The use of CCTV footage in the context of employment disciplinary procedures was recently considered by the Court of Appeal in Doolin v The Data Protection Commissioner [2022] IECA 117, following the appeal of an earlier decision from the High Court.
The Plaintiff, Mr. Doolin, had originally made a complaint to the Data Protection Commission (“DPC”) claiming that his data protection rights had been infringed where CCTV footage of him in the workplace was used in disciplinary proceedings against him. The Plaintiff argued that in circumstances where the CCTV cameras in question had been installed for the specific purposes of workplace security and health and safety only, the further usage of this footage in the context of unrelated disciplinary proceedings (involving alleged unauthorised breaks by the Plaintiff during work hours) was unlawful and in breach of the General Data Protection Regulation (“GDPR”).
Pursuant to the “purpose limitation principle” under the GDPR and Data Protection Acts 1988 to 2018, any personal data obtained by a data controller (in this case, the Plaintiff’s employer) should be obtained for one or more specific, explicit and legitimate purposes and should not be further processed in a manner incompatible with that purpose or purposes. The DPC rejected the Plaintiff’s complaint finding that the CCTV footage had been originally accessed solely to investigate a security issue (a legitimate purpose under the GDPR) and that while the personal data may subsequently have been used for another purpose (i.e. disciplinary proceedings) the CCTV images were not further processed for that purpose.
The Plaintiff appealed this decision to the Circuit Court (which appeal was dismissed) and subsequently, to the High Court. In upholding the High Court’s ultimate decision, the Court of Appeal outlined that it could not reasonably be said that the Plaintiff had been notified that the CCTV footage would be used for disciplinary purposes or that he ought reasonably to have expected such use. On that basis, the DPC erred in its finding that the data had not been further processed for that purpose. Therefore, the processing was not lawful and was in contravention of the GDPR’s purpose limitation principle.
The decision in Doolin is a timely reminder to operators of CCTV systems, particularly employers, that data subjects should be made aware of all purposes for which CCTV footage is being obtained and data controllers should ensure that their CCTV data protection policy and any/all signs accompanying CCTV cameras list these purposes.
The DPC has prepared helpful guidance on the processing of CCTV footage which is available here. To see a full copy of the Doolin decision, click here.
