CCTV footage: a GDPR nightmare?

The leaking of former Well being Secretary Matt Hancock’s affair through CCTV footage just lately dominated headlines, in the end leading to his resignation. Nevertheless, it additionally raised questions concerning the GDPR and privateness points related to CCTV within the office.

So, how can companies keep on the proper facet of the legislation when implementing this know-how? Martin Noble, associate and information safety professional at legislation agency, Shakespeare Martineau explains.

Individuals typically affiliate private information with particulars corresponding to telephone numbers and electronic mail addresses, nonetheless photos of people additionally fall beneath the umbrella of private information. Because of this, any enterprise that’s recording their workers through CCTV should comply with the right GDPR processes or face severe penalties.

Earlier than putting in CCTV, employers ought to perform an information safety impression evaluation (DPIA) the place the usage of surveillance digital camera information is prone to end in a excessive threat to particular person privateness. A DPIA identifies the dangers of dealing with the info, and methods to mitigate these. For instance, each particular person has a proper to privateness, and the usage of the CCTV should be justified when balanced in opposition to this. Employers ought to think about minimising the impression on individuals’s privateness, corresponding to placing cameras exterior of workplaces quite than in them or maintaining them to communal areas solely and guaranteeing they don’t seize sound. As a rule of thumb, if there’s a approach to acquire the identical data in a much less intrusive method, then that choice should be chosen. The DPIA also needs to establish the authorized foundation that the employer intends to make use of for utilizing the CCTV. If that is on the idea of recognized “respectable pursuits” then they can’t outweigh particular person pursuits, rights and freedoms.

It’s not only a case of maintaining a DPIA on document although. As a part of the general evaluation, it might even be prudent to talk to related stakeholders within the enterprise, together with workers. Having determined to make use of CCTV, employers might want to make all workers conscious that their information is being captured. Because of the imbalanced nature of the employer-employee relationship, consent can’t be relied upon as a lawful foundation for processing such information. As a substitute, workers ought to have the ability to entry a privateness coverage that units out the grounds that the enterprise is counting on to deal with the info. This could embody how it will likely be used, how it will likely be saved, how lengthy it will likely be saved, and who can entry it.

Any information collected ought to solely be utilized in accordance with the privateness coverage, corresponding to for well being and security causes or to observe worker behaviour to forestall misconduct. Notices also needs to be clearly positioned across the constructing which notify those who CCTV is in operation, as guests additionally have to be made conscious that their private information is being captured.

Nevertheless, ought to a enterprise proprietor have issues a few particular worker for instance, there isn’t any legislation in opposition to the usage of covert cameras. Nonetheless, they need to nonetheless have the ability to reveal that there’s a lawful foundation for planting a digital camera, and that this isn’t outweighed by the rights of the person. A DPIA should be carried out to cowl these circumstances.

Matt Hancock seems to have been caught by a covert digital camera, positioned there with out the Authorities’s permission. This was reported as being an ‘outlier’ which meant that it was not on the primary CCTV circuit or put in by his employer. Employers do have an obligation to take care of their workers and this has raised some safety points when it comes to how the footage was obtained within the first place. In the event that they might be discovered, then the one that planted the digital camera would face a declare for breach of privateness.

Even when absolutely knowledgeable about the usage of CCTV within the office, workers do nonetheless have the proper to object in the event that they don’t agree with the way in which their private information is being processed. Initially, employers ought to supply to elucidate in additional element the reasoning for the CCTV, as clarification concerning its objective and utilization could also be all that’s required to place the worker’s thoughts relaxed. Nevertheless, ought to they proceed to assert that it’s overly intrusive, employers must think about how greatest to maneuver ahead.

If there’s a specific digital camera that’s of concern, eradicating it might be the best choice. Then again, if it’s the idea of CCTV itself that the worker disagrees with, then the employer should think about whether or not the person’s rights are prone to override the respectable pursuits they search to guard. In the event that they consider that their grounds don’t override the worker’s rights, then they will select to maintain the cameras as they’re.

Ought to the CCTV keep in place, and the worker continues to have issues, then the enterprise might face a declare by the affected person for breach of information safety laws and their proper to privateness. The worker additionally has the choice to escalate the criticism to the ICO, which has the ability to research and problem fines for GDPR breaches. These fines differ relying on the severity of the offence and are capped at a a number of of their general turnover, which means they will result in a major monetary loss for non-compliant companies. That is why having the ability to reveal the authorized foundation for utilizing CCTV is important.

CCTV is extra prevalent than ever now that the know-how is extra reasonably priced, with SMEs in addition to massive corporates capable of set up it within the office. Nevertheless, there isn’t any threshold for GDPR compliance, with companies of any dimension having to comply with the right procedures. In search of authorized recommendation earlier than implementing CCTV will help employers to make sure they perform the mandatory checks, avoiding expensive fines.