Videoed in work

badker

Are you legally allowed to video someone in the workplace without their consent?

Kaisr Sose

More information needed on who is doing the recording and context of it (where/why etc.)

badker

A co worker to show the person was breaching company policy by being under the influence

Flinty997

My understanding, might be wrong, is that a workplace has to tell you're going to be recorded in advance and have a valid reason for doing so.

harmless

Yes if it is not obvious an employer must tell you they are monitoring you via camera.

But this is one co worker recording another. Unless the employer has a policy that you can not record video while working I don't see a problem here.

Flinty997

Open to correction. An employee can be seen as an agent of the company if they do something on work premises or at work event.

That said not sure what to be gained with these arguments. If it some for a genuine reason, safety, fraud, or such it might be covered under employment policy.

Jim2007

https://www.boards.ie/discussion/comment/121564359#Comment_121564359

I have a feeling we still have not got the context..... who is filming whom exactly and how? Cameras that are already installed in the work place, a phone, an action camera?

badker

No was by phone and to prove another employee was after having few drinks while on duty

Former Former Former

https://www.boards.ie/discussion/comment/121564817#Comment_121564817

There is no law against one person taking a video of another.

I presume you are concerned about disciplinary action from your employer, so the 'good' news is that it's a lot more complicated when it comes to an employer using footage in a hearing when the employees have not been told that they may be recorded at work.

badker

https://www.boards.ie/discussion/comment/121564860#Comment_121564860

Yes they are concerned over disciplinary action. Is the footage allowed to be used at the hearing?

Can you please explain the lot more complicated part? thanks

Kimbot

https://www.boards.ie/discussion/comment/121564956#Comment_121564956

I think their concern should be more about been under the influence in work rather than someone videoing them.

AndrewJRenko

First question would be whether there is any company policy about use of cameras at the workplace.

There are fairly stringent data protection requirements on employers who use CCTV in the workplace.

https://dataprotection.ie/en/dpc-guidance/guidance-on-the-use-of-cctv#CCTV

If the employer chooses to use video recorded by another staff member, that could open up a bit of a can of worms from a data protection point of view.

It might be relevant to know whether the person recording was a line manager, and whether they were using a work-supplied phone to do the recording.

If you're in a union, engage your union for support. If you're not in a union, you might want to think about joining a union for next time.

badker

https://www.boards.ie/discussion/comment/121564996#Comment_121564996

Could possibly be the case that they used a work phone and are definitely more senior in the workplace alright.

Jim2007

https://www.boards.ie/discussion/comment/121565091#Comment_121565091

In addition to the laws themselves there are the rules of evidence and judicial processes to consider. The video would have to be admitted in a context and in this case that would be the person who took the video giving evidence that they observed the event and took the video at that time. In other words they have an eye withness to the event and the video does not even need to be used.

And depending on the full details of the case, a solicitor might not want your friend to even acknowledge the existence of a video in such circumstances. Arguing over a video of an event you are claiming did not happen might not work out well.

Get proper legal advice and be very careful what you discuss on public media as it might well disclose the identity of your friend to people who may well be dealing with this situation.

Former Former Former

If a complaint is made, it's gross misconduct and dismissal territory. Being drunk on the job isn't like knocking off five minutes early or sneaking a cigarette during your shift. Depending on the nature of the job, you're potentially putting yourself, colleagues or customers at risk, and certainly the reputation of the company.

If it came to a WRC hearing, I think the employer could make a strong case that it was critical to get all the available evidence and that his obligations to keep the workplace safe override the privacy concerns of the employee.

I'm going to assume these drinks weren't consumed in the course of an office Christmas lunch function.

AndrewJRenko

https://www.boards.ie/discussion/comment/121565375#Comment_121565375

Regardless of the outcome of any WRC process, the employer still has legal obligations under data protection legislation.

Pauliedragon

Is a video enough to prove intoxication? Is there video or pics of a bottle of alcohol? An employer has to thread very carefully

kirving

Regardless of whether the video is admissible, or any data protection legislation surrounding its capture and storage, the person who was drinking on the job should get their CV up to date if drinking is proving to be an issue.

If it was working in a bar, or at some other social event though, different expectations would apply I think.

I did have one new employee order (and be served) a pint at lunch when we were on a work trip, they were told pretty quickly of the expectations of the company, but nothing more was said.

Former Former Former

https://www.boards.ie/discussion/comment/121565395#Comment_121565395

Yes, that is correct. But in this case, the employer did not collect or process the data (we don't even know if they've seen it yet) so it's a grey area at best in terms of their obligations.

