Videoed in work

AndrewJRenko

https://www.boards.ie/discussion/comment/121582504#Comment_121582504

Your employer is almost certainly breaking data protection law. If you're concerned, you can report them to the DPC now, or you can wait until they try to use the CCTV in their dealings with staff and report them then.

If you're in a union, it would certainly be worthwhile getting the union involved. If you're not in a union, this would be a good time to consider organising.

https://www.boards.ie/discussion/comment/121585643#Comment_121585643

Sorry, but when did a simple management communication become 'whistle blowing'? Is every communication relating to any employee error now whistle blowing? If I email one of my team saying "I didn't like the way you did X, please do Y the next time" am I whistle blowing?

There are now 'understandings' in relation to GDPR compliance. There are specific legal obligations, and when companies screw up on these, it costs them big money - tens of thousands, hundreds of thousands, millions or billions.

The company phone is operated by the individual, as part of their employment - same as any company owned equipment - same as CCTV or factory equipment or anything else. You seem to be spinning here to try to distance yourself from GDPR obligations, but employers are responsible for how company equipment is used. It's up to the employer to have appropriate policies and controls in place.

And if it was a personal phone, companies have obligations to have appropriate procedures in place also about how personal phones are used in the workplace.

Yes, you can certainly reach.

witchgirl26

https://www.boards.ie/discussion/comment/121586302#Comment_121586302

Because if the video is shared indicating a practice (e.g. intoxication) that contravenes company policy & poses a danger to others, it can be classified as whistle-blowing. It's not giving out to someone for not doing their job correctly. Obviously. There's a massive difference.

I know about all the fines etc around GDPR and I'm not trying to say that the company doesn't have an obligation around them but likewise, the nature of the information involved here indicates a specific type of processing under GDPR which is allowed due to the nature of the information and to what it relates. It's literally covered by both the GDPR and Whistleblowing legislation as to how to correctly process this so as to recognise the individual who was recorded rights under GDPR but also the companies in regards safe practices etc.

https://www.dataprotection.ie/en/individuals/know-your-rights/restriction-individual-rights-certain-circumstances First line - it's not an absolute right so on the balance of information processed here (video of someone presenting as intoxicated), the balance would indicate that the video could be processed in the investigation of the incident. Now it can't be used solely for a gross misconduct, because as someone else pointed out, you can't actually fully determine if someone is intoxicated just by a video. But it would be allowed to be processed.

AndrewJRenko

https://www.boards.ie/discussion/comment/121586554#Comment_121586554

That's a big leap there, from someone being under the influence (as the OP stated) to posing a danger to others. We've had nothing from the OP to suggest there was a danger to others.

And anyway, how do you define 'danger'? Is an employee error that will result in reduced profits a danger to others? Is an employee error that causes slight reputational damage a danger to others?

The specific type of processing may well be allowed, but it STILL needs to be covered in the privacy policy of the organisation.

witchgirl26

https://www.boards.ie/discussion/comment/121588029#Comment_121588029

It depends on the workplace of course but somebody being under the influence in a warehouse could be a massive danger. It's why you're not allowed to be under the influence. Yes if it's an office scenario, less likely but there are still things that can happen. And danger I do mean physical danger to themselves or another as the employer has obligations to the health & safety of all individuals. Including the one who is under the influence. If they fall & bang their head off a desk for example. Or bump into someone causing them to fall or spill a hot drink on themselves. I'm not saying that we should all be wrapped in cotton wool here but recognise that people under the influence can often be a danger to themselves & others, unintentionally, & there's a reason you're not allowed in the workplace in that state.

Reputational damage is a real thing but in cases like this (well ones where I've been involved) that has not really registered as a concern at all in regards the case. It's more an after the fact thing of how the company can deal with any potential reputational damage once the issue itself has been resolved.

I never said it didn't have to be covered in the policy but it doesn't have to be called out specifically. If you have a whistleblowing policy in work, then it will likely include a line saying that information will be processed in line with legislation (to save them changing it every time something changes). And considering that having a whistleblowing policy is now law across the EU, it would be hard for the OP to claim something under GDPR against the investigation.

AndrewJRenko

https://www.boards.ie/discussion/comment/121590672#Comment_121590672

Honestly, you're reaching so far here you're about to topple over.

There is absolutely nothing in the OP about danger. Yes, that is a possibility in certain conditions in certain workplaces, but it's a fair old stretch to say there's danger here so this is a whistleblowing scenario.

There is absolutely nothing in the OP about whistleblowing. I'd bet a fiver if you asked the person who did the video recording if they were whistleblowing, they would look back at you with a confused stare. There's nothing to suggest that this is a whistleblowing scenario.

You really don't seem to understand how GDPR policies work. Of course this personal data category has to be called out specifically. That's the whole purpose of these policies. If it's not called out specifically in the policies, then the data is not being processed in compliance with GDPR, which is a requirement for whistleblowing, according to the link you posted yourself.