The GDPR non-compliant use of recordings made by an employee in order to punish a colleague
The Spanish data protection authority imposed a fine of 12,000 EUR (eventually reduced to 9,600 EUR) on an employer (restaurant) who applied disciplinary sanctions against one of its employees based on evidence from video recordings made by another employee with his private phone.
The authority found that the penalised worker had not been informed that his professional activities could be monitored. There were cameras installed in the restaurant but they were out of order. The employer used recordings made by another employee without the person recorded on video being aware of this fact, thus violating the principle of data processing transparency (Art. 5 sec. 1 item a) of GDPR).
The Polish legislative body also attaches great importance to the obligation to inform the employee about the monitoring applied. Before introducing video surveillance, the employer must inform the employees about this fact, at the latest 2 weeks before it is activated. Additionally, as for new employees, the employer is obliged to inform them individually in writing about the use of video surveillance before the employee commences work. None the less, all the premises and the area under surveillance must be marked in an appropriate manner not later than one day before the start of the surveillance activity, and the fulfilment of this obligation doesn’t exclude the need to comply with the obligation to provide information under Articles 12 and 13 of GDPR. In this context, however, it is worth bearing in mind the recent judgement of the ECHR of October 17, 2019, in the case of López Ribalda and others versus Spain, which found that the hidden surveillance device used to detect the perpetrator of repeated thefts was legal. In special cases, as it transpires, it may be that the use of hidden surveillance solutions is the only solution available. Having said that, the issue should be approached with great caution.