Assuming the guy with the camera is not routinely recording people but only did so to record the misconduct, I don't think GDPR is going to save the offender.

badker

https://www.boards.ie/discussion/comment/121565432#Comment_121565432

As far as I know there are no photos of said alcohol or it being consumed. The person went home sick on the day in question aswell

AndrewJRenko

https://www.boards.ie/discussion/comment/121565698#Comment_121565698

Highlighting the GDPR issues may well cause the employer to think twice about using the video as part of the disciplinary process, which in turn may well have a significant impact on the outcome.

Former Former Former

https://www.boards.ie/discussion/comment/121565712#Comment_121565712

If you were an employer, would you?

If I thought one of my staff was drunk on the job, I wouldn't let fear of GDPR get in the way. Let him chance his arm at the WRC, I'd argue that the data was legally obtained, proportionate, reasonable and limited in its scope, only held for as long as necessary and my obligations to my other staff obliged me to consider all available evidence.

I'd be pretty confident tbh. Even a few grand for a GDPR breach, I'd take that as an acceptable outcome. This isn't something that an employer can let slide.

Pauliedragon

https://www.boards.ie/discussion/comment/121565706#Comment_121565706

The only reason I ask that is because I take medication which can make me drowsy and affect my speech so I could appear drunk so people should be careful before whipping the camera out.

Mrs OBumble

https://www.boards.ie/discussion/comment/121566287#Comment_121566287

Does your manager know about that?

Have they done a risk assessment to make sure iit something they can safely accommodate? I can think of workplaces where just being sleepy would be an issue- and others where it wouldn't.

Your colleagues would need some information as part of the accommodation, so they don't jump to incorrect conclusions

witchgirl26

Ok first off GDPR doesn't apply here. GDPR is about the processing of a person's information & the storage of the same by a business. Not one employee recording another.

Secondly, as someone who investigates whistleblower cases like these, we would use the video evidence if it was uploaded as part of the whistleblowing complaint. It could not be solely relied upon & a full investigation would have to take place but it can be used as part of it. If nothing else it can identify other potential witnesses who would be interviewed to get their understanding of what happened. Also it doesn't matter if it was recorded on a work phone or a personal phone either.

Most companies take a very dim view of being intoxicated in the workplace and while it might not be able to be proven too much after the fact, it may lead to a heavy formal warning going onto the employees file.

As for use of CCTV - if there is CCTV in the workplace anyway, it is perfectly allowable to access it in the case of an investigation into behaviour and this is allowed under it's usage. Now there should be stringent policies in place about who is allowed to access that and that a proper formal request is documented to review it but it is there to protect employees, which in this case would be those other than the alleged intoxicated person as that person could cause injury to another employee by being impaired.

AndrewJRenko

https://www.boards.ie/discussion/comment/121566717#Comment_121566717

If you're investigating whistleblower cases, you need to upskill yourself on GDPR urgently. GDPR would absolutely apply to the processing of data by the organisation, particularly when done by a manager using a corporate phone. If anyone in the business is processing the recording (and simply viewing the recording is considered to be processing), then GDPR applies. If the recording is stored on corporate networks or corporate devices, this would solidify the case that GDPR applies.

I specifically asked whether it was done by a line manager, and the OP answered that it was done by someone senior to the employee. This is NOT a peer-to-peer action, when it has been taken by a manager. It may well be that the recording was preplanned and organised by members of management, which is an action of the business.

If there is CCTV in the workplace, the CCTV recordings may ONLY BE USED for the purposes set out in the organisation's privacy policy which has been previously communicated to employees. There are many case studies on the DPC website where employers went beyond their own policies in using CCTV and got hammered as a result.

https://www.boards.ie/discussion/comment/121565873#Comment_121565873

If the GDPR breach was going to cost you €15k, would it still be an acceptable outcome? How about €50k cost, given that GDPR fines can be done on a % of turnover basis.

We've only got one side of the story here. If there was email documentation showing that the recording of the individual without their knowledge and permission was preplanned in advance by people at management level, with zero consideration of the employee's data privacy rights, would you still go ahead with your firing?

https://www.boards.ie/discussion/comment/121566529#Comment_121566529

Colleagues would need precisely zero information about their colleague. Revealing any such information to colleagues would be an absolute breach of employer confidentiality. If jumping to conclusions is a problem, then train your staff on not jumping to conclusions.

