Some employers may be surprised to discover that video footage captured by CCTV can constitute personal data under the General Data Protection Regulation (GDPR). This means that there are certain rules that must be followed when processing this data, especially in the context of using this footage as evidence of an employee’s misconduct.
The following guide for employers looks at the legal considerations when using CCTV evidence at a disciplinary, from what the law says about employers recording the activities of their employees, to best practice advice around CCTV in the context of disciplinary proceedings.
What does the law say about recording employees’ activities?
By law, employers can monitor the activities of both their staff and visitors using CCTV, although there are risks associated in doing so. These risks include potential breaches of data protection law, where GDPR covers any monitoring by an employer that includes collecting and processing images. Additional risks arise out of potential breaches of an individual’s human rights, including the right to privacy, plus the risk of undermining an employee’s trust and confidence, and irreparably damaging the employment relationship because of this.
Under GDPR, although employers are entitled to monitor employee activity, they must have a lawful basis to do so. They must also communicate in advance the fact that CCTV is installed on their premises and in active use, and the purpose for which the surveillance will be used.
Employers may install CCTV for various reasons, although typically this will be for safety and security reasons, to help safeguard their property and staff from the threat of crime. In fact, in many cases, the signage used for CCTV will state ‘This CCTV recording system is operated for purposes of security, safety and potential prosecution’. By forewarning potential offenders of the fact that they are being filmed, it is hoped that this will act as an effective deterrent.
What are employers allowed to record using CCTV technology?
The use of CCTV in the workplace is not, of itself, unlawful. However, this does not give an employer carte blanche to record anything and everything. Employers have a right to protect their legitimate business interests using CCTV, provided the deployment of cameras is necessary and proportionate, and addresses a pressing need that cannot be addressed by any other means. To be deemed lawful, this means that CCTV monitoring must not be either overly intrusive or disproportionate to the purpose for which it is intended to be used.
Where staff have a reasonable expectation of privacy, any use of CCTV will almost certainly expose an employer to potential breaches of both data protection and human rights laws, as well as breach of the implied duty of mutual trust and confidence between the parties. For example, the use of CCTV in either toilets, changing rooms or break areas would be hard to justify under any circumstances on the grounds that this would be far too intrusive and an invasion of privacy. In contrast, in public areas — such as a lobby, lift or the entrance and exit points of a building — where expectations of privacy are low, CCTV is far more easily justified.
An example of a scenario which might fall somewhere in the middle would be where CCTV monitors the entrance to each department of a workplace, but a number of workstations fall within the cameras’ view. Given that this would inadvertently result in the everyday activities of certain individuals being constantly recorded, steps would need to be taken, for example, adjusting the camera angle, to avoid any disproportionate monitoring.
In the context of covert CCTV surveillance, where cameras are secretly installed, this will only be justifiable in exceptional circumstances. This could be, for example, where there are grounds to suspect criminal activity or serious malpractice, where to notify staff of hidden CCTV would jeopardise a criminal or regulatory investigation. However, even in these circumstances, any covert surveillance should only be targeted at those under suspicion, while still ensuring that areas where privacy is expected remain private. Covert surveillance should also only be undertaken for limited periods and as part of a specific investigation.
In all other cases, employers must ensure that they display visible CCTV signage in all areas where surveillance is taking place, explaining that CCTV is in use and the reasons for this. This signage should also provide legible details of the organisation or person responsible for the CCTV system and how they can be contacted. This is because any data subject, where footage has been obtained of them in which they are identifiable, has the right of access to this data.
The law on using CCTV evidence at a disciplinary
Employers can often be tempted to use information captured on CCTV for all kinds of purposes, and while many have justifiable reasons for deploying CCTV systems, such as for the prevention and detection of crime, any further use of personal data captured in this way will be unlawful under data protection law. This can include using CCTV evidence at a disciplinary.
In accordance with the principles of fairness and transparency under GDPR, employers are only permitted to process any personal data obtained by them for the purpose(s) for which it was collected. This means that if CCTV has been installed for safety and security reasons, with signage to this effect, it would not be fair and lawful to use the footage for any other reason. This will be the case, even if the CCTV footage provides clear evidence of misconduct on the part of an employee, and even if this misconduct was only inadvertently discovered during the course of viewing footage for the purpose of crime prevention or detection.
