The engagement of private investigators by employers was, up until relatively recently, a commonplace practice but is now one that is fraught with legal risk. While a number of recent cases from the Workplace Relations Commission suggest that Adjudication Officers remain willing to consider pertinent evidence that has been obtained covertly, there is likely to be a marked increase in challenges to an employer's ability to rely on such evidence once the GDPR comes into effect.

The most significant legal risk for employers who wish to engage a private investigator to conduct covert surveillance on an employee is the risk of a complaint by the employee to the Office of the Data Protection Commissioner of an infringement of their data protection rights. The Office of the Data Protection Commissioner regularly investigates such complaints and has the power to direct an employer not to use evidence obtained in breach of an employee's rights under the Data Protection Acts. Indeed, the Office of the Data Protection Commissioner's annual report frequently names and shames employers who have fallen foul of the Data Protection Acts by engaging private investigators to conduct covert surveillance on employees. With the impending introduction of GDPR, employers' concerns over the engagement of private investigators are likely to be justifiably heightened, particularly given the scope for significant monetary fines to be imposed for material infringements of GDPR.

Employers who wish to engage a private investigator to conduct covert surveillance on an employee should, at a minimum, take the following steps:

1. assess whether it is absolutely necessary to engage a private investigator and document the basis on which it has been concluded it is so;
2. ensure the private investigator is registered with, and has a valid licence from, the Private Security Authority, as an employer who engages an unlicensed private investigator could face criminal prosecution;
3. put a written contract in place with the private investigator which takes account of the guidance published by the Office of the Data Protection Commissioner on what should be included in such contracts;
4. ensure the surveillance is as limited as is reasonably practicable and that the surveillance is carried out using lawful means in areas where the subject of the surveillance does not have a reasonable expectation of privacy.

Before taking the somewhat drastic step of engaging a private investigator to conduct covert surveillance on an employee, an employer who has concerns about the veracity of an employee's medical-related absence should get the employee independently medically assessed. If those concerns are not adequately addressed via such a referral, only then should an employer consider the necessity of engaging a private investigator and take appropriate steps to ensure compliance with applicable data protection legislation.