Mrs OBumble

https://www.boards.ie/discussion/comment/121567001#Comment_121567001

Read what I said.

SOME information. Not detailed or even fully factual. Probably something like "X has an issue which causes him/her to appear sleepy sometimes. If this happens you should do xyz"

Because employees should absolutely not be tolerating their colleagues appearing to be drunk in the workplace. If someone sees and reports an apparently drunk employee on-site, and management say and do nothing, then it looks like it's allowed.

Pauliedragon

https://www.boards.ie/discussion/comment/121566529#Comment_121566529

Everyone who needs to know are aware of my situation and all requirements have been looked at and I've been passed fit to work not that it's any of your concern.

Deep Thought

Data privacy company needs to say they are using cameras and for what intention. Any video can only be used to support that actual intention.

they can’t use it for everything

AndrewJRenko

https://www.boards.ie/discussion/comment/121567098#Comment_121567098

To say that "X has an issue" is a breach of confidentiality. No one needs to know about X having issues except their line manager.

If employees are having difficulty in distinguishing between drunkenness, then you can train employees to either MYOB or report any concerns to the line manager, who will deal with the in complete confidence, and won't provide any feedback to the reporting employee.

witchgirl26

https://www.boards.ie/discussion/comment/121567001#Comment_121567001

I'm well versed in it thanks. GDPR allows for the processing of the information if:

• The processing is necessary for compliance with a legal obligation, or
• It is deemed to be a “legitimate interest” of the controller, company or third-party

Which does apply in the above. Now the number of people who see the information should be limited and in compliance with the GDPR policy within the business and also with the legislation. When it comes to whistleblowing cases where there is a legitimate risk to people (which can definitely happen is someone is intoxicated on site) then it can fall into the 2 categories above. The legal part as the employer is obligated to provide a safe environment for employees (which includes protecting them from accidents caused by someone who is not able to complete their duties) and also the legitimate interest part as it forms part of a whistleblower complaint which also is legal as you're legal obligated to investigate them.

I agree on the CCTV - the policy must be clear as to how and when this can be used but most companies will have it included in their CCTV policy that they can review in the event of a complaint. It must be a specific complaint & also with controls around who can see it as it could identify the whistleblower who is entitled to anonymity. CCTV can't be used for continuous monitoring of employees but again in this case, I'd say they'd be looking for corroboration of the phone video evidence.

Peer-to-peer doesn't count in whistleblowing - anyone is entitled to raise a complaint or concern about anyone else either anonymously or not regardless of level within the organisation and have it investigated. Also the recording on the phone isn't necessarily under corporate control as the phone is most likely available to the employee for outside corporate use so does fall into a more grey area than something like CCTV. Now if the employee is sharing that video amongst other employees, that can be a case against them too as that is not allowed.

The EU Whistelblower Directive which came into effect at the end of 2021 covers off on the right to process under GDPR and also the right of the company to not inform in the instance where there could be hinderance to the investigation until that risk is reduced. I'd recommend reading this to understand it: https://blog.complylog.com/whistleblowing/gdpr-and-whistleblowing

AndrewJRenko

https://www.boards.ie/discussion/comment/121567165#Comment_121567165

Did you read the link you posted? There is nothing in there to say that a whistleblowing scenario overrides GDPR requirements, quite the opposite:

This personal data must be handled in a GDPR-compliant manner. 

The employer would absolutely need a legal basis to process such data. An employer coming up with that legal basis in retrospect, AFTER the incident arose, rather than beforehand, clearly documented in a Privacy Policy and employee contracts would be on very dodgy ground. If there is a legal basis for processing videos recorded by peers, that should absolutely have been made clear up front - and I'll bet you a fiver that it hasn't been made clear up front.

Former Former Former

https://www.boards.ie/discussion/comment/121567110#Comment_121567110

Again. The company was not using cameras for anything. The video was taken by another employee on his/her phone. Citing the rules for CCTV over and over again isn't really helpful.

Unless the company starts sharing the video on the office WhatsApp or some other inappropriate use of the footage, then they are absolutely entitled to view it and use it.

If I walked into the office, punched a co-worker in the face and it was captured on cameraphones by 20 of my co-workers, would I be able to claim GDPR protection?

Mrs OBumble

https://www.boards.ie/discussion/comment/121567140#Comment_121567140

And it would look to the colleagues as though X was persistently allowed to be drunk at work, with no consequences!

You really think that is OK?