This essentially means that CCTV footage can only be used by employers in a disciplinary context where they have clearly communicated to staff in advance that they they are being monitored, for example, to manage employees’ performance, from the amount of work that they do to potential misconduct matters. The employer must also be able to justify using CCTV to monitor employee activities for these purposes, where it may be difficult to show a need for such oppressive methods, if alternative methods are available, such as human supervision.
If an employer suspects an employee of breaking the law and letting them know about it would make it harder to detect the crime, the employer can lawfully monitor those involved without their knowledge, but only as part of a specific investigation. In these circumstances, any relevant footage could then be used as evidence against the employee to justify dismissal for gross misconduct, although these types of scenarios are likely to be exceptional. Further, if evidence of other minor misconduct is inadvertently revealed from any covert CCTV footage, this should not be used against an employee in a disciplinary context.
Legal risks for employers using CCTV evidence at a disciplinary
In many cases, the use of CCTV evidence at a disciplinary hearing will be unlawful, thereby giving rise to a number of both legal and practical risks for the business, including:
- an infringement of GDPR: if a business is found to be in breach of the GDPR, they could be liable to large fines, bans on data processing and bad publicity. This means that employers must ensure that, among other things, they have a lawful basis for processing data and that any data is not used for a purpose different to the one for which it was intended;
- a violation of human rights: if the nature of any CCTV monitoring is overly intrusive, including constant monitoring for the purposes of detecting any minor misconduct, this is likely to constitute a breach of an employees’ right to privacy;
- a breach of employee trust: if CCTV is installed without an employee’s knowledge, or CCTV evidence is used for a different purpose to that which the employees were made aware, this could easily erode any trust and confidence in the employer. If the employee feels forced to resign because of this, this could result in a claim for constructive dismissal;
- an unfair decision to dismiss: if CCTV is installed or used unlawfully, including the unlawful use of CCTV evidence in the context of a disciplinary hearing, and an employee is dismissed because of this, they may have a claim for unfair dismissal.
Using CCTV at work
Before an employer can monitor the activities of their staff and visitors using CCTV, or even consider using any footage obtained at a disciplinary hearing, they must first register as a data controller with the Information Commissioner’s Office (ICO). This will require the employer to outline the purpose of using CCTV in the workplace and pay a data protection fee.
The employer must also tell staff and visitors that they may be recorded, typically through displaying signs, which must be clearly visible and legible; ensure that footage is kept securely, controlling who has access to this; and only keep the footage for as long as is strictly necessary, typically no more than a few short months, unless there is a criminal investigation.
Where the employer is wanting to use CCTV to monitor and manage its workforce, including any misconduct matters which may arise, this must be set out in writing within a workplace policy. Employees should also be made aware of this policy during the course of any induction procedure at the start of their employment. However, the use of a written policy or statement, warning employees that their work activities are being recorded and may be used as evidence against them, does not necessarily justify this level of data processing.
In cases where the use of CCTV data in a disciplinary context can be more easily justified, where footage has been obtained because the employee was suspected of committing a criminal offence, the employer must still follow a fair disciplinary procedure. Even if the footage reveals a clear case of criminality and gross misconduct, for example, theft from the employer, the employer must provide the employee with a chance to defend their position and put forward any mitigation. The employer must also ensure that the employee is provided with a copy of the footage in advance so that they are fully appraised of the case against them.
Advice for using CCTV evidence
There are a number of best practice steps that employers can take to ensure that any use of CCTV is lawful, and as a means of minimising the risk of legal proceedings, especially when it comes to ‘using CCTV evidence at a disciplinary UK’, including:
- Carrying out a data protection impact assessment prior to CCTV deployment to weigh up whether the benefits of using CCTV justify the adverse impact on employees, and assessing any alternative means that can be deployed, such as human supervision and training
- Keeping a record of this assessment in the event of any legal proceedings
- Being fully transparent with staff about how CCTV is being used and where
- Providing clearly visible and legible GDPR-compliant signage
- Providing a workplace policy setting out the purpose(s) for which CCTV will be used, including the possible use of covert surveillance where an employee is suspected of a crime.
Need Assistance?
DavidsonMorris’ employment lawyers work with employers to support with all aspects of workplace disciplinary procedures, including advice on evidence and the use of CCTV footage. We can advise on specific matters to help your organisation ensure compliance with your legal obligations while protecting your best interests. For expert advice and support, contact us.
Using CCTV Evidence at a Disciplinary FAQs
Can I use CCTV footage as evidence in a disciplinary hearing?
CCTV footage can be used as evidence in a disciplinary hearing, provided it has been obtained lawfully and is relevant to the case. It is essential to ensure that the use of CCTV complies with the Data Protection Act 2018 and GDPR.
