Argentina, Belgium, Brazil, Czech Republic, Denmark, Finland, France, Germany, Greece, Hong Kong, Hungary, Italy, Kazakhstan, Latvia, Lithuania, Luxembourg, Mexico, Netherlands, New Zealand, Peru, Poland, Portugal, Russia, Slovakia, Sweden, United Kingdom.
On 17 October 2019, the Grand Chamber of the European Court of Human Rights issued a judgment (López Ribalda and Others v Spain) refining the criteria previously established by the Chamber on 9 January 2018 on video surveillance in the workplace and hidden monitoring of employees. This judgment will provide an important reference point in the ongoing European judicial controversy on this topic.
1. Summary of the facts
Faced with well-founded suspicions of theft resulting from inconsistencies between stock levels and normal sales figures, the company installed a video surveillance system using visible and hidden cameras. The company informed the workers of the visible cameras (directed towards the doors) but not of the hidden cameras (focused on the tills).
All workers suspected of theft were called for individual interviews in which they were shown the videos. The cameras had filmed the five plaintiffs as they helped customers and co-workers steal items and stole themselves. The plaintiffs admitted having taken part in the thefts and were dismissed for disciplinary reasons.
Three of the five plaintiffs signed an agreement acknowledging their involvement in the thefts and waiving their claims in the employment courts for dismissal, in return for which the company promised not to prosecute them. The other two plaintiffs did not sign the agreement. The five plaintiffs took legal action but their dismissals were declared fair.
The ECHR Grand Chamber’s decision is composed of two main elements.
Firstly, it analyses the possible violation of the right to private life (Article 8 ECHR) of hidden video surveillance obtained without informing the workers of its existence and purpose and their rights (Article 5 Convention for the Protection of Human Rights and Fundamental Freedoms, the ‘Convention’).
Secondly it examines the possible violation of the right to a fair trial (Article 6.1 Convention) by admitting these video recordings as evidence and the validity of the settlement agreements signed by several workers after viewing the images, alleging that there was coercion by the company.
On this second question the Court ruled that:
The recordings were not the only evidence on which the Spanish courts based their conclusions. Consideration was given to the questioning of the plaintiffs by admitting their misconduct, the testimony of the supermarket manager, the company's legal representative, and the expert report contrasting the recorded images with the video surveillance and cash register receipts. A significant number of purchases had been cancelled without payment.
The plaintiffs did not contest the validity of the agreements at the time of the dismissal and did not object to their admission as evidence. There was no indication of coercion when they signed the agreement
2. Necessity and proportionality
The other and main axis of the case is the issue of video surveillance and its impact on employees’ privacy. The judgment confirms the doctrine of the Spanish Constitutional Court (STC 186/2000) and incorporates mutatis mutandis the so-called Barculescu Test (relating to controls on the use of a computer) to video surveillance of workers in their workplace. It sets the factors to be followed in evaluating the balance between the two conflicting interests: the employees’ right to privacy and the employer’s interest in the protection of its property right.
Information
The workers were informed of the implementation of video surveillance cameras (two other cameras were installed secretly).
The degree and extent of intrusion
The level of privacy in a public area where workers are in contact with customers is not the same as in a more private area. The cameras only covered the payment area at the cash registers where the losses occurred.
Legitimate reasons
The company provides legitimate reasons for the installation: the continued losses recorded at the cash registers alerted the employer to a probable theft scenario. In addition, the suspicion and consequent investigation did not focus on the improper conduct of a single employee, but on concerted action by several employees.
Were the intrusive means used necessary?
Video surveillance requires greater justification, here based on the discovery of losses and numerous voided purchases. From these it could be inferred that there was not just one perpetrator but several conspirators colluding, as was demonstrated: employees participated, but customers external to the company were also involved in the thefts.
The Court also noted a revealing and significant fact: informing any member of staff about the covert video surveillance could have thwarted its purpose.
Purpose of video surveillance and its use by the employer
The monitoring was conducted strictly to achieve the objective of finding those responsible for the losses recorded. After recording for ten consecutive days, monitoring ceased as soon as the employees responsible for the thefts were identified. In addition, only the supermarket manager, the company's legal representative and the union representative saw the recordings before the workers did.
Appropriate guarantees
Workers received appropriate guarantees relating to the use of intrusive media: employees had the right to be informed under the Spanish Organic Law on Data Protection and the company installed one or more information panels notifying the public about the presence of CCTV cameras.
Possibility of a complaint
Finally, employees could have filed a complaint before the Spanish Data Protection Agency regarding the employer's failure to comply with its obligation to provide them with prior information regarding the surveillance, or they could have filed a lawsuit to obtain redress for the alleged violation of their data protection rights. The employees did neither of these things.
