectations of privacy are low, CCTV could be justified. An example of a situation which might fall somewhere in the middle would be where CCTV monitors the entrance to a department, but a number of workstations fall within the camera's view meaning certain individuals' everyday activity is monitored. In this case, it may be that the employer should look into the possibility of adjusting the camera angle to avoid disproportionate monitoring.
- Give employees the chance to be heard. Ensure employees can voice their concerns in confidence and are given the chance to explain or challenge any footage where it is used as part of a disciplinary process. If this is not done, there is a risk an employee will seek to obtain an enforcement notice from the ICO preventing the use of such data. Where footage is critical to a disciplinary investigation, it would be frustrating to lose the right to rely on such evidence in these circumstances.
- Store and process information in accordance with the DPA. The data captured must be relevant, not excessive, securely stored and not kept for longer than is necessary. This will again help to ensure that individuals’ rights are protected and that the evidence gathered can later be relied on if necessary. Some employers may need to provide details to the ICO of how they handle personal data and the ICO can be contacted directly for further advice regarding this.
- Deal with SARs promptly: Employees have the right to request a copy of any CCTV footage relating to them and employers should have a clear system in place in order to respond to any SARs within the 40 day time limit. See our article "Use of SARs in employment disputes" for further information on how employees can make use of this right and how best employers can manage the risk.
When is covert monitoring justifiable?
Monitoring individuals without their knowledge is only justifiable in exceptional circumstances where there are grounds to suspect criminal activity or extremely serious malpractice. If such monitoring is undertaken it would be advisable to ensure that:
- senior management authorises its use;
- it is only carried out for a set timeframe and as part of a specific investigation;
- the risk of intrusion on innocent workers is considered;
- areas where privacy is expected remain private; and
- limited numbers of people are involved.
If information obtained during covert monitoring inadvertently brings up evidence of other malpractice, this evidence should not be used against employees unless it is a case of serious gross misconduct. Where the misconduct is minor in nature, use of the "secret" footage to discipline individuals will not be allowed.
If employers do wish to use CCTV to monitor their workforce, it is important to consider employees' rights and the risks involved. Although the reasonable and appropriate use of CCTV has its advantages (and was valuable evidence in the case of Kisoka v Rydevale Day Nursery, which we report this month), a "big brother" approach which goes beyond a reasonable and appropriate scope can lead to employee complaints and ICO investigations which can be very time-consuming, lead to reputational damage and mean that employers are prevented from relying on data which would otherwise have been very useful to them. By following the steps above, in particular carrying out an impact assessment, communicating with employees and processing data in accordance with the DPA, the adverse impacts can be avoided and the benefits maximised.