The Data Protection Commission (DPC) cannot examine employment issues or criminal matters but occasionally data subjects query whether their employer could use CCTV footage of them stealing or leaving work early to discipline them. As with all data processing, the data controller should be transparent with the data subjects and this can be achieved by having the issues clearly set out in policies such as CCTV policies or privacy policies or other relevant employer/employee policies.

Accordingly, employers should notify employees in advance if they intend to use evidence such as CCTV footage in disciplinary hearings. Obviously, employers have a legitimate interest to protect their business and enforce company policies but this must also be balanced against the employee’s right to privacy. Where it is clearly explained to employees prior to an incident and set out in employer policies that there are cameras in operation in reasonably assumed locations such as above tills or at entrances and exits, and that the footage will be used, if required, the employer will have been transparent with the employees.

If the various employer policies are silent on the issue of the use of CCTV footage for disciplinary action, and the employer later uses the CCTV footage for such a purpose, this may create further processing of personal data in that the footage is being used for a purpose other than that for which it was originally gathered. Although such scenarios tend to be fact specific, broadly speaking, the use of the CCTV footage in these circumstances is likely to be unlawful from a data protection perspective unless the data controller can demonstrate that they had a lawful basis under Article 6 of the General Data Protection Regulation (GDPR) for such processing or further processing of personal data.