Videoed in work

AndrewJRenko

https://www.boards.ie/discussion/comment/121567165#Comment_121567165

Did you read the link you posted? There is nothing in there to say that a whistleblowing scenario overrides GDPR requirements, quite the opposite:

This personal data must be handled in a GDPR-compliant manner. 

The employer would absolutely need a legal basis to process such data. An employer coming up with that legal basis in retrospect, AFTER the incident arose, rather than beforehand, clearly documented in a Privacy Policy and employee contracts would be on very dodgy ground. If there is a legal basis for processing videos recorded by peers, that should absolutely have been made clear up front - and I'll bet you a fiver that it hasn't been made clear up front.

Former Former Former

https://www.boards.ie/discussion/comment/121567110#Comment_121567110

Again. The company was not using cameras for anything. The video was taken by another employee on his/her phone. Citing the rules for CCTV over and over again isn't really helpful.

Unless the company starts sharing the video on the office WhatsApp or some other inappropriate use of the footage, then they are absolutely entitled to view it and use it.

If I walked into the office, punched a co-worker in the face and it was captured on cameraphones by 20 of my co-workers, would I be able to claim GDPR protection?

Mrs OBumble

https://www.boards.ie/discussion/comment/121567140#Comment_121567140

And it would look to the colleagues as though X was persistently allowed to be drunk at work, with no consequences!

You really think that is OK?

At very least, colleagues need to know what to do if an incident arises and the manager isn't on-site.

witchgirl26

https://www.boards.ie/discussion/comment/121567744#Comment_121567744

Did you? I didn't say it overrode GDPR requirements but that the individual accused of being intoxicated can't cite GDPR as a reason to not have the video used.

From the link:

4.1 Ensure lawfulness of data processingWith regard to the lawfulness of your processing data relating to whistleblowing reports, you can justify using one of two different reasons, as set out in the data protection directive:

• You are doing so to comply with a legal obligation
• You are pursuing a legitimate interest using the data.  

In most cases, your legal basis for data processing will fall under the first reason. When a whistleblower makes a report, you are obliged to investigate, which requires processing data. If the first reason does not apply, you would have to prove that you were processing data in the public interest, relating to national or EU law, to justify your actions under the second reason. 

If there is a whistleblowing claim you are legally obliged to investigate it. The legal basis isn't in retrospect at all. Employers do not have to have policies about what people do with their phones in regards recording other employees as it is not a company thing. They do around CCTV however but that is only if they want to access the CCTV to confirm the incident.

Also from that article:

In order to comply with GDPR, you should inform persons concerned about the fact you are processing their data. However, as this could hinder any investigation, you are allowed to delay disclosure until the high risk of obstructing the reporting process is diminished. Article 14.5(b) of GDPR offers an exemption in cases where disclosure is “likely to render impossible or seriously impair the achievement of the objectives of that processing.“ 

So please explain to me where I said that it overrode GDPR and also anything I said that was incorrect? What I did say was that the employee cannot make this go away or get the company fined under GDPR legislation because they don't like that another employee (level doesn't actually matter in the cases of whistleblowing) took a video of them.

AndrewJRenko

https://www.boards.ie/discussion/comment/121568215#Comment_121568215

If the company wants to use the video taken by the other employee during the disciplinary process, then the company absolutely IS using cameras. You need to review the definition of 'processing data' under GDPR.

https://www.boards.ie/discussion/comment/121568562#Comment_121568562

That's where the training that I mentioned comes in to play, training colleagues to MYOB and not make assumptions based on appearances.

Management need to put cover in place for all kinds of things if the manager isn't on site. That's fairly standard, and nothing to do with being videod in work by a colleague.

Akrasia

There is another element of GDPR relating to the collection and retention of PII.

If you collect data for one purpose, it cannot usually be used for another unrelated purpose.

In this case the data was collected specifically for the purpose of making a whistleblower complaint as part of a formal or informal investigation.

AndrewJRenko

https://www.boards.ie/discussion/comment/121569179#Comment_121569179

What you and the authors of that blog are failing to recognise is the duty of the organisation to have policies and procedures in place BEFORE these situations arise, not after. If the organisation is going to use recordings or other data as part of whistleblowing reports, then they need to have covered that off in employee contracts and their privacy policy beforehand.

If they don't have this covered beforehand and decide retrospectively that it is acceptable to use covert video recordings, they could very well find themselves facing serious difficulties and fines under GDPR.

witchgirl26

https://www.boards.ie/discussion/comment/121569230#Comment_121569230

Whistleblowing policies & procedures are required legally to be in place since the end of 2021. All employers should have them and it does allow for that. It does not have to be covered in any employment contracting as whistleblowing is protected as is the person who is doing the whistleblowing. Policies must be available to all employees and also the information as to where & how to report but no update to contracts are needed. If the company (i.e. as the organisation not an individual) is covertly recording, this would be a problem but someone recording someone doing something they perceive as dangerous in the workplace is not going to be a problem. They won't find themselves facing any fines under GDPR if they are processing provided information (either verbal, written or video) under whistleblowing. Seriously this is not complicated and is well covered under both the GDPR and the Whistleblowing directives and legislation. And whistleblowing is legally protected so that there can be no come back on a whistleblower unless malintent has been proven which is seriously difficult to do. It's protected under law. And also as companies are legally obligated to investigate all whistleblowing (no matter how stupid the report may seem), the processing of any information under that is again protected by a legal obligation.

