THE CHALLENGE: HR manager Jackie has been informed that Howard suspects an
employee of stealing money from the till. He wants the company to install
closed circuit television cameras (CCTV) to find out who the thief is. Nicole
Hallegua a solicitor at Berwin Leighton Paisner weighs up the implications
involved under the Data Protection Act
Legal issues
Prior to the Data Protection Act 1998, which came into force on 1 March
2000, there was no statutory regulation on the use of CCTV in the workplace.
The Act places responsibilities on companies to process personal data (data
relating to identifiable living individuals), which it holds in a fair and
proper way.
There are both civil and criminal penalties for breaching the Act. The
Information Commissioner has published a draft code on the use of personal data
in the workplace. It is intended to help employers comply with the Act and
establish good practice regarding the handling of personal data in the
workplace.
The code applies to all aspects of monitoring employees in the workplace,
including the use of CCTV. While it is not legally enforceable, it contains the
Information Commissioner’s recommendations on how the legal requirements of the
Act can be complied with and may be cited in any enforcement action. The
company would, therefore, be strongly advised to follow the code. Under the
code, employers must:
– Ensure that they have a specific purpose for introducing the CCTV before
they put it into operation. This is important, as it will affect whether the monitoring,
particularly if it is to be covert, is permissible.
– Determine if and how the CCTV monitoring should be introduced by carrying
out a detailed impact assessment. This must take into account that the
monitoring must be no more than is necessary and proportionate to achieve the
business purpose. Accordingly, monitoring by CCTV in parts of the workplace
other than where the employer suspects that a criminal act is being committed
will not be justified.
– In most cases staff should be made aware that they are being monitored.
They should also know why the CCTV is being introduced. This is not necessary
where the monitoring is being introduced to prevent or detect criminal
activity, as it may tip off the person being monitored.
– Visitors or customers who are likely to be captured by monitoring should
also be made aware that it is in operation and told the reasons why they are
being watched. However, again, this may not be practicable if it is likely to
tip-off the people the company wants to monitor.
– The employer must also not use personal information collected through CCTV
monitoring for purposes other than the prevention or detection of the criminal
activity for which monitoring was introduced. The only exception is when the
information is such that no reasonable employer could ignore it because, for
example, it reveals other criminal activity or gross misconduct. Once the
purpose for which the monitoring was introduced has been achieved the
monitoring must cease
– Lastly, all CCTV footage should be securely locked away from prying eyes.
The company has legal duties and responsibilities regarding the collection and
use of CCTV footage including a common law duty of confidence. Any footage
should only be used for the purposes for which it was intended and not be sold
or given to any unauthorised person.
HR issues
In Jackie’s case she needs to ensure that the employer ascertains the
purpose for which the CCTV surveillance is required.
The employer also needs to ensure that an impact assessment has been carried
out and that CCTV is necessary and proportionate for the purpose identified.
This assessment should consider a number of factors, such as the benefits of
monitoring, any adverse impact it might have on staff and whether the firm can
achieve similar benefits by using a less intrusive method.
The employer should also ensure all discussions regarding the CCTV
surveillance, including the impact assessment, are properly documented. If CCTV
is to be used, all employees affected need to know why (unless this defeats the
object of introducing the CCTV – such as the prevention or detection of
criminal activity).
The employer should also ensure that the CCTV is not used for any other
purposes and for no longer than is absolutely necessary.
In this case, Howard should be made aware of his duty not to misuse the
information collected by CCTV. He should also be instructed not to act on any
information collected by it without giving the employee an opportunity to
respond.
The information collected should be destroyed if it is not to be used for
the intended purpose, unless other misconduct is revealed.
Comments are closed.