The use of CCTV footage in disciplinary proceedings has developed as a key feature in employment disputes over the past number of years. This issue was more recently considered in Doolin v The Data Protection Commissioner [2020] IEHC 90, where the High Court determined that the permissible use of CCTV footage in an investigation to promote security and safety was unlawfully further processed in a disciplinary process.

This decision serves as a stark reminder to employers on the importance of processing employee data in a manner that is consistent with the original purpose for which it was collected and to ensure that its data protection policy is reviewed and updated on a regular basis.

Background

On 19 November 2015, Our Lady’s Hospice and Care Services (the “Employer”) discovered a threatening graffiti message in a staff room, which stated “Kill all whites, ISIS is my life”. As advised by An Garda Síochána, the Employer subsequently examined the CCTV footage which recorded the corridor leading to the staff room in question. The sign beside the CCTV camera and the CCTV policy provided that the CCTV camera was in place for the purposes of health, safety, and crime prevention. The CCTV footage was reviewed to identify those persons who entered/left the staff room. Mr Doolin (the “Appellant”), was one of a number of staff members identified on the CCTV footage accessing the staff room.

The Employer wrote to the Appellant stating that it had commenced a formal investigation under its Disciplinary Policy into the following:

• An offensive graffiti message which was found in the staff room, namely for the purpose of preventing crime and promoting staff security and public safety.
• The use of unauthorised breaks, namely for the purpose of disciplining the employee.

While the investigation panel noted that it would only rely on admissions by the Appellant rather than any information derived from the CCTV footage, the investigation report indicated that the CCTV footage was also considered to determine that the Appellant had taken unauthorised breaks by accessing the staff room on three consecutive afternoons. As a result, the investigation panel established on the balance of probabilities that unauthorised breaks were being taken by the Appellant and at a subsequent disciplinary hearing, the Appellant was given a minor sanction.

Decision of the Data Protection Commissioner and the Circuit Court

The Appellant made a complaint to the Data Protection Commission (the “DPC”) about the use of his data, namely that his personal data which derived from the CCTV footage, was further processed and used in an incorrect/unfair manner, which lead to an illegal sanction. The Appellant alleged that this was in breach of Section 2(1)(c) of the Data Protection Acts 1998-2003, which is reflected in Article 5(1)(b) of the GDPR. The DPC found in favour of the Employer on the basis that:

(i)              the Employer had a legitimate justification in accessing and viewing the CCTV footage, which was to prevent crime and to promote staff security and public safety in relation to the graffiti incident, in accordance with its CCTV policy; and

(ii)            While the CCTV footage was originally used for the purpose of promoting staff security and public safety, its use in the subsequent disciplinary proceedings did not constitute a different purpose as it was not further processed in the context of the disciplinary proceedings. For example, as the CCTV footage was not viewed or downloaded during the disciplinary proceedings it could not be considered as having been further processed.

The Appellant appealed the DPC’s decision to the Circuit Court on the grounds that the DPC had erred in fact and/or law. In the Circuit Court, the DPC submitted an alternative argument to the effect that the taking of an unauthorised break by the Appellant was a valid security concern on the part of the Employer and, as a result, the use of the CCTV footage in the subsequent disciplinary proceedings was consistent with the purpose of its use in the original investigation i.e. to promote staff security and public safety. The Circuit Court accepted this argument and upheld the decision of the DPC.

High Court Decision

In dismissing the DPC’s arguments, Justice Hyland found that the CCTV footage was further processed by using it for a distinct and separate purpose in the disciplinary proceedings. In addition, Justice Hyland rejected the DPC’s argument in the Circuit Court that the use of the CCTV footage in the disciplinary process was for the purpose of staff security and public safety as there was “no evidence at all” to support this argument. In overturning the decision of the Circuit Court, the High Court found that:

(i)              there was no evidence that the use of the CCTV footage in the disciplinary hearing was for security purposes; and

(ii)            the DPC made an error of law in holding that no further processing of the CCTV footage took place.

Interestingly, Justice Hyland further noted that after the graffiti incident, the Employer amended its CCTV policy to state “If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff.” The Court stated had the CCTV material been intended to be used for disciplinary purposes, as well as for staff security and public safety, the policy would have reflected this at that time.

Key Considerations for Employers

This case highlights the importance of implementing effective and robust data protection policies and procedures in relation to employees. This includes:

• clearly defining the purpose for installing CCTV cameras and that there is a lawful basis for this in accordance with Article 6 of the GDPR;
• communicating and informing employees and/or other data subjects on how CCTV footage may be used. Employers should ensure that employees have access to the data protection policies and re-circulate these policies where any further amendments have been made. In addition to including this information in the data protection policy and privacy statement, the employer should ensure that appropriate signage is displayed which indicates the purpose of the CCTV footage;
• linking policies in with each other in a consistent manner e.g. the data protection policy and the disciplinary policy should each contain a reference to the other where it is the case that CCTV footage can be used in disciplinary matters.

Our Employment & Corporate Immigration Team regularly advises employers on drafting and updating policies and has extensive experience advising on a range of employment and data protection related issues/disputes arising in the above context. For further information, please contact Bláthnaid Evans or Sheila Spokes, +353 1 639 3000 or visit www.leman.ie.