Former Former Former

https://www.boards.ie/discussion/comment/121569217#Comment_121569217

You need to review the definition of 'processing data' under GDPR.

I do not. I know exactly what the definition is.

I'm saying that they are entitled to process the data so long as it is reasonable and proportionate.

GDPR is not a Get Out of Jail Free card, it is a set of obligations on how to process data. Process the data in accordance with GDPR and there should be no issue.

bop1977

there was a case in the WRC where the guy was awarded $15 k because the company didnt/couldnt test the employee. the company needs to send the employee to the company doctor to get a sample taken. the video probably wont be enough to get fired.

https://www.ibec.ie/employer-hub/hr-management-guide/dismissal/case-law/welder-awarded-15000-in-unfair-dismissal-claim-despite-admitting-he-consumed-alcohol-before-work

AndrewJRenko

https://www.boards.ie/discussion/comment/121569366#Comment_121569366

And GDPR policies and procedures are required legally to be in place since May 2018.

You're right, it's not complicated - the Whistleblowing legislation does not override the obligation to have GDPR policies and procedures setting out the legal basis for processing data, the usage of the data, how long it is retained and more.

AndrewJRenko

https://www.boards.ie/discussion/comment/121569398#Comment_121569398

If they don't have the legal basis for processing and other requirements set out in their Privacy Policy beforehand, then they're not processing data in accordance with GDPR.

witchgirl26

https://www.boards.ie/discussion/comment/121569496#Comment_121569496

No but the whistleblowing directive & subsequent legislation takes into account GDPR and allows for the processing of all relevant provided information during the course of an investigation. And it does set out that it should be kept confidential & only viewed by a limited number of people and only those involved in an investigation.

If this was put in as part of a whistleblowing (the video I mean) the person who monitors that hotline would be allowed to view it and process it in line with both the whistleblowing legislation & GDPR. I don't know why you're trying to argue that GDPR somehow trumps the whistleblowing or that processing the information is in contravention to GDPR which could result in fines.

https://www.boards.ie/discussion/comment/121569454#Comment_121569454

Yes video evidence of looking like their intoxicated wouldn't be enough necessarily for a dismissal, there would have to be other evidence. However it could be enough for a formal warning and to be place on a PIP plan depending on the actions portrayed in the video as the actions (not the cause) could be potentially harmful to other employees.

AndrewJRenko

https://www.boards.ie/discussion/comment/121570964#Comment_121570964

It allows for "allows for the processing of all relevant provided information during the course of an investigation" provided that the information is processed in a GDPR compliant manner, as detailed in the article you quoted. It's not a hall pass to ignore GDPR requirements to have a Privacy Policy setting out what information you use, what the legal basis for use is, and how it will be processed and retained.

They still have to comply with GDPR, and unless their Privacy Policy sets out the legal basis for using covert video taken by a manager, they are not complying with GDPR and are exposing themselves legally.

I'm gonna leave it there, as we're largely going round in circles now, but you can't use Whistleblowing regulations to take short cuts on GDPR.

bucketybuck

People blowing on about GDPR tend to be the same who blow on about "The Consumer rights act" ad nauseum. In other words, it is such a broad topic that just shouting "GDPR" is basically meaningless.

Jim2007

https://www.boards.ie/discussion/comment/121571192#Comment_121571192

Well yes I think the whole thing is a bit of a hail Mary prayer at the end of the day. The bottom line is that there is an actual witness to the event - the person who took the video, so they probably won't use it in any case and even if it was used and excluded during the judicial processes the case could still move forward. The company did not collect the video an individual took it upon themselves to do so, so the company might receive a reprimand for that, but that is about it.

And in any case the OPs solicitor would most likely tell him to shut up about the video, because arguing to exclude a video about an event you are trying to claim did not happen is not a great way to go, if the argument to exclude it failed.

AndrewJRenko

https://www.boards.ie/discussion/comment/121571192#Comment_121571192

Which is why I pointed out the specific issues with use of a covert video during a disciplinary process, where that has not been previously covered in the organisation's privacy policy.

https://www.boards.ie/discussion/comment/121571246#Comment_121571246

We don't know that the company did not collect the video. There could be emails between managers setting out their plan to record the covert video.

All we know is that the video was taken by another manager in the company.

Jim2007

https://www.boards.ie/discussion/comment/121571673#Comment_121571673

Exactly you don't so stop dragging the thread down a rabbit hole.