Do I need to inform employees about CCTV usage?
Employees must be informed that CCTV is in operation. Employers are required to be transparent about the purpose of CCTV, and this should be clearly communicated in the workplace, typically through signage and an official policy.
Can employees request access to CCTV footage?
Employees have the right to request access to personal data, including CCTV footage, under the Data Protection Act 2018. Employers must respond to such requests within one month.
Is it legal to use CCTV footage from a hidden camera in disciplinary actions?
Using footage from hidden cameras is generally not advisable unless there is a strong, justified reason, such as suspicions of criminal activity, and it is proportionate to the issue being investigated. Even then, it must comply with strict legal guidelines, and failure to do so could lead to serious legal consequences.
How long can I retain CCTV footage?
CCTV footage should only be retained for as long as necessary for the purpose it was collected. The retention period should be clearly defined in your CCTV policy, and footage should be securely deleted once it is no longer needed.
What if the CCTV footage is unclear or incomplete?
If the CCTV footage is unclear or incomplete, it may be less reliable as evidence. Employers should consider the quality and context of the footage and, where necessary, support it with additional evidence to ensure a fair disciplinary process.
Do I need employee consent to use CCTV footage in a disciplinary case?
While explicit consent may not always be required, employees must be aware that CCTV is in operation and that it may be used for disciplinary purposes. This information should be included in the company’s CCTV policy.
Can I install CCTV in private areas like toilets or changing rooms?
Installing CCTV in private areas is generally prohibited unless there is a very strong justification, such as preventing serious crime, and even then, it must comply with strict legal requirements. Any such installation must be clearly communicated to employees and be proportionate to the issue at hand.
What should be included in a workplace CCTV policy?
A workplace CCTV policy should include details about the purpose of CCTV, areas under surveillance, how footage will be used, how long it will be retained, who can access it, and employees’ rights regarding the footage. It should also outline the procedures for requesting and handling footage.
Glossary
| Term | Definition |
|---|---|
| CCTV (Closed-Circuit Television) | A video surveillance system used for monitoring and recording activities within a specific area, often used in workplaces for security purposes. |
| Data Protection Act 2018 | A UK law that governs the processing of personal data and implements the General Data Protection Regulation (GDPR) within the UK. |
| GDPR (General Data Protection Regulation) | A regulation in EU law on data protection and privacy that also applies in the UK, controlling how personal information is handled and processed. |
| Disciplinary Action | Measures taken by an employer to address an employee’s misconduct or poor performance, which can include warnings, suspension, or dismissal. |
| Surveillance | The monitoring of behaviour, activities, or information for the purpose of gathering evidence, typically through CCTV systems in the workplace. |
| CCTV Policy | A formal document outlining the use of CCTV in a workplace, including the purpose, areas covered, retention of footage, and employee rights. |
| Privacy | The right of individuals to keep their personal information secure and protected from unauthorized access, particularly in the context of CCTV surveillance. |
| Retention Period | The duration for which CCTV footage is kept before being deleted or securely disposed of, usually defined within the CCTV policy. |
| Subject Access Request (SAR) | A request made by an individual to access their personal data held by an organisation, including CCTV footage in which they appear. |
| Transparency | The principle of being open and clear with employees about the use and purpose of CCTV surveillance within the workplace. |
| Proportionality | The concept of ensuring that any surveillance conducted is appropriate and not excessive in relation to the issue being addressed. |
| Fairness | The obligation to handle CCTV footage in a way that is just and reasonable, particularly when used as evidence in disciplinary proceedings. |
| Legitimate Interest | A legal basis under GDPR that allows the processing of personal data when it is necessary for the legitimate interests of the organisation, provided it does not override the individual’s rights. |
| Covert Surveillance | The use of hidden or secret CCTV cameras, typically requiring a higher level of justification and strict legal compliance. |
Author
Founder and Managing Director Anne Morris is a fully qualified solicitor and trusted adviser to large corporates through to SMEs, providing strategic immigration and global mobility advice to support employers with UK operations to meet their workforce needs through corporate immigration.
She is a recognised by Legal 500 and Chambers as a legal expert and delivers Board-level advice on business migration and compliance risk management as well as overseeing the firm’s development of new client propositions and delivery of cost and time efficient processing of applications.
Anne is an active public speaker, immigration commentator, and immigration policy contributor and regularly hosts training sessions for employers and HR professionals
