The mistake many employers make is asking “Can we install this CCTV camera?” GDPR asks a different question: “Can you justify this CCTV camera?”
Workplace CCTV can absolutely be lawful; many businesses have legitimate reasons for using it. The difficulty is that GDPR requires employers to balance those business interests against the privacy rights of the people being recorded. That’s where many organisations get into trouble.
One of the questions that comes up repeatedly when I’m teaching data protection is workplace CCTV. In fact, it comes up so often that it forms part of the Law Society’s Diploma in Data Protection, where I lecture, and which I also externally examine.
The reason it comes up so frequently is simple: many employers assume they have broader rights to monitor employees than they actually do. A business owner might think, “It’s my building, my equipment and my staff. Surely I can install cameras wherever I think they’re needed?”
The answer is: not necessarily.
Why Is CCTV a GDPR Issue?
A surprising number of employers think of CCTV as a security issue rather than a data protection issue. In reality, the moment you point a camera at an identifiable person and record them, you are collecting personal data. The footage is information relating to that individual. Once you store it, review it, or share it, you are processing personal data. At that point, GDPR applies just as surely as it would if you were storing personnel records or customer files.
That means employers need a lawful reason for collecting the footage and must be able to justify what they are doing with it.
Two Questions Every Employer Must Be Able to Answer
Whenever I advise organisations on workplace monitoring, I find myself coming back to the same two questions:
- Why is this camera necessary?
- Is the way you’re using it proportionate?
Those two principles of necessity and proportionality sit at the heart of most workplace CCTV decisions. The question is always whether the monitoring is necessary for a legitimate purpose and whether the intrusion into employee privacy is proportionate to that purpose.
The CCTV Example That Usually Makes the Point
When discussing workplace CCTV, I often contrast two very different examples. The first is a camera overlooking a till. Most people can immediately understand why that might be justified.
The second example is at the opposite end of the spectrum: a camera installed in a staff toilet. You might think it would be unnecessary to spell out that this kind of surveillance is neither necessary nor proportionate. Unfortunately, employers still need to be reminded that the intrusion into employee privacy is simply too great. This issue arises so frequently that the regulator has had to issue specific guidance on the use of CCTV in staff toilets.
Most workplace CCTV decisions are less extreme than that, but the same principles apply.
Employees Do Not Lose Their Privacy Rights at Work
This is one of the biggest misconceptions I encounter. Some employers assume that because somebody is on company premises, they would no longer have any expectation of privacy. That is not how the law works.
Employees continue to have privacy rights in the workplace. Those rights do not disappear simply because they have clocked in for work. As a result, every CCTV system involves a balancing exercise. On one side are the employer’s legitimate interests. On the other are the employee’s rights and freedoms.
If that balance is not considered properly, the employer may find themselves defending a complaint to the Data Protection Commission.
Imagine You Receive a Letter From the Data Protection Commission…
One practical way to think about workplace CCTV is to ask yourself a simple question:
“What would I say if the Data Protection Commission asked me to justify this camera?”
Imagine an employee complains about your monitoring arrangements. A letter arrives from the DPC telling you that an investigation has been opened. What evidence can you produce to justify your CCTV usage?
Can you explain:
- Why a particular camera was installed?
- What risk it was intended to address?
- Why CCTV was necessary?
- Why a less intrusive option would not have worked?
- How employee privacy rights were considered?
If the answer to those questions is “we’ve never really thought about it”, you have a problem. If the answer is “we considered all of those issues before installing the system”, you are in a much stronger position.
Don’t Forget the Signage
Another surprisingly common issue is signage. People need to know they are being recorded. That means employees, visitors, contractors and members of the public should all be clearly informed that CCTV is operating.
Many organisations install the cameras and forget about the notice requirements. But from a compliance perspective, that can be just as problematic as the placement of the cameras themselves.
How Long Can CCTV Footage Be Kept?
This is another question that businesses regularly ask. The answer, in the classic lawyer response, is: it depends.
There is no magic retention period that automatically applies to every CCTV system. Instead, the retention period should be linked to the reason the footage was collected in the first place.
For example, if footage is being used to investigate discrepancies at a till that are reconciled every day, there may be little justification for holding months of recordings. If footage relates to stock control processes that are only reviewed periodically, a longer retention period may be easier to justify.
What matters is that the organisation can explain why it needs the footage for that length of time.
One of the recurring problems I encounter is that electronic storage has become cheap. Because hard drives were, for many years, inexpensive, organisations often keep footage far longer than they actually need it.
Unfortunately, GDPR does not contain a “storage is cheap” exemption.
The Value of Doing the Work Up Front
The businesses that handle workplace CCTV best are rarely the ones with the most complicated systems. They are usually the ones that have taken the time to think through their decisions before installing the cameras.
That means documenting:
- The purpose of the monitoring,
- The legal basis relied upon,
- The risks to employees,
- The safeguards in place,
- The retention periods that will apply.
Often this is done through a Data Protection Impact Assessment. The exercise may feel bureaucratic at the time. However, if an employee later complains, or the Data Protection Commission comes asking questions, those records become enormously valuable.
In my experience, regulators are far more interested in whether an organisation has genuinely engaged with the process and made the effort to think through its choices, than whether every judgement call turned out to be perfect.
Workplace CCTV Is About Balance
The mistake many employers make is viewing workplace CCTV as a question of what they are entitled to do. The more useful question is what they can justify.
Most employers have legitimate reasons for using CCTV. The challenge is ensuring that the monitoring is no more intrusive than it needs to be and that employee privacy rights have been properly considered along the way.
Simon McGarr
Simon McGarr is a graduate of UCD and GMIT. He has been a lawyer with McGarr Solicitors since qualifying as a solicitor in 2008.
Simon is a CIPP/E Certified Information Privacy Professional/Europe specialising in GDPR compliance, data protection, and privacy rights law. He lectures for the Law Society of Ireland on its Diploma in Data Protection and Certificate in Data Protection programmes, and also serves as an external examiner.
Simon works with Irish and international organisations as an external DPO and on compliance, breach response, and data governance matters.