Illegal Recording of Staff, GDPR Breach?

PatrickSmithUS

I came across this news report today. It's the second time in six months that a company has been penalized heavily for breaching GDPR for recording and saving video footage of staff without a sound legal basis or authorization for doing so. More here.

If this sets a precedent that can be relied upon it will surely have a massive impact in Ireland?


The construction sector alone will be hit hard.

Privacy Notice

PatrickSmithUS wrote: »

The construction sector alone will be hit hard.

No it won't.

I Am The Law

PatrickSmithUS wrote: »

I came across this news report today. It's the second time in six months that a company has been penalized heavily for breaching GDPR for recording and saving video footage of staff without a sound legal basis or authorization for doing so. More here.

If this sets a precedent that can be relied upon it will surely have a massive impact in Ireland?


The construction sector alone will be hit hard.

I don't get it, the German case is correct, being considered guilty until proved innocent is not acceptable.

Robbo

PatrickSmithUS wrote: »

I came across this news report today. It's the second time in six months that a company has been penalized heavily for breaching GDPR for recording and saving video footage of staff without a sound legal basis or authorization for doing so. More here.

If this sets a precedent that can be relied upon it will surely have a massive impact in Ireland?


The construction sector alone will be hit hard.

There's nothing earth shattering here bar the willingness of the provincial supervisory bodies to impose a headline grabbing fine. The principles upon which this was decided pre-date the GDPR and are in line with the jurisprudence of ECtHR; namely disproportionate and invasive workplace surveillance needs to have a bloody good justification.

Potential-Monke

Article doesn't really explain much though. Is theft monitoring not a good enough basis for cctv now? Fair enough if they were in the jacks, but I thought everywhere else was fair game as long as employees were aware? Is that not also the main purpose of cctv, to help in the prevention of theft? Maybe I'm missing something here.

Del2005

Like a lot of the massive payouts that make the news they rarely report what the result of the appeal is and the appeals are usually successful.

You'd think that lower courts make these types of judgements to get in the press in the knowledge that they will be overruled when a higher court hears the appeal.

Hoboo

Potential-Monke wrote: »

Article doesn't really explain much though. Is theft monitoring not a good enough basis for cctv now? Fair enough if they were in the jacks, but I thought everywhere else was fair game as long as employees were aware? Is that not also the main purpose of cctv, to help in the prevention of theft? Maybe I'm missing something here.

Sounds like they were everywhere. Its acceptable to have them in a stock room, but not in a canteen for example. It's reasonable to assume theft could take place in the former but not in the latter.

Homer

Hoboo wrote: »

Sounds like they were everywhere. Its acceptable to have them in a stock room, but not in a canteen for example. It's reasonable to assume theft could take place in the former but not in the latter.

Never underestimate how low some people will stoop

Mrs OBumble

Hoboo wrote: »

Sounds like they were everywhere. Its acceptable to have them in a stock room, but not in a canteen for example. It's reasonable to assume theft could take place in the former but not in the latter.

Canteen staff (usually low-paid agency workers who get the blame for lots of stuff) may welcome the protection from false allegations which CCTV gives them.

Claw Hammer

If the purpose of the surveillance was to stop theft 60 days is an excessive period of time to retain the data. Theft should be detected much sooner.
Furthermore the area covered by the surveillance was too broad, there was no evidence of theft or suspected theft by anyone. A sales area was covered meaning customers could be recorded. There was no evidence that less invasive methods of controlling theft had been tried.

It seems that to have surveillance at all there should be a demonstrable need for it, there is no practical alternative, it should be the minimum required to deal with that need and the images should be retained for no longer than necessary. The length of time the images are retained must be justified.


The company seems to have failed on all aspects.

Potential-Monke

Interesting. With the way people are today, could you get away with having it installed to help prevent potential fraudulent claims from customers?

PatrickSmithUS

Potential-Monke wrote: »

Interesting. With the way people are today, could you get away with having it installed to help prevent potential fraudulent claims from customers?

As long as the internal members of staff are aware that it will be used to monitor them and there is a notification outside that the footage is used to monitor for theft, will be use for prosecution but not shared publicly without consent then everything should be ok.

Del2005

Potential-Monke wrote: »

Interesting. With the way people are today, could you get away with having it installed to help prevent potential fraudulent claims from customers?

Supermac's has a famous video from their toilets of someone putting water on the floor to get a claim.

