ISIS death threats and unauthorised breaks – when can an employer use CCTV in workplace investigations?

The High Court has recently found fault with an employer for viewing CCTV footage for one purpose (namely investigating graffiti involving ISIS-related death threats) but using it for a different purpose, namely disciplining an employee for taking unauthorised breaks.  The case underlines the need for employers to have data protection policies that are sufficiently broad to allow an employer to use workplace CCTV for legitimate purposes.  If an employer has a data protection policy that is too narrowly drafted, the policy may prevent the employer from using its own CCTV footage.

The case of Cormac Doolin -v- The Data Protection Commission and Our Lady’s Hospice And Care Services  [2020] IEHC 90 involves an appeal on a point of law from the Circuit Court decision under the Data Protection Act 1988 (the "1988 Act"). Although the case originates from before the coming into effect of the General Data Protection Regulation (GDPR), the same principles would apply to a case taken under the GDPR.

Background

A threatening graffiti message was left in a staff room. It said "Kill all whites, ISIS is my life”. The OLHCS reviewed CCTV footage in order to identify the persons who had accessed the staff room on the relevant days. This footage identified the Appellant as one of a number of staff members who had accessed the staff room on these dates.  The OLHCS commenced an investigation into the offensive message as well as staff members taking unauthorised breaks.  An investigation report, solely in respect of the investigation relating to staff members accessing the room at unauthorised times, found that the Appellant had taken unauthorised breaks. The Appellant was subsequently invited to attend a disciplinary hearing and he appears to have received a minor sanction.

The relevant law

Section 2(1)(c) of the 1988 Act provides that:

“2(1) A data controller shall, as respects personal data kept by him or her, comply with the following provisions: …

“(c) the data - 

(i) shall have been obtained only for one or more specified, explicit and legitimate purposes, 

(ii) shall not be further processed in a manner incompatible with that purpose or those purposes…”

The GDPR contains a similar provision at Article 5(1)(b), which states that personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Therefore, the lessons from this case are equally applicable since the coming into effect of the GDPR 

Complaint to the Data Protection Commission

The Appellant made a complaint to the Data Protection Commission ("DPC") about the use of his data.  The DPC summarised this complaint as being that the OLHCS “used the CCTV footage for disciplinary proceedings related to unauthorised breaks." OLHSC stated that the investigation panel did not view the CCTV footage after interviewing staff members. It stated that the footage showed staff entering the room when there was no work-related reason for them to be there and, when asked about it in interviews, some staff admitted to taking an unofficial additional break. OLHCS asserted that disciplinary action was taken on the basis of those admissions. Accordingly, OLHCS stated that the Appellant's personal information was not processed by it by using CCTV as part of the disciplinary matter.

The Appellant clarified to the DPC that it was not CCTV footage that was used to sanction him but rather the "data retrieved, processed and used in an incorrect/unfair manner, from CCTV footage, that led to [his] illegal sanction". 

The DPC found that, although information gathered from the initial viewing of the CCTV for the correct purpose (i.e. the investigation of a security incident) may subsequently have been used for another purpose (i.e. disciplinary proceedings), this did not constitute a different purpose because the CCTV images were not further processed for that purpose. 

Circuit Court decision

The Appellant initiated Circuit Court proceedings against the DPC on the grounds that the DPC had erred in fact and/or law in “determining that the Appellant's employer was not in violation of section 2, and in particular section 2(1)(c) of the Data Protection Acts applicable by reason of the said employer's use of the Appellant's data for reasons unrelated to the purpose for which such data was originally processed and/or in breach of the CCTV policy in being”.

During the Circuit Court proceedings, the DPC’s primary defence was that the OLHCS’ further use of the information taken from the CCTV footage for the disciplinary proceedings was for the same purpose as the original one, i.e. security purposes as unauthorised entry into the break room was a security concern. The High Court found that this was a significantly different approach to the approach taken in the DPC's initial decision. In its initial decision, that DPC's sole justification for rejecting the Appellant's complaint was that, even though the data taken from the initial viewing of the CCTV footage may have been used for a different purpose, the CCTV images were not further processed for that second purpose, for example, they were not viewed as part of the disciplinary proceedings against the Appellant. 

The High Court found that this defence approach became the sole basis for the rejection by the Circuit Court of the Appellant's appeal. 

High Court decision

The High Court allowed the appeal against the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the use of the CCTV footage or material derived from it in the disciplinary hearing was for security purposes.  The High Court also concluded that the DPC made an error of law in holding that no further processing took place as this conclusion was founded upon an incorrect interpretation of “processing” having regard to the terms of the legislation.

The High Court noted that there was a sign beside the CCTV cameras in the OLHCS which stated that   “Images are recorded for the purposes of health and safety and crime prevention” and that this was consistent with the relevant CCTV Policy of OLHCS at the time, which stated that the use of CCTV in OLHCS was, “to prevent crime and to promote staff security and public safety”.  

After the incident occurred, the OLHCS amended its policy to provide that “…The purpose of the system is to prevent crime and promote staff security and public safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff”.  

The High Court found that if, “at the time of collection, the policy was as it is now, none of the above difficulties would have arisen…Where a processor wishes to use CCTV data for identified purposes, if those purposes are clearly identified before the material is collected (assuming of course that they are otherwise permissible purposes having regard to the Act) then the use of such material is likely to be uncontroversial.”

The employer’s problem in this case was that its own CCTV policy was – at the time of the incident – too restrictive. By having an unnecessarily restrictive policy (limited to preventing crime and promoting staff security and public safety) the employer had limited the extent to which it could use its own CCTV footage.

Lesson for employers – make sure CCTV policies are not too restrictive

It is advisable for employers to review CCTV policies in order to ensure that such policies expressly allow the employers to use CCTV footage in disciplinary processes.  Employers are entitled to say that the primary purpose of CCTV is security and that CCTV will not be routinely used for monitoring staff performance/attendance. However, if employers make clear that CCTV footage may be used in disciplinary proceedings if a performance/attendance issue comes to light while the employer is investigating a separate security concern, then the employer may use the CCTV footage in addressing that performance/attendance issue.

For further information or advice on disciplinary procedures or other issues related to this update, please contact Loughlin Deegan or any member of the ByrneWallace Employment Law Team.