3. Conclusions
The Grand Chamber concluded in López Ribalda v. Spain that surveillance of workers using hidden video cameras is valid, but will be unjustified if there is just a slight suspicion of misappropriation of company property or any other crime committed by employees. The installation of hidden video surveillance by the employer is only allowed in cases where there is reasonable suspicion that a serious infringement has been committed with significant harm to the company.
This does not mean that the employer has a blank cheque to use hidden cameras indiscriminately and without informing employees prior to their use as a suitable means of controlling work performance or protecting the company's assets. The rule of thumb establishes an obligation to inform workers in advance if they are going to be subject to video surveillance: this is a necessary guarantee to preserve the right of privacy enshrined in Article 8 of the Convention.
The exception established to this rule in the López Ribalda case when using hidden cameras without informing staff arises from a finding of well-founded indications of serious illegal acts committed by employees (in the present case theft) and the absence of less intrusive alternative means to achieve the desired result. For this reason and in short, hidden surveillance will not be valid in the face of a mere minor suspicion of wrongdoing committed by employees.
Argentina, Belgium, Brazil, Czech Republic, Denmark, Finland, France, Germany, Greece, Hong Kong, Hungary, Italy, Kazakhstan, Latvia, Lithuania, Luxembourg, Mexico, Netherlands, New Zealand, Peru, Poland, Portugal, Russia, Slovakia, Sweden, United Kingdom.
In Argentina, video monitoring employees is allowed as long as the surveillance is not discriminatory or an invasion of the employee´s privacy. If the employer decides to install video cameras in the workplace, the Ministry of Labour (the local authority for labour matters and labour inspectorate) must be notified.
Intrusive monitoring that violates employees’ dignity, such as cameras installed in bathrooms or dressing rooms, or any other system targeting selected employees without reasons is prohibited.
Labour tribunals do not accept video recordings in legal proceedings if they are intrusive. However, if cameras are visible, the relevant notification was made to the Ministry of Labour, and surveillance is required for security reasons or because of the organisation’s special activity, the film can be used (provided employees’ dignity is not affected). Film records will normally be accepted if they are certified by a notary public who determines the date and place of the recording, the equipment used and the integrity of the video.
Verónica Puerta Basaldúa, Funes de Rioja
Back to list of contributing countries
Belgian law does not allow hidden video surveillance. According to national Collective Bargaining Agreement nr. 68 of 16 June 1998, the employer must inform the works council and employees among others of the number of cameras and where they are installed. Usually employers will include a plan with the exact placing of cameras with their camera policy.
When cameras film employees not only employees but also the wider public, companies should also adhere to the legal provisions of the Camera Act of 21 March 2007. This act provides an obligation to display pictogram signage and to register every camera via an online site.
If, however, evidence is found from hidden cameras, it is not excluded that, as in the Ribalda case, the court would take it into account. According to Belgian Supreme Court case law, evidence can be accepted even when it was obtained in breach of the law on condition that the formalities that were not respected were not sanctioned with nullity (video footage is not) and the truthfulness of the evidence is not questioned.
Inger Verhelst, Claeys & Engels
Back to list of contributing countries
CCTV monitoring is generally permitted in Brazil if there is a visible notice informing individuals it is in operation. An organisation does not need to have pre-existing security issues to use it. But it is forbidden to monitor specific employees and areas of social interaction (cafeteria and lounges), toilets and dressing rooms. There is an interesting case from 2015 in which the Labour Court of São Paulo held that a hotel was not guilty of a violation of privacy resulting from CCTV installed in the hotel locker room. The court rejected a claim for damages because the cameras focused only on the lockers, keeping the adjacent dressing rooms free from surveillance. There were proper signs stating that there was CCTV monitoring and the hotel was not liable for the plaintiff’s decision to change in the locker room.
José Carlos Wahle, Veirano Advogados
Back to list of contributing countries
In the Czech Republic, employees must also be duly informed about personal data processing and specific monitoring methods (video surveillance). This judgment, however, allows employers to monitor and control serious wrongdoing by employees to protect their business and/or property. This conduct was considered illegal, which caused serious problems for employers in detecting perpetrators among employees. In practice, employees are usually fully aware of the use of cameras and know which locations are (not) monitored.
We believe that employers have not used hidden cameras (to a greater extent) because they were aware that such evidence could not be used in subsequent investigations or proceedings. Ribalda confirms that in certain circumstances it is not illegal for employers to use hidden cameras, creating a new option where there is serious suspicion of criminal activity.
However we strongly believe that this judgment does not allow general use of hidden cameras or not informing employees in line with GDPR about personal data processing and share the concern about how Ribalda will be interpreted by employers and supervisory authorities in practice. We are particularly concerned that this judgment could be misinterpreted and lead to widespread use of hidden cameras, even when there is no serious suspicion, or a serious suspicion proves to be unsubstantiated, which could be very difficult for personal data subjects and supervisory authorities to identify and monitor.