The 60 day thing is a stupid ruling when people have several years to lodge a personal injury claim. How is a company supposed to protect itself if the chancers know that they can't be proven to be making a false claim once they wait a few weeks?

Claw Hammer

Del2005 wrote: »

Supermac's has a famous video from their toilets of someone putting water on the floor to get a claim.

The 60 day thing is a stupid ruling when people have several years to lodge a personal injury claim. How is a company supposed to protect itself if the chancers know that they can't be proven to be making a false claim once they wait a few weeks?

If there is an incident recorded they would preserve the footage as it would be reasonable. keeping all footage for 60 days is unreasonable.

AndrewJRenko

Del2005 wrote: »

Supermac's has a famous video from their toilets of someone putting water on the floor to get a claim.

The 60 day thing is a stupid ruling when people have several years to lodge a personal injury claim. How is a company supposed to protect itself if the chancers know that they can't be proven to be making a false claim once they wait a few weeks?

The 60 day ruling applies to this particular case, where the purpose of the monitoring is to prevent theft.

Each scenario is different.

Having said that, if you plan to keep cctv content for months or years, you'd better have a good archiving system.

And you'd better be prepared to deal with subject access requests going back months or years.

Del2005

Claw Hammer wrote: »

If there is an incident recorded they would preserve the footage as it would be reasonable. keeping all footage for 60 days is unreasonable.

The problem for businesses is that the "incident" is reported several weeks later so they can't know what to persevere.

The 60 days may relate to this case but it could set a precedent for other cases.

Potential-Monke

Yeah, that'd be my worry if I was a business owner, that someone could come back well after the CCTV is gone and you'd have no video defence then. Maybe they should change the law to state claims must be notified to the store within 14 days (as some places delete footage after 14 days).

Claw Hammer

How would an incident occur without staff being aware of it and making notes as required by the Health and Safety Regulations?

Del2005

Claw Hammer wrote: »

How would an incident occur without staff being aware of it and making notes as required by the Health and Safety Regulations?

It doesn't happen which is why I used "incident". The person comes back a few months later, after the CCTV is recorded over, and lodges a claim. Insurance pays out because the company can't prove it never happened. Then the company has a massive insurance renewal quote which means that a lot are now operating without cover.

Claw Hammer

Del2005 wrote: »

It doesn't happen which is why I used "incident". The person comes back a few months later, after the CCTV is recorded over, and lodges a claim. Insurance pays out because the company can't prove it never happened. Then the company has a massive insurance renewal quote which means that a lot are now operating without cover.

A claim could be lodged years after. The question is whether it is proportionate to retain CCTV for years.
The burden of proof is on the claimant to prove an incident happened. By now, the insurance companies are challenging Plaintiffs. Even with CCTV there may be a problem if it can be alleged that it was not working at the time.

AndrewJRenko

Potential-Monke wrote: »

Yeah, that'd be my worry if I was a business owner, that someone could come back well after the CCTV is gone and you'd have no video defence then. Maybe they should change the law to state claims must be notified to the store within 14 days (as some places delete footage after 14 days).

The impact of some injuries isn't apparent for weeks or months after the incident. In some cases, people assume that their after-effects are short term problems that will heal up and go away, but realise months later that they are dealing with permanent disability or loss of function.

BattleCorp

Claw Hammer wrote: »

How would an incident occur without staff being aware of it and making notes as required by the Health and Safety Regulations?

Here's how to do it. Fall in a shop. Get up, let on you are fine, mention the fall to an employee, get their name and then sod off without giving your name/filling in any paperwork.

Then lodge a claim about 3 - 6 months later.

Claw Hammer

BattleCorp wrote: »

Here's how to do it. Fall in a shop. Get up, let on you are fine, mention the fall to an employee, get their name and then sod off without giving your name/filling in any paperwork.

Then lodge a claim about 3 - 6 months later.

The employee should fill in an incident report form no matter what the customer says. The CCTV of that incident should then be retained.

BattleCorp

Claw Hammer wrote: »

The employee should fill in an incident report form no matter what the customer says. The CCTV of that incident should then be retained.

What you say is true but it doesn't always happen.

Claw Hammer

BattleCorp wrote: »

What you say is true but it doesn't always happen.

Just because people are inefficient or incompetent, doesn't mean that Data Protection should be ignored.