The Court of Appeal delivered what is expected to be the final adjudication on what appeared, at first instance, to be a relatively minor disciplinary infringement infraction regarding the upbraiding of an employee for taking unauthorised breaks over 3 separate periods in his place of employment (a hospice). Management had been advised in 2015 by the Gardai to try to identify the perpetrator of some graffiti that had terrorist overtones. CCTV notices in the buildings made staff and visitors aware that their images were recorded for the purposes of health and safety and crime prevention. The Hospice CCTV policy states that the purpose of the system is “to prevent crime and promote staff security.“
When management reviewed the images recorded in the area in which the graffiti had been written they noticed that an employee had entered the room on numerous occasions for what was considered to be taking unauthorised breaks. There was never a suggestion that he had vandalised the property. This led to a disciplinary sanction against the employee.
The employee made a complaint to the Data Protection Commission (DPC) who rejected the complaint as it was of the view that the processing of the data (the employee’s images) in relation to the security concerns was legitimate. They said that as there wasn’t any downloading of the data, the viewing was necessary and did not go beyond its stated purpose. The employee unsuccessfully appealed to the Circuit Court and then appealed to the High Court, who found against the DPC’s decision on the ground that “the collection of the CCTV footage was for the express and exclusive purpose of security and was used (permissibly) for that purpose, but was also used for a distinct and separate purpose, i.e. Disciplinary proceedings. This was no longer a security -based investigation and the Circuit Court was in error. The images were therefore used for a different purpose than the one for which the data was originally collected.
The DPC appealed to the Court of Appeal who made reference in a critical fashion, to “the costs involved in all of these appeals are very substantial and entirely disproportionate to the issue concerned where there is no obvious necessity for such a multiplicity of appeals.
The COA agreed with the High Court – there was no problem viewing the images when investigating a possible security issue, but the fact that the image of a person was captured in a “non-security issue” matter, and that the person was the subject of a disciplinary complaint based on what had been seen was a breach of that person’s understanding of his consent to have his image recorded and watched.
-Take Away For Employers –
this highlights the need for clear policies and procedures. Further processing of personal data is not automatically unlawful, it is more likely to be so where further processing is not related to the original purpose, was not expected by the subjects, may have negative consequences and there are no safeguards to ensure fair and transparent processing.