In one of our previous texts we wrote about the recent decision of the Spanish personal data protection authority, by which it fined an employer as the controller of personal data for using the option of audio recording within the employees surveillance system, which data were subsequently used for termination of an employment contract.
Considering that the issue of using video surveillance at the workplace is a highly important topic in the context of personal data protection, given that the Serbian employers are increasingly using different tools for surveillance over the work of their employees, such as video surveillance, GPS, software for supervising the use of computers etc., we will refer below to two more decisions of European personal data protection authorities that have been enacted recently.
Estonia
According to the decision of the Estonian personal data protection authority, the use of security cameras for video surveillance over employees cannot be based on employees’ consent, but rather on the existence of legitimate interest of the employer, which has been properly established.
Namely, the Estonian Data Protection Inspectorate instituted ex officio investigation against one hotel for establishing on what basis and for what purposes they used the installed security cameras, on which occasion the employer provided employees’ consent as a basis for personal data processing. However, the acting authority found, in accordance with relevant provisions of the GDPR, that the employee’s consent cannot represent a valid basis for personal data processing in employment relations, i.e., that such processing can be based solely on the existence of legal or contractual obligation of the employer or its established legitimate interest.
Croatia
Even if there is relevant basis for processing employees’ personal data by using the system of video surveillance, i.e., security cameras, such cameras may not be randomly directed as there are certain restrictions in this sense as well.
The Croatian Personal Data Protection Agency has – albeit in a case which does not refer to relations between employees and employers, but which can certainly present a general instruction in this respect – ordered the personal data controller to change the angle of the installed cameras. Namely, acting upon a complaint, the stated authority found that the cameras installed by one residential community were positioned as to cover a part of public space around the building as well. Referring to the GDPR provisions and local personal data protection regulation, the acting authority ordered the adjustment of camera positions so that they do not cover the public space, given the lack of basis for such processing.
Video surveillance in terms of domestic legislation
The use of video surveillance, as well as control of arrival to and departure from work, and communication of employees through different devices, represent the personal data processing. Therefore, such activities must be performed in accordance with the provisions of the Law on Personal Data Protection (Official Gazette of RS no. 87/2018) (“the Law”), i.e., respecting the prescribed principles of processing, along with providing appropriate information to employees in that respect.
The above particularly implies that the employer shall be obliged to establish legitimate interest for such processing in advance, while it is necessary to distinguish the terms “legitimate interest” and “purpose of processing” since legitimate interest, in terms of the Law, is a wider notion, i.e., the reason for data processing.
The model of act on the assessment of legitimate interest as a legal basis for personal data processing is available at the website of the Commissioner for Information of Public Importance and Personal Data Protection.
By Ivana Ruzicic, Partner, and Lara Maksimovic, Senior Associate, PR Legal
