The use of CCTV cameras within workplace is subject to the provisions of the European General Data Protection Regulation 2016/679 (hereinafter the “GDPR”) and the Cyprus Law for the Protection of Natural Persons as to the Processing of their Personal Data and the Free Movement of such Data (125(I)/2018) (hereinafter referred to as the “Data Protection Law”) since recognisable images captured by CCTV cameras are considered “personal data”.
Article 5.1 (a), (b), (c), (d), (e) and (f) of GDPR introduces the data protection principles that an organization must adopt and follow in data processing activities, whether it acts as Data Controller or as Data Processor (“Data Processing Principles”). The organization/employer must always act within the ambit of the following Data Processing Principles:
- Lawfulness, fairness and transparency: This principle requires that the personal data of data subjects are processed in a lawful, fair and transparent manner. Transparency implies that any information and communication concerning the processing of personal data must be easily accessible and easy to understand. Also, clear and plain language needs to be used in this regard.
- Purpose limitation: This principle requires that personal data are to be collected only for specified, explicit and legitimate purposes and it is not allowed to process them further in a way that is not compatible or not relevant with these purposes.
- Data minimization: According to this principle, personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Essentially, it means that data cannot be processed unless it is needed to process them in order achieve the above-mentioned purposes.
- Accuracy: This principle requires ensuring that personal data are accurate and are kept up to date where it is necessary. Personal data that are inaccurate considering the purposes for their processing must be deleted or rectified without any delay.
- Storage limitation: This principle entails that personal data must be kept in a form that makes it possible to identify Data Subjects for no longer than is necessary for the purposes of the Storing these data for longer periods is allowed when the processing of the data aims at achieving purposes in the public interest, scientific or historical research purposes or statistical purposes. Nevertheless, also in these cases rights and freedoms of Data Subjects must be safeguarded.
- Integrity and confidentiality: This principle enquires that the Data Processor or Data Controller keep personal data safe and protected against unauthorized or unlawful processing and against accidental loss, destruction or damage by using appropriate technical or organizational measures including, inter alia, the use of encryption and authentication and authorisation mechanisms.
The GDPR and the Data Protection Law provide guidelines to the controllers on how to use the surveillance system within the workplace under the principle of proportionality. The Data Protection Commissioner in Cyprus has also issued several guidelines and/or opinions relating to the use of CCTV cameras within the workplace and those guidelines and/or opinions have been taken into consideration during the drafting of the present article
Undoubtedly, using a CCTV camera to monitor areas within workplace is not an easy task. The location of cameras shall always be a key matter to consider as areas where individuals would have a reasonable expectation of privacy are not always easy to be justified.
Specifically, under GDPR, employers are entitled to monitor the employees’ activities if they have a lawful basis for doing so and provided that the purpose of their monitoring is clearly communicated to employees in advance.
Due to the imbalance of power in the employer-employee relationship, employers can no longer rely on consent to process employee data, including employees’ personal data from CCTV cameras within the workplace. There are, however, many legitimate business reasons based on which employers may monitor employees by using CCTV cameras within workplace which include, inter alia, for the purpose of keeping employees safe and secure by preventing crime, ensuring compliance with health and safety procedures, complying with regulatory requirements etc.
Employers relying on legitimate interests as the legal basis for processing of employees’ personal data need to consider the legitimacy of their interest (and potentially the interests of third parties) and must balance that interest against the interests, rights and freedoms of their employees. In addition, employers also need to apply safeguards and compliance steps to ensure that employees’ rights are not prejudiced in any given case. Should an employee exercise his/her right, under GDPR, to object to the use of CCTV cameras in a particular area, the employer has the burden to demonstrate that it has “compelling legitimate grounds” for processing that override the employees’ rights, or for the establishment, exercise or defence of legal claims.
The purpose of CCTV should be clearly communicated to employees by way of a Privacy Notice. In line with the GDPR requirements, employers are under a duty to employees to make this clear and unambiguous. The general assumption for CCTV usage in the workplace is for security purposes, but the use of CCTV cameras for monitoring employee performance or conduct is not an obvious reason. Therefore, employees must be clearly given notice prior to having their personal data recorded for this purpose. The same approach to notice must be adopted if the purpose of CCTV surveillance is also for health and safety reasons.
Based on the opinion issued by the Data Protection Commissioner (Opinion 2/2018) in a typical workspace environment monitoring needs to be limited, inter alia, to entrance and exit areas, outside elevators, at stairways, at parking areas, at areas with cash/card machines or at areas with electromechanical equipment etc. provided, that the cameras are focused on the assets they are protecting and not at the workspaces of the employees or their faces. Having said that the monitoring of employees at their desks, conference rooms, corridors, kitchen, changing rooms, WCs etc. is forbidden.
This article is provided for informational purposes only and does not constitute legal advice. Readers are advised to consult with legal professionals for advice specific to their individual circumstances.
For further inquiries or legal assistance, please do not hesitate to contact us at info@kpklegal.com.
Author
Mina Socratous
Senior Advocate – Head of GDPR, KPK Legal