knowledge 24 March 2020 |

Use of CCTV in Disciplinary Processes: High Court rules on “further processing” of CCTV footage in an employee disciplinary action

Background

The case arose in the context of a security investigation by Our Lady’s Hospice and Care Services (“OLHCS”) into graffiti on the walls of a staff room – graffiti which could have indicated terrorist activity.  A CCTV camera was located in the premises, beside a sign indicating that “images are recorded for the purposes of health and safety and crime prevention”, and footage from that camera was reviewed.  OLHCS noted from this footage that Mr Doolin had used the break room on a number of occasions when he was not authorised to do so. This led to the commencement of a disciplinary process concerning the alleged taking of unauthorised breaks, and Mr Doolin was subsequently sanctioned. 

Mr Doolin complained to the Data Protection Commissioner about the use of his data in the disciplinary investigation.  In particular, he complained about the “further processing” of the CCTV footage in the context of a disciplinary procedure.  He was unsuccessful in the Circuit Court, and appealed again to the High Court. The High Court upheld Mr Doolin’s complaint.

Further Processing and Incompatible Purposes

The security and disciplinary investigations took place under the pre-GDPR data protection regime, the Data Protection Acts 1988-2003.  Section 2(1)(c) of the 1988 Act contains the purpose limitation principle, i.e. data obtained for one or more specific, explicit and legitimate purpose should not be further processed in a manner incompatible with that purpose or purposes.  The purposes specified for the processing the CCTV footage were “health and safety and crime prevention”.  The questions of law faced by the High Court were whether the use of information obtained from the CCTV footage in the disciplinary procedure (a) constituted a “further processing” of the CCTV footage and, if so, (b) whether this processing was for purposes incompatible with health and safety and crime prevention.

In the absence of case law on the meaning of “further processing”, the High Court looked to guidance from the European Data Protection Board, formerly the Article 29 Working Party.² Hyland J discussed the meaning of incompatibility from the guidance.  She noted that legislators intended some flexibility on further processing of personal data and that, while a different purpose is not necessarily an incompatible purpose, this must be assessed on a case by case basis.

Approach Taken

The judge was satisfied that there was further processing of the CCTV footage in the context of the disciplinary investigation.  OLHCS argued that only information garnered from the CCTV footage (rather than the footage itself) was used in the context of the disciplinary investigation so there was no further processing of the CCTV footage.  However, the Court found the terms of the investigation report indicated the disciplinary panel had regard to the CCTV footage itself.  On this basis, the Court found there was further processing of the CCTV footage.

The Court then turned to the question of whether the further processing was for a purpose incompatible with the original purposes of health and safety and crime prevention.  The Court rejected an argument that security was the purpose of processing during the disciplinary investigation as unsupported by evidence.  The Court concluded the processing at this stage was for the separate and distinct purpose of disciplinary proceedings into unauthorised breaks by an employee.  On this basis, it found that the further processing of the CCTV footage was for a purpose incompatible with the original purposes. 

The Court noted that the OLHCS policy was subsequently amended to address the point at issue in the case, as follows:

“The purpose of the system is to prevent crime and promote staff security and public safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff”.  

The judge observed that “if, at the time of collection, the policy was as it is now, none of the above difficulties would have arisen.” She further commented that where a processor wishes to use CCTV data for identified purposes, if those purposes are clearly identified before the material is collected (assuming of course that they are otherwise permissible purposes having regard to data protection law) then the use of such material is likely to be uncontroversial.

Commentary

While the legislative framework for data protection has changed since this case arose, the principles considered by the High Court remain in place.  The principle of purpose limitation, in particular, continues in Article 5(1)(b) of the GDPR.  The threshold of an “incompatible” purpose for further processing has been retained. 

In this case, the High Court has provided interesting guidance on the principle of incompatible purposes for further processing.  Here, the separate and distinct nature of the disciplinary investigation rendered it incompatible with the original purposes of collection.  However, the Court indicates this assessment of incompatibility should be made on a case by case basis so ultimately it will be a question of fact in a given scenario.

HR and data protection practitioners should note Hyland J’s comments on the need to clearly specify the purposes for which CCTV can be used, and should review their employee Privacy Policy and CCTV signage to ensure that disciplinary processes are appropriately catered for.

How we can help

The Technology and Innovation and Employment Groups at McCann FitzGerald have significant experience advising on employee data protection matters and on the conduct of disciplinary process, including processes which are based on CCTV evidence.

Your usual contact in McCann FitzGerald would be happy to provide further information.