GDPR: The use of video recording systems in the workplace (act 4624/2019)
1. Preamble
“Big brother is watching you” is the well-known quote reminding us of George Orwell and his novel “1984”. In this novel the Big Brother is a fictional character-leader and symbol. Ingsoc, the governing party in Oceania, forces its power on the residents of the country in his name and on his behalf. G. Orwell describes the society as one where all citizens (all except for Proles) is under constant surveillance from the authorities, via electronic means.
We know all too well that neither Oceania nor, at least in the novel, Big Brother ever existed. But we do identify phenomena of surveillance and abuse of the government (mostly) powers as the Big Brother.
In modern societies the need for video recording systems is present -for the protection of persons and goods. Thus, it would be justifiable if someone was to think “those who abide by the law have nothing to worry about”, opening a big discussion on personal freedoms and fundamental rights with both sides presenting important arguments.
When it comes to modern-day businesses, the need for the protection of persons and goods is not only present, but also more vivid. And this is because modern-day businesses have to do with “our” persons and “our” goods.
Having particular regard to those concerns, the use of video recording systems has been regulated on a European and national level. The regulations in place regard, among others, the businesses and their employees.
The regulations regarding the (broader) issue of personal data are today found, in a European Union level, in Regulation (EU) 2016/679N/span> and in Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016. Issues arising from this particular legislation have repeatedly concerned us in the past (indicatively in work relations, the use of biometric data in employment contracts, the first fines imposed for the violations of the relevant Regulation etc.).
Article 63 paragraph 1 of the aforementioned Directive imposed an obligation to incorporate its provisions in all national legal systems by 6.5.2018.
Spain and Greece turned a blind eye.
2. Greece taken to court by the European Commission
The European Commission announced, in a press release of 25.7.2019, its decision to take Greece (and Spain) to the Court of Justice of the EU, for failing to transpose the aforementioned EU regulations. Especially regarding Greece, the commission called on the Court of Justice of the EU to impose financial sanctions in the form of a lump sum of €5.287,50 per day Greece did not comply (from 6.5.2018) and, in case Greece still refrains from complying -after the day of the judgment, a daily penalty payment of €22.169,70 and a minimum lump sum of €1.310.000.
Our country had to rush in passing the relevant act (act 4624/2019) under the urgency procedure. One of the most important issues of personal data (troubling most businesses and employees) is the issue of video recording, via a closed circuit, at the workplace.
3. The provisions of the recently passed act 4624/2019 regarding video recording
3.1. The content of §§ 7 & 8 of article 27, act 4624/2019
The provision of article 27 of this act refers to the processing of personal data for the purpose of performance of employment contracts. Paragraphs (7) and (8) regard issues relating to the (legitimate) processing of personal data in the workplace. To be more precise, they have the following content:
“7. The processing of personal data in the workplace via closed circuit video recording systems, either if the workplace is accessible to the public or not, is only allowed if it is necessary for the protection of persons and goods. The data collected via a closed-circuit video recording system cannot be used as a criterion for the valuation of the employees’ efficiency. The employees are informed in written, either by being given a printed document or electronically, for the installation and operation of a closed-circuit video recording system in the workplace.
- For the purposes of the present act, all those working with any work relationship, works contract or service contract, public or private, no matter the validity of the contract, those who are up for a position and past employees are perceived as employees”.
3.2. Conclusions drawn from the provisions regulating video recording.
We can deduct the following conclusions from articles 27 §§ 7 & 8 act 4624/2019:
(a) The use of a closed-circuit video recording system in the workplace:
- is (exclusively) permitted if it is necessary for the protection of persons and goods
- is not tolerated (in any way) as a means to evaluate the employees’ efficiency (it must be noted that, notwithstanding the clear prohibition by law, no one can really prevent the employer from monitoring the attitude and efficiency of the employees who are within the range of the existing and lawful video recording system).
(b) The employees must be informed either via a printed document or via email for the installation and operation of a closed-circuit video recording system in the workplace.
(c) Employees are considered those who:
- relate to the company with an employment contract, full or partial, for a limited or indefinite time
- relate to the company with a works contract or a service contract
iii. are up for a job (under the wording chosen by the legislator, informing those persons in written will certainly be difficult).
- are former employees.