Danny Drier

https://www.boards.ie/discussion/comment/121564359#Comment_121564359

Can you post the video so we can review properly and opine?

witchgirl26

https://www.boards.ie/discussion/comment/121571673#Comment_121571673

Ah come on? Now you're suggesting collusion between managers to record an event? And if there was, wouldn't that indicate a longerterm problem with the employee and suspected intoxication. At which point, most companies could invoke Health & Safety policies which will often include a clause around testing employees for drugs or alcohol. You're now just reaching. Most likely thing was the person involved grabbed the phone and recorded it. 9 times out of 10 they simple explanation is the correct one.

Ash.J.Williams

https://www.boards.ie/discussion/comment/121565873#Comment_121565873

The video isn't needed, if someone reports drinking onsite the boss will open an investigation and then follow process

AndrewJRenko

https://www.boards.ie/discussion/comment/121573887#Comment_121573887

As an investigator, I'd expect you to be open to all possibilities. When someone else's line manager takes an action like this, recording a staff member, I would be very keen to know the back story.

And yes, it's not the most likely possibility, but it absolutely is a possibility - and one that puts a dramatically different spin on the GDPR issues around processing of the video.

witchgirl26

https://www.boards.ie/discussion/comment/121574086#Comment_121574086

I think you are reaching.

As an investigator I would look at the facts that are presented, interview witnesses and obtain the evidence that is available to me. I would not spend my time looking for potential collusion unless there was some evidence of it. Also it would go against all whistleblowing legislation about the protection of whistleblowers from retaliation for reporting unless there is clear malice in it. You'd find yourself in a lot of trouble over that. As an investigator of a whistleblowing claim, you are looking at the incident reported & if there is any relevant history of the individual who the claim is made against. Indeed the person making the claim & who has submitted the video can choose to remain anonymous which means you legally cannot look at anything to do with them even if you know yourself who it is.

And actually it wouldn't change the GDPR position on the processing of it as it would still be covered under the need to look at it & assess it under the whistleblowing. Yes it's on a managers phone but a phone is a personal device as opposed to something like CCTV which is company owned and operated. And as pointed out above, if the person reported anonymously, you literally can't go off your own ideas who it is to investigate it.

AndrewJRenko

https://www.boards.ie/discussion/comment/121574717#Comment_121574717

To be honest, applying 'whistle blowing' this this scenario in the first place was completely overreaching. There was no suggestion from the OP that this was a whistle blowing situation, but because you know a bit about whistle blowing, you've applied your knowledge to a different situation. If you only have a hammer, everything looks like a nail.

This wasn't about whistleblowing. It wasn't an employee out to save the world or the company. It was one manager reporting the actions of another employee, someone lower down the line than them, based on video recordings made without the consent of the target.

The OP also clarified that the phone in question could well have been a company phone, so it absolutely IS company equipment, with the company responsible for setting out policies around how it is used, and how data is processed.

And even if it was about whistle blowing, the obligation to process data in compliance with GDPR still applies (for the umpteenth time).

Ted222

https://www.boards.ie/discussion/comment/121573916#Comment_121573916

This is the beginning, middle and end of the correct response to the issue raised.

If disciplinary action is being considered, the strength of testimony of the witness should be considered on its own merits.

Flinty997

https://www.boards.ie/discussion/comment/121571246#Comment_121571246

Exactly this.

F1ngers

https://www.boards.ie/discussion/comment/121564359#Comment_121564359

How does a video prove worker was under the influence?

Unless a blood sample or breathalyzer was taken, how can the videographer/HR prove it?

Were there other witnesses?

Is it one persons word against another?

What proof do they have?

"I was acting the maggot, won't happen again."

RobbieV

My employer recently put up over 2 dozen CCTV cameras around our workshop, fuel and chemical stores, warehouse and other areas of offices. Was done in November over a weekend.

Never said anything, nobody asked , nobody told etc

Came in one day to a rotating camera above my work bench.

witchgirl26

https://www.boards.ie/discussion/comment/121575608#Comment_121575608

Ok re-read your second paragraph there. It was someone reporting the actions of someone else - that is whistleblowing. It's literally the essence. While the companies have to have official channels in place, people can also just report it to anyone & it still has to be treated the same. And also the same could be said for you banging on about GDPR continuously without understanding some of the nuances in it.

And yes the data has to be processed in line with GDPR but there are specific understandings around that for the cases of whistleblowing. Like not necessarily having to inform the person straight away if it would hinder an investigation. And you were the one with all the conjecture about "saving the company" or the managers intentions etc. None of that actually matters.

Company phone or not it is not owned & operated by the company. It's operated by an individual. It doesn't matter their level or not, it's the operator. For someone who's so pedantic on GDPR you should understand those terms. Also you do get in to the realms of was it the company phone or not as some people have 2 so how could they know which was used to make the recording. See I can reach too.

blackbox

https://www.boards.ie/discussion/comment/121582504#Comment_121582504

Was it already covered in your contract of employment?