Data Protection: CCTV Footage in Employee DisciplinaryApril 2020
The use of CCTV footage in disciplinary investigations was recently considered by the High Court in Doolin v The Data Protection Commissioner. In a decision that will be of interest to HR and data protection professionals, Hyland J considered that CCTV footage can be used by employers for specified purposes including disciplinary procedures provided this purpose is made clear to employees.
The case highlights, however, that while the purposes specified by an employer have some flexibility in interpretation, they will not be broadly interpreted.
The case arose in the context of a security investigation by Our Lady’s Hospice and Care Services (“OLHCS”) into graffiti on the walls of a staff room – graffiti which could have indicated terrorist activity. A CCTV camera was located in the premises, beside a sign indicating that “images are recorded for the purposes of health and safety and crime prevention”, and footage from that camera was reviewed. OLHCS noted from this footage that Mr Doolin had used the break room on a number of occasions when he was not authorised to do so.
This led to the commencement of a disciplinary process concerning the alleged taking of unauthorised breaks, and Mr Doolin was subsequently sanctioned. Mr Doolin complained to the Data Protection Commissioner about the use of his data in the disciplinary investigation. In particular, he complained about the “further processing” of the CCTV footage in the context of a disciplinary procedure. He was unsuccessful in the Circuit Court, and appealed again to the High Court. The High Court upheld Mr Doolin’s complaint.
Further Processing and Incompatible Purposes
The security and disciplinary investigations took place under the pre-GDPR data protection regime, the Data Protection Acts 1988-2003. Section 2(1)(c) of the 1988 Act contains the purpose limitation principle, i.e. data obtained for one or more specific, explicit and legitimate purpose should not be further processed in a manner incompatible with that purpose or purposes.
The purposes specified for the processing the CCTV footage were “health and safety and crime prevention”. The questions of law faced by the High Court were whether the use of information obtained from the CCTV footage in the disciplinary procedure (a) constituted a “further processing” of the CCTV footage and, if so, (b) whether this processing was for purposes incompatible with health and safety and crime prevention.
In the absence of case law on the meaning of “further processing”, the High Court looked to guidance from the European Data Protection Board, formerly the Article 29 Working Party.2 Hyland J discussed the meaning of incompatibility from the guidance. She noted that legislators intended some flexibility on further processing of personal data and that, while a different purpose is not necessarily an incompatible purpose, this must be assessed on a case by case basis.
While the legislative framework for data protection has changed since this case arose, the principles considered by the High Court remain in place. The principle of purpose limitation, in particular, continues in Article 5(1)(b) of the GDPR. The threshold of an “incompatible” purpose for further processing has been retained.
By Judy de Castro - Regulatory Consultant