Workplace monitoring – what is the employer allowed to do?

The Personal Data Protection Office has published guidelines on its website regarding the use of video surveillance in the workplace. It also includes answers to frequently asked questions. Among many useful pieces of information, particular attention should be given to the reminder about the employer’s obligation to inform employees, including where surveillance is located and the requirement to provide recordings to employees upon request.

Not only labour law

The principles for using video surveillance in the workplace are regulated by the Labour Code. However, it should be remembered that when an image is recorded by cameras and includes employees’ likenesses, this constitutes the processing of personal data. Therefore, in such cases, the employer must also take into account the provisions of the GDPR.

On 10 July 2019, the European Data Protection Board adopted Guidelines 3/2019 on the processing of personal data through video devices, aimed at clarifying how the GDPR applies to the processing of personal data through video devices and ensuring consistent application of the General Data Protection Regulation in this area. These guidelines indicate, among other things, that when selecting technical solutions, the data controller should consider privacy-friendly technologies that enhance security. Examples of such technologies include systems that enable masking or blurring of areas not relevant to the monitored zone.

An employer choosing to implement video surveillance in the workplace should specify the exact purpose for which it will be used. Surveillance should serve to ensure the safety of employees, protect property, monitor production, or safeguard confidentiality of information, the disclosure of which could harm the employer. The area under surveillance may include the workplace or its surrounding premises.

Employer’s information obligation

An employer using video surveillance should inform individuals who may potentially be affected that monitoring is in use and indicate the area it covers. The employer must also fulfil the information obligation under Article 13 of the GDPR, which includes providing its name, address, the area and purpose of monitoring, the period for which data is processed — which is also important for asserting claims — and the possible recipients of the data.

Employees must be aware that surveillance has been implemented in the area in which they are present. In accordance with the Labour Code, the employer must mark monitored rooms and areas in a visible and legible way, using appropriate signs or audible notices, no later than one day before surveillance is activated.

Information boards about installed monitoring should be clearly visible, permanently placed, and not too far from the monitored area. Their dimensions must be proportional to the location in which they are displayed. Additionally, pictograms indicating camera surveillance may be used. However, due to the requirement to fulfil the information obligation set out in Article 13 of the GDPR, it is not sufficient to mark the monitored area with pictograms alone. This does not mean, however, that all the information specified in this provision must be placed on the information board. In such cases, layered information notices may be used. Thus, it is sufficient for the board to contain information on who is conducting the surveillance, the purpose and legal basis for monitoring, and the contact details of the Data Protection Officer (if appointed). It should also indicate the area covered by the surveillance, the rights of the observed person, and where further details can be found.

At the same time, it should be emphasised that the employer must include information about the objectives, scope, and method of applying video surveillance in a collective labour agreement or work regulations, or in an announcement if the employer is not covered by a collective agreement or not obliged to establish work regulations.

What about recording audio?

Surveillance is a technical measure that enables the recording of images. Consequently, video surveillance must not record sound. The use of cameras that also record audio — in cases not regulated by law — may be considered a violation of privacy and an excessive form of data processing, potentially resulting in administrative, civil, and even criminal liability. Moreover, recording both image and sound may reveal legally protected secrets.

The Labour Code contains a closed list of areas where surveillance is prohibited, such as toilets, changing rooms, or social rooms — unless such monitoring is necessary to achieve a specific aim and does not violate the dignity or other personal rights of employees, particularly by using techniques that prevent identification of individuals present in those rooms. Surveillance of sanitary facilities requires prior consent from the workplace trade union organisation, or if none exists, from employee representatives elected in accordance with procedures in place at the employer.

The monitored area should also be limited to what is strictly necessary, so as to process only data required to achieve the intended surveillance purpose.

It is important to stress that this regulation gives the employer the right to use video surveillance, but it is not an obligation. Introducing this form of surveillance should be preceded by a thorough analysis of its necessity, determining that no less privacy-intrusive means are available to ensure, for example, employee safety.

The Labour Code provides a closed list of situations in which this specific form of data processing may be introduced. Therefore, it must not be extended beyond this scope and used, for example, to evaluate employee performance. This would violate their privacy, which employees retain even in the workplace.

An employer using tools that interfere with employees’ privacy must follow specific rules and remember that private life may extend into the professional sphere of the individual.

Employee rights under the GDPR

An employer, when asked by an employee to provide recordings from video surveillance concerning them, should consider such a request. The basis for this is Article 15(1) of the GDPR. The controller is required to provide the individual with information regarding the processing of their personal data, such as the purpose of processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be disclosed, the planned data retention period, and other information listed in the aforementioned article.

It is important to remember that under Article 15(1) of the GDPR — the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed. The controller must provide the data subject with a copy of the personal data being processed (e.g. a copy of the video recordings). If the data subject requests the copy in electronic form, and does not specify otherwise, the information should be provided in a commonly used electronic format.