At very least, colleagues need to know what to do if an incident arises and the manager isn't on-site.

witchgirl26

https://www.boards.ie/discussion/comment/121567744#Comment_121567744

Did you? I didn't say it overrode GDPR requirements but that the individual accused of being intoxicated can't cite GDPR as a reason to not have the video used.

From the link:

4.1 Ensure lawfulness of data processingWith regard to the lawfulness of your processing data relating to whistleblowing reports, you can justify using one of two different reasons, as set out in the data protection directive:

• You are doing so to comply with a legal obligation
• You are pursuing a legitimate interest using the data.  

In most cases, your legal basis for data processing will fall under the first reason. When a whistleblower makes a report, you are obliged to investigate, which requires processing data. If the first reason does not apply, you would have to prove that you were processing data in the public interest, relating to national or EU law, to justify your actions under the second reason. 

If there is a whistleblowing claim you are legally obliged to investigate it. The legal basis isn't in retrospect at all. Employers do not have to have policies about what people do with their phones in regards recording other employees as it is not a company thing. They do around CCTV however but that is only if they want to access the CCTV to confirm the incident.

Also from that article:

In order to comply with GDPR, you should inform persons concerned about the fact you are processing their data. However, as this could hinder any investigation, you are allowed to delay disclosure until the high risk of obstructing the reporting process is diminished. Article 14.5(b) of GDPR offers an exemption in cases where disclosure is “likely to render impossible or seriously impair the achievement of the objectives of that processing.“ 

So please explain to me where I said that it overrode GDPR and also anything I said that was incorrect? What I did say was that the employee cannot make this go away or get the company fined under GDPR legislation because they don't like that another employee (level doesn't actually matter in the cases of whistleblowing) took a video of them.

AndrewJRenko

https://www.boards.ie/discussion/comment/121568215#Comment_121568215

If the company wants to use the video taken by the other employee during the disciplinary process, then the company absolutely IS using cameras. You need to review the definition of 'processing data' under GDPR.

https://www.boards.ie/discussion/comment/121568562#Comment_121568562

That's where the training that I mentioned comes in to play, training colleagues to MYOB and not make assumptions based on appearances.

Management need to put cover in place for all kinds of things if the manager isn't on site. That's fairly standard, and nothing to do with being videod in work by a colleague.

Akrasia

There is another element of GDPR relating to the collection and retention of PII.

If you collect data for one purpose, it cannot usually be used for another unrelated purpose.

In this case the data was collected specifically for the purpose of making a whistleblower complaint as part of a formal or informal investigation.

AndrewJRenko

https://www.boards.ie/discussion/comment/121569179#Comment_121569179

What you and the authors of that blog are failing to recognise is the duty of the organisation to have policies and procedures in place BEFORE these situations arise, not after. If the organisation is going to use recordings or other data as part of whistleblowing reports, then they need to have covered that off in employee contracts and their privacy policy beforehand.

If they don't have this covered beforehand and decide retrospectively that it is acceptable to use covert video recordings, they could very well find themselves facing serious difficulties and fines under GDPR.

witchgirl26

https://www.boards.ie/discussion/comment/121569230#Comment_121569230

Whistleblowing policies & procedures are required legally to be in place since the end of 2021. All employers should have them and it does allow for that. It does not have to be covered in any employment contracting as whistleblowing is protected as is the person who is doing the whistleblowing. Policies must be available to all employees and also the information as to where & how to report but no update to contracts are needed. If the company (i.e. as the organisation not an individual) is covertly recording, this would be a problem but someone recording someone doing something they perceive as dangerous in the workplace is not going to be a problem. They won't find themselves facing any fines under GDPR if they are processing provided information (either verbal, written or video) under whistleblowing. Seriously this is not complicated and is well covered under both the GDPR and the Whistleblowing directives and legislation. And whistleblowing is legally protected so that there can be no come back on a whistleblower unless malintent has been proven which is seriously difficult to do. It's protected under law. And also as companies are legally obligated to investigate all whistleblowing (no matter how stupid the report may seem), the processing of any information under that is again protected by a legal obligation.

Former Former Former

https://www.boards.ie/discussion/comment/121569217#Comment_121569217

You need to review the definition of 'processing data' under GDPR.

I do not. I know exactly what the definition is.

I'm saying that they are entitled to process the data so long as it is reasonable and proportionate.