3.3. Worth mentioning: The initial wording of the provision regulating video recordings.
The initial wording of the second and third subparagraph of par. 7 mentioned:
“Data collected via a closed-circuit video recording system cannot be used as the only criterion for the evaluation of the employees’ behavior and performance. The employees are informed in written, either by being given a printed document or electronically, for the introduction and use of control and monitoring methods.”
Therefore: Under the wording of the relevant provision it was clear that closed circuit video recording systems could be used as a criterion (one of many -not the only one) for the evaluation of the employees’ behavior and performance.
Needless to say, the original wording did not entail a clarification of who was considered as an employee. The, later added, paragraph 8 not only clarified, but also expanded the term, as it ought to.
3.4. Explanatory memorandum.
The explanatory memorandum for paragraphs 7 and 8 of article 27 mentioned:
“Paragraph 7 introduces the provision that monitoring a workplace through recording systems (either if it is accessible by the public or not) is allowed under conditions and for the achievement of specific purposes, and that there is an obligation for informing the employees in written for the introduction and operation of monitoring and surveillance methods in the workplace (see also article 13, paragraph 1 of GDPR).
Closing, to avoid any ambiguity regarding the scope of the provisions, paragraph 8 defined the meaning of the term “employee” in the context, where the term includes even those who provide their services voluntarily, as well as trainees obtaining professional skills.
4. The (relatively) recent decisions of the DPA in relation to video recording and the directions given
The most recent decisions of the Authority are dating back to 2018 (published according to the previous institutional framework in force, act 2472/1997): Decision no.40/2018 which regarded a catering company and the (more famous) no.41/2018, which regarded a law firm.
These decisions dealt with similar issues (installation of closed-circuit video recording systems in workplaces). In both cases, the controllers were fined (5,000€ in the first case and 50,000€ in the second). The assumptions, in both cases, were identical. To be more precise, they both mentioned (this way providing the necessary directions all businesses should take):
(a) “… Audio and video data, when referring to persons, constitute personal data”.
(b) “Storing and transmitting a person’s image, collected by a video surveillance system operating lawfully, continuously or at regular intervals, in a closed or open space of gathering or passing of persons, constitutes processing of personal data …”
(c) “Basic prerequisite …for the lawful processing of personal data is respecting the principle of proportionality, meaning that the collected data are necessary and appropriate for the intended purpose, which cannot be succeeded by less intrusive means”
(d) Furthermore, the places where the cameras are installed and the way the data is received should be defined is such way, so that the data collected are not more than those necessary to achieve the purpose of processing and no basic rights of the persons in the area surveyed are jeopardized, especially the right of “lawful expectation of protection of private life” in a specific place.
(e) “Additionally …the system should not be used for surveying employees in the workplace, except in special situations where this is justified by the nature and the conditions of the work and it is necessary for the protection of health and the security of the employees or the protection of critical workspaces (e.g. military factories, banks, high risk facilities). For example, in a typical workspace, video surveillance should be limited in areas of entrance and exit, without surveying certain office areas or corridors. An exception to that can be certain areas like cashiers’ desks or areas with vaults, electromechanical equipment etc., under the condition that the cameras focus on the good they are protecting and not on the areas the employees occupy. Also, in some specific areas, like areas with electromechanical equipment, the shift supervisor or the security supervisor can monitor in real time the operators of high-risk machinery, in order to be able to intervene immediately, in case a safety incident occurs”.
5. In Conclusion
There was no “Big Brother” in George Orwell’s “1984”, but there was electronic surveillance in his name, powerful and very widespread.
Technology and legislation, in a European and in a national level, permit the creation of similar conditions as they allow the monitoring and video recording in workplaces (as well). “For the protection of persons and goods”-exclusively.
The existing legislation (act 4624/2019, article 27, par. 7) protects the businesses and, even more so, the employees. The same does the Data Protection Authority, with its above-mentioned decisions.
The legal and administrative sanctions, in cases of infringement of the relevant obligations, are not negligible.
To avoid the provided, cumbersome, sanctions, it appears that the businesses’ complete alignment with the existing legislation and the directions given by the DAP is necessary.
Today.
Stavros Koumentakis
Senior Partner
P.S. A brief version of this article has been published in MAKEDONIA Newspaper (September 8th, 2019).
