The European Court of Human Rights in Lopez Ribalda & Ors v Spain recently held that covert camera surveillance at work breaches the ECHR Article 8 right to privacy.
In this case, a supermarket installed both visible and hidden surveillance cameras to address suspected theft. Workers were only told about the visible cameras and not those that were hidden from view. Covert images recovered on the hidden cameras recorded instances of employees stealing items from the supermarket and several employees were dismissed using these covert images as evidence. The dismissed employees claimed there had been a breach of Article 8 and their data protection rights.
At first instance, a Spanish court held that the installation of covert surveillance cameras was a justified, appropriate, necessary and proportionate measure to try to combat theft.
On appeal the European Court of Human Rights disagreed and found that the right to privacy under Article 8 had been violated. It was stated that video surveillance in the workplace is a considerable intrusion into private life and that personal data extends to personal appearance.
The General Data Protection Regulation ((EU) 2016/679) (GDPR) defines personal data as “any information relating to a data subject” (Article 4(1)). A data subject is the identified or identifiable person to whom the personal data relates.
A person is identifiable if he or she “can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity” of that person (Article 4(1), GDPR).
Furthermore, to comply with data protection laws, employees must be “explicitly, precisely and unambiguously“: –
- informed of the existence of a personal data file, which in this case was the covert recording of the employees at work;
- have confirmation regarding how that data will be processed;
- have confirmation of the purpose for collection of that data; and
- have confirmation of the recipients of that data.
In this case it was found that a fair balance between the right of the supermarket to take measures to prevent theft and the right of its employees to a private life in terms of the personal data collected by the supermarket had not been struck.