Irena Lišková, Randl Partners
Back to list of contributing countries
In Denmark, many employers are covered by a collective agreement on monitoring measures. According to these agreements, the employer must inform employees about any monitoring measures no later than six weeks before their implementation, unless the purpose of the monitoring measures would be thwarted if the employee or employees in question were notified.
In a situation where an employer has a well-founded suspicion that one or more employees are committing a criminal offence ( e.g. theft), the purpose of the video surveillance would be forfeited if the employees were notified. In such a situation, ‘hidden’ video surveillance would not constitute a violation of the above-mentioned agreements on monitoring measures. Further, it follows from the Danish Data Protection Act that the duty of disclosure, (see Article 14 of the GDPR), does not apply in the event of investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The ECHR Grand Chamber’s decision is, thus, consistent with the Danish legal position.
Elsebeth Aaes-Jørgensen, Norrbom Vinding
Back to list of contributing countries
In Finland, the Act on the Protection of Privacy in Working Life sets out strict conditions for the use of camera surveillance in the workplace. Camera surveillance must be transparent, which includes ensuring that employees are consulted and notified before surveillance starts and a prominent notification is displayed in areas where cameras are located. It is generally prohibited to direct cameras at particular workstations but this is allowed in certain cases if, for example, it is necessary to prevent or investigate property crimes. However, employees must be informed of the location of directed cameras.
The law does not allow covert camera surveillance in the workplace. However, should an employer collect footage by these means, this would not in itself prevent the employer from dismissing an employee based on the footage or submitting the footage as evidence in a trial. The employer would, of course, risk being sanctioned for the covert surveillance.
Jukka Lång, Oskari Paasikivi, Dittmar & Indrenius
Back to list of contributing countries
In France, this decision would certainly be questionable: the French Supreme Court and the French Data Protection Authority (the ‘CNIL’) have a very strict position on the obligation to inform employees when using a video surveillance device. The French Supreme Court considers that, in the absence of prior information, videos recorded from such devices are illegal evidence before employment courts and may not be used to justify disciplinary sanctions (for example, a dismissal), even when the device is installed at customers' premises. On 13 June 2019, the CNIL imposed a penalty of EUR 20,000 on a company that had set up a video surveillance system placing its employees under constant surveillance, without any satisfactory information being provided to them.
Basile Moore, Capstan Avocats
Back to list of contributing countries
German labour courts have had to decide very similar cases of covert video surveillance in supermarkets over the last view years. The criteria for acceptable surveillance are similar (information to data subjects, weighing of the intensity and legal purpose of the surveillance etc.). In addition, German courts point out that covert video surveillance can only be the last resort; the very last possible means if all other methods of investigation have failed.
A recent court verdict in Germany in a case similar to Ribalda, awarded EUR 2,000 compensation to a gas station employee who was subject to ongoing and covert video surveillance without any actual suspicion or legitimate reason. The case was decided under the previous legal rules. It is anticipated that compensation claims and awards will increase over the next years now that the GDPR applies.
Jessica Jacobi, KLIEMT.Arbeitsrecht
Back to list of contributing countries
In Greece, in general, covert or other kind of surveillance in workplaces, can be accepted only if:
Employees should be informed well in advance about any kind of surveillance. If any improper behaviour is recorded, the employer should also either be able to either demonstrate it through other means or have exhausted any other less extreme means before resorting to covert surveillance. According to L. 4624/2019, which implemented the GDPR in Greece, the processing of personal data through a closed circuit of optical recording within the workplace is only permitted when it is necessary to protect persons and goods and in any event should not be used as a criterion for evaluating employees' performance.
Korina Paschaliori, Kremalis Law Firm
Back to list of contributing countries
In Hong Kong, the Privacy Guidelines ‘Monitoring and Personal Data Privacy at Work’ and ‘Guidance on CCTV Surveillance and Use of Drones’ issued by the Privacy Commissioner for Personal Data basically endorse the principles in the Ribalda case.
Before installing and using any CCTV surveillance on the workforce, an employer has to assess whether it is appropriate, necessary and proportionate in the circumstances. In addition, the employer has to consider whether there are less intrusive alternative means for monitoring. Lastly, a data user must act and be seen to act responsibly and transparently in terms of its policy, controls and compliance with the data privacy laws on the use of CCTV.
Kenneth Leung, Lewis Silkin Hong Kong
Back to list of contributing countries
In Hungary legislation determines certain main aspects of video surveillance in general but leaves most of the specifics open. Thus, the Hungarian Data Protection Authority (HDPA) has taken it upon itself to settle these questions, issuing guidelines, decisions and opinions dating back as far as 2013, most of which are still considered relevant even after the GDPR’s entry into force.
