The Grand Chamber of the European Court of Human Rights has held that use of covert CCTV to uncover theft by employees did not infringe the Article 8 right to privacy although the claimants may still have remedies under data protection law.
What's the issue?
Employers who suspect their employees of criminal or unlawful conduct often seek to use surveillance technology to confirm their suspicions, but this area is fraught with difficulty as the employer has to be careful not to infringe the employee's privacy rights, in addition to complying with relevant employment law.
A particular issue is how to balance requirements to inform employees that monitoring is taking place, with the occasional need to use monitoring to confirm criminal activity. The latest major case to consider covert monitoring of employees and its impact on their right to privacy under Article 8 of the European Convention on Human Rights (ECHR) provides guidance on factors to be considered when weighing up competing rights.
What's the development?
The Grand Chamber of the European Court of Human Rights has reversed an earlier decision of the Chamber, holding that the use of CCTV by a Spanish employer to uncover workplace theft, had not infringed its employees' Article 8 right to privacy.
What does this mean for you?
The Grand Chamber decision seems a sensible adjustment of the earlier Chamber decision (see below for more detail) and is line with earlier case law. From a data protection perspective, ICO guidance suggests that covert monitoring of employees is rarely justified and should only be conducted in exceptional circumstances. These can include when it is used as part of an investigation into suspected criminal activities. The ICO has also said that covert monitoring can only be justified where openness would be likely to prevent detection of a crime (or equivalent malpractice) and apprehension of offenders.
For employers, it is essential to include provisions about potential employee monitoring in cases of suspected crime or equivalent, in their employee privacy policies in order to comply with prior information requirements as far as possible.
They should also conduct a DPIA before carrying out covert monitoring as it is likely to be considered 'high risk' processing. The DPIA will establish the parameters of the use of surveillance and help the employer reduce the risk to individuals as well as demonstrate accountability under the GDPR. If the DPIA outcome shows there is a high and unmitigated risk for the employees, the employer must notify the national data protection authority and seek advice on the adequacy of any measures intended to reduce the risks as set out in the DPIA.
Of course, data protection law will not be the only consideration. Local employment law and wider privacy law will also need to be taken into account.
Read more
Background
The employees bringing the claim had worked in a supermarket. The management became aware that there was a discrepancy between sales and revenue. They installed CCTV cameras with warnings in the customer areas of the shops. They also installed cameras behind the till without telling their employees. The resulting CCTV footage revealed that five employees were involved in theft.
The employees were dismissed (with three signing settlement agreements) but then brought an unfair dismissal claim, arguing the CCTV footage had been unlawfully obtained in breach of Spanish data protection law. The Spanish Courts held that the CCTV footage had been lawfully obtained despite the lack of prior notice, and that the surveillance had been justified as there had been reasonable suspicion of theft so it was appropriate to the legitimate aim pursued and necessary and proportionate.
The employees then took their case to the ECtHR, arguing that the monitoring infringed their Article 8 ECHR rights to a private life, and that the use of the footage in the unfair dismissal proceedings infringed their Article 6 rights to a fair hearing.
Chamber decision
The facts of this case are similar to those in Koepke v German (Application 420/07) in which the ECtHR found that the interference with the applicant's Article 8 rights had been restricted to what was necessary to achieve the aims of the video surveillance. In this case, however, the Chamber found that the applicants' Article 8 rights (although not their Article 6 rights) had been infringed. The Chamber distinguished this case from Koepke on a number of grounds. In Koepke, only employees under suspicion were monitored, the monitoring took place for a limited two week period, and it covered a limited area. In the Spanish case, all staff were filmed, without any time limit and at all hours, based on a general rather than informed suspicion.
The Chamber of the ECtHR found that while the suspicion of theft warranted the use of covert surveillance, the way that surveillance was carried out breached Spanish data protection law and guidance. In particular, it found that the surveillance was not sufficiently targeted as it covered all employees working at the supermarket's cash register over a period of weeks, without a time limit and during untargeted hours. The Chamber also noted that the employers could have achieved their aims through other means, in particular, by giving the employees prior information about the monitoring and informing them of their rights. Consequently, it held that the Spanish Courts had not struck a fair balance between the rights of the employees and of the employer in upholding the monitoring as lawful and that the employees' Article 8 right had been infringed.
Grand Chamber decision
Spain applied for the case to be re-heard before the Grand Chamber of the ECtHR. The Grand Chamber reversed the earlier decision, relying on principles established in the earlier cases of Koepke, and Barbulescu (which involved monitoring of personal emails). It said that factors to be considered in employee surveillance cases were:
- Whether the employee had been notified of the surveillance.
- The extent of the monitoring and the degree of intrusion.
- Whether the employer had provided legitimate reasons to justify the monitoring and its extent.
- Whether it would have been possible to set up a monitoring system based on less intrusive methods.
- The consequences of the monitoring for the employees.
- Whether the employee had been provided with appropriate safeguards.
The Grand Chamber held that the monitoring measures were necessary and proportionate, taking into account:
- The fact that the employers had legitimate reasons for the surveillance as they had a body of evidence suggesting employee theft.
- The monitoring took place in an area often open to the public where the employees' expectations of privacy were lower than they would have been in private areas such as bathrooms.
- While there had been no initial time limit on the surveillance, it had only lasted for ten days and was stopped as soon as the perpetrators of the theft had been discovered. This meant that the duration of the surveillance had not been excessive.
- The surveillance had been viewed only by the store manager, the supermarket's lawyer, and a union representative.
- While the consequences of the surveillance had been serious for the employees, the recordings were only used to investigate the thefts.
- The Spanish courts had found that the surveillance had been necessary as there were no other means to fulfil the aims of identifying the culprits.
The Grand Chamber considered the issue of lack of prior information. While European law does not usually require prior consent to surveillance, individuals do usually have to be clearly informed in advance of its commencement. This is particularly true in employer/employee situations due to the imbalance in power. However, provision of prior information is only one factor to be considered when assessing proportionality in relation to Article 8 claims. Where information is not given, safeguards will be particularly important. Only an overriding requirement relating to the protection of significant public or private interests can justify lack of prior information.
In this case, the Grand Chamber held that the domestic courts had not overstepped their margin of appreciation when holding that the surveillance had been proportionate. There had been a reasonable suspicion of serious misconduct based on extensive losses over a period of time which suggested a group of employees had been involved so the surveillance could not have been more targeted. In a dissenting judgment, three of the 18 judges found that failure to provide prior information should have been a decisive factor against the employer.
While the Grand Chamber held that the Spanish courts had not erred in finding no infringement of Article 8 rights, it did note that the employees could have remedies available under data protection law.
