In a previous article available here we discussed the judgement given by the High Court in Doolin v. The Data Protection Commissioner [2020] IECH90.

The High Court’s decision was appealed to the Court of Appeal by the DPC. The Court of Appeal in its decision held that the use of CCTV footage in the disciplinary process was unlawful, as the employer’s CCTV policy confirmed that CCTV footage was only collected and processed for the specific purpose of security.   As such, the employee could not have reasonably expected that the footage would be used to monitor his performance.

It was held that this difference in purpose was in contravention of the Data Protection Act, 1988 – 2003 (the “Act”), which requires data processors to properly notify data subjects about the specified purpose that data is collected.

Background

Mr Doolin (the “Employee”) was employed by Our Lady’s Hospice and Care Services (the “Employer”). In 2015, a threatening graffiti message which stated “Kill all whites, ISIS is my life” was discovered carved into a table in the staffroom.

The graffiti prompted a security review by the Employer as the graffiti was found one week after the terror attacks in Paris. The staffroom was only accessible to staff members who used electronic fobs to get inside.

On the advice of gardaí, the Employer reviewed the CCTV footage which recorded the corridor leading to the staffroom to identify all people who entered the room. During the review of the footage, the Employeewas observed entering the room on several occasions and it was established that he was taking long, unauthorised breaks during the day. Whilst the Employee was not accused of carving the graffiti into the table, the Employer initiated disciplinary proceedings against the Employee.

During the disciplinary hearing, it was put to the Employee that he had taken breaks between 45 and 55 minutes on three consecutive days. The Employee admitted that he had taken those unauthorised breaks and the Employee was ultimately given a minor disciplinary sanction on conclusion of the disciplinary process. In the final disciplinary report, it was made clear that the CCTV footage was considered to determine whether the Employee had taken unauthorised breaks on three consecutive afternoons.

Decision of the Data Protection Commissioner, Circuit Court and the High Court

Following the outcome of the disciplinary process, the Employee raised a complaint to the Data Protection Commissioner (the “DPC”) on the basis that the Employer’s CCTV policy stated that the use of CCTV footage was solely for the purposes of security. Furthermore, the signage in the area stated that CCTV images were recorded for health, safety and crime prevention. In these circumstances, the Employee submitted that the use of CCTV footage during the disciplinary process was unlawful because his personal data was processed and used in an incorrect and unfair manner which resulted in an illegal sanction.

The DPC found in favour of the Employer and stated that the personal data consisted solely of the Employee’s image and that the CCTV footage was reviewed without any further processing by the Employer. The DPC also found that the data was processed in connection with the security incident only and that the use of the CCTV footage during the disciplinary proceedings against the Employee did not constitute a different purpose.

This decision was appealed to the Circuit Court by the Employee, which upheld the appeal.

The matter was appealed again by the DPC to the High Court.  The High Court determined that the data had been lawfully collected for security purposes but had been impermissibly used for the “distinct and separate purpose” of discipline. Accordingly, the High Court held that the processing was unlawful. The DPC appealed the High Court’s decision to the Court of Appeal.

Decision of the Court of Appeal

The Court of Appeal noted that the Act applied and that the case primarily concerned section 2(1)(c)(ii), which states that data “shall not be further processed in a matter incompatible” with the specified purposes. The Court of Appeal also noted that the relevant principles on statutory appeals were contained in Deely v Information Commissioner [2001] 3 IR 439, which included that findings of fact could not be set aside unless there was no evidence to support such findings and that a decision could be set aside if the DPC had taken an erroneous view of the law.

In reaching its decision, the Court of Appeal had regard to the views of the “Working Party” established under the Data Protection Directive, 1995. The Working Party stated that the limitation of data collection was necessary to protect individuals by setting limits on how data controller’s use data. Furthermore, processing was not necessarily incompatible with a specified purpose and had to be assessed on a case-by-case basis.

Mr Justice Noonan in the Court of Appeal held that the Employee’s personal data was processed more than once and that the DPC had made a “manifest error” in finding otherwise. The CCTV footage disclosed information which went beyond the Employee’s image, including where he was and when. In addition to this, Mr Justice Noonan held that the DPC was incorrect to state that processing only occurred when the CCTV footage was viewed by the Employer. In fact, it was processed three times:

a)    it was initially processed when it was recorded;

b)    it was then processed once more when it was accessed by the investigators; and

c)    processing then occurred a third time when data of dates and times were set out in the final disciplinary report.

Mr Justice Noonan held that there were “plainly two investigations or at a minimum, one investigation into two different matters.” In these circumstances, it could not be said that the disciplinary investigation was conducted for the purpose of security. The final disciplinary report itself described that the investigation was conducted for the purposes of investigating a staff member’s access to the tearoom.

Finally, the Court of Appeal considered whether the data being used for a different purpose was incompatible with the specified purpose of security. In this case, the viewing of CCTV to identify the perpetrator who was responsible for the graffiti in the staffroom was “entirely irrelevant to the incidental observation of” the Employee “taking unauthorised breaks.” There was no evidence to suggest that these breaks warranted security issues in themselves.

Conclusion

The Court of Appeal determined that the concept of notification to the data subject for the purpose of data collection was central to the case. Under the Act, data is not processed fairly unless the data subject is made aware of the purpose of processing at or before the data is obtained, it cannot be remedied after the fact.

In this case, the Employee had not been notified that the CCTV footage could be used to investigate disciplinary matters and there was no basis that he might have reasonably expected it to be used as such. The data was used for a purpose other than the specified purpose and in these circumstances the processing of that data was unlawful. As such the Court of Appeal dismissed the appeal.

Key Considerations for Employers

As we previously reported, this case highlights the importance of implementing effective and robust data protection policies and procedures in relation to employees, and indeed the proper usage of CCTV footage. This includes:

• Clearly defining the purpose for installing CCTV cameras and ensure that there is a lawful basis for doing so, in accordance with Article 6 of the GDPR.
• Ensuring that employees and/or other data subjects are aware of how CCTV footage may be used.
• Providing employees with and ensuring they have access to the organisation’s data protection policies. If there are any amendments made to these policies, the employer should re-circulate them and highlight any changes.
• Ensuring that appropriate signage is displayed where CCTV footage is being captured. This signage should explicitly indicate that the CCTV footage can be used in disciplinary matters.
• Ensuring that the relevant policies refer to and are consistent with each other. For example, the data protection policy and the disciplinary policy should each make reference to the other where it is the case that CCTV footage can be used in disciplinary matters.