GDPR is not a Get Out of Jail Free card, it is a set of obligations on how to process data. Process the data in accordance with GDPR and there should be no issue.

bop1977

there was a case in the WRC where the guy was awarded $15 k because the company didnt/couldnt test the employee. the company needs to send the employee to the company doctor to get a sample taken. the video probably wont be enough to get fired.

https://www.ibec.ie/employer-hub/hr-management-guide/dismissal/case-law/welder-awarded-15000-in-unfair-dismissal-claim-despite-admitting-he-consumed-alcohol-before-work

AndrewJRenko

https://www.boards.ie/discussion/comment/121569366#Comment_121569366

And GDPR policies and procedures are required legally to be in place since May 2018.

You're right, it's not complicated - the Whistleblowing legislation does not override the obligation to have GDPR policies and procedures setting out the legal basis for processing data, the usage of the data, how long it is retained and more.

AndrewJRenko

https://www.boards.ie/discussion/comment/121569398#Comment_121569398

If they don't have the legal basis for processing and other requirements set out in their Privacy Policy beforehand, then they're not processing data in accordance with GDPR.

witchgirl26

https://www.boards.ie/discussion/comment/121569496#Comment_121569496

No but the whistleblowing directive & subsequent legislation takes into account GDPR and allows for the processing of all relevant provided information during the course of an investigation. And it does set out that it should be kept confidential & only viewed by a limited number of people and only those involved in an investigation.

If this was put in as part of a whistleblowing (the video I mean) the person who monitors that hotline would be allowed to view it and process it in line with both the whistleblowing legislation & GDPR. I don't know why you're trying to argue that GDPR somehow trumps the whistleblowing or that processing the information is in contravention to GDPR which could result in fines.

https://www.boards.ie/discussion/comment/121569454#Comment_121569454

Yes video evidence of looking like their intoxicated wouldn't be enough necessarily for a dismissal, there would have to be other evidence. However it could be enough for a formal warning and to be place on a PIP plan depending on the actions portrayed in the video as the actions (not the cause) could be potentially harmful to other employees.

AndrewJRenko

https://www.boards.ie/discussion/comment/121570964#Comment_121570964

It allows for "allows for the processing of all relevant provided information during the course of an investigation" provided that the information is processed in a GDPR compliant manner, as detailed in the article you quoted. It's not a hall pass to ignore GDPR requirements to have a Privacy Policy setting out what information you use, what the legal basis for use is, and how it will be processed and retained.

They still have to comply with GDPR, and unless their Privacy Policy sets out the legal basis for using covert video taken by a manager, they are not complying with GDPR and are exposing themselves legally.

I'm gonna leave it there, as we're largely going round in circles now, but you can't use Whistleblowing regulations to take short cuts on GDPR.

bucketybuck

People blowing on about GDPR tend to be the same who blow on about "The Consumer rights act" ad nauseum. In other words, it is such a broad topic that just shouting "GDPR" is basically meaningless.

Jim2007

https://www.boards.ie/discussion/comment/121571192#Comment_121571192

Well yes I think the whole thing is a bit of a hail Mary prayer at the end of the day. The bottom line is that there is an actual witness to the event - the person who took the video, so they probably won't use it in any case and even if it was used and excluded during the judicial processes the case could still move forward. The company did not collect the video an individual took it upon themselves to do so, so the company might receive a reprimand for that, but that is about it.

And in any case the OPs solicitor would most likely tell him to shut up about the video, because arguing to exclude a video about an event you are trying to claim did not happen is not a great way to go, if the argument to exclude it failed.

AndrewJRenko

https://www.boards.ie/discussion/comment/121571192#Comment_121571192

Which is why I pointed out the specific issues with use of a covert video during a disciplinary process, where that has not been previously covered in the organisation's privacy policy.

https://www.boards.ie/discussion/comment/121571246#Comment_121571246

We don't know that the company did not collect the video. There could be emails between managers setting out their plan to record the covert video.

All we know is that the video was taken by another manager in the company.

Jim2007

https://www.boards.ie/discussion/comment/121571673#Comment_121571673

Exactly you don't so stop dragging the thread down a rabbit hole.

Danny Drier

https://www.boards.ie/discussion/comment/121564359#Comment_121564359

Can you post the video so we can review properly and opine?

witchgirl26

https://www.boards.ie/discussion/comment/121571673#Comment_121571673

Ah come on? Now you're suggesting collusion between managers to record an event? And if there was, wouldn't that indicate a longerterm problem with the employee and suspected intoxication. At which point, most companies could invoke Health & Safety policies which will often include a clause around testing employees for drugs or alcohol. You're now just reaching. Most likely thing was the person involved grabbed the phone and recorded it. 9 times out of 10 they simple explanation is the correct one.