Amongst the opinions and precedents set by the HDPA, the rules and legitimate grounds necessary to conduct lawful hidden video surveillance, compliant with data protection legislation, are notably absent. This omission causes uncertainty in terms of hidden video surveillance in general, but particularly for data controllers who cannot adequately ensure the protection of human life and property with visible video surveillance. We therefore expect the Ribalda decision to bring a lasting and much-needed change in data processing practice in Hungary.
Máté Laczkó, CLV Partners
Back to list of contributing countries
Remote monitoring of employees in Italy is subject to specific legislation (Art 4, L. no. 300/70) that requires the employer to enter into an agreement with the work council or to obtain an authorisation before installing cameras. The use of hidden cameras in Italy is forbidden and in any case subject to the above procedure. For some Italian commentators, the ECHR decision could strengthen the so-called ‘controlli difensivi’ (defensive checks) argument, according to which Article 4 would not apply if the remote monitoring is used to stop or prevent illicit behaviour. However, this interpretation remains risky even after the ECHR decision: the Court has established the use of hidden cameras can be compliant with the principles of the Convention but the declaration does not take into account the Italian rule above.
Mauro Gallo, Toffoletto De Luca Tamajo e Soci
Back to list of contributing countries
Video monitoring in the workplace without employees’ consent violates citizens’ constitutional right of a citizen to personal privacy. Several Kazakh regulations (Constitution, Civil code, etc.) refer to this. Moreover, in accordance with the Law on personal data and its protection, the image is data, based on which, a face that can be identified is the personal data. Collecting and processing personal data without an employee's consent may entail administrative and criminal liability.
In addition, employee have a right of access to accurate information on their working terms, as well as methods of control over their labour activities. Display of announcement on video monitoring at the working place is not sufficient. Monitoring of employees subject to production necessity and the nature of an employees' job functions are in the sphere of internal regulations, which are to be captured in the relevant employer's act with which, the employees are to be acknowledged in writing.
Yuliya Chumachenko, AEQUITAS Law Firm
Back to list of contributing countries
The case is interesting in terms of two aspects: proportionality of video surveillance scope and notifying employees. The interpretation of the proportionality limits is quite similar for Latvia, as filming only the zone with cash registers would not be considered to impact on the private life of employees seriously. However the issue of not informing employees about surveillance is vaguer. Currently the requirement to inform employees about this processing is based on Articles 13 and 14 of the GDPR as well as the provisions of the Latvian Data Processing Law. These acts do not provide any exceptions for not informing data subjects about video surveillance in similar cases. As a result, this case might have a serious impact on interpretation of controllers’ obligations stemming from the GDPR in video surveillance cases.
Anna Vladimirova-Kryukova, COBALT
Back to list of contributing countries
The Lithuanian data protection authority (DPA) has not provided any official comment regarding the Ribalda case to date. However, a similar public opinion ‘On the monitoring of employee communication’ can be mentioned as an example of a pre-GDPR approach. This provided that:
It is important to note that Lithuanian Law on the Legal Protection of Personal Data provides that employees must be informed in writing about the video and/or voice monitoring in the workplace.
Renata Vasiliauskienė, COBALT
Back to list of contributing countries
In Luxembourg, employment courts have almost systematically rejected evidence collected through illegal surveillance, notably where the employer had failed to inform employees and to obtain prior authorisation from the data protection authority, even where there was suspicion of wrongdoing.
It will be interesting to see if, in light of this ECHR decision and with a legal framework that no longer requires this prior authorisation, national jurisdictions will now use a margin of appreciation in assessing the admissibility of evidence.
However, employers need to remain extremely careful as illegal video surveillance still exposes them to criminal prosecution. The issue definitely goes beyond the mere question of admissibility of evidence.
Marie Behle, Castegnaro
Back to list of contributing countries
To our knowledge, Mexican courts have not yet ruled in any cases regarding covert video surveillance of employees. What the ECHR has ruled in the Ribalda case is an important precedent that could serve as a reference for Mexican courts to resolve similar cases, especially now that Mexico has strengthened its relationship with Europe by acceding to Convention 108.
Adolfo Athié, Erika Rodríguez, Basham, Ringe y Correa
Back to list of contributing countries
According to Dutch case law, the Ribalda case does not come as a surprise. In the Netherlands, hidden camera surveillance of employees is permitted if there is a concrete and demonstrable suspicion of any criminal offense, if it has turned out to be impossible to stop this without the use of cameras, if the surveillance occurs only occasionally, and provided that the employees are informed about the outcome of the surveillance afterwards.
It is striking that in the Ribalda case no damages based on article 82 GDPR (or any other breach of their rights under data protection law) were claimed by the employees who were dismissed. There are a few cases in the Netherlands in which the court has mentioned the possibility of remedies under article 82 of the GDPR, notwithstanding a valid dismissal of an employee. It is going to be interesting to see what the Dutch courts would do with this type of (GDPR-based) claim.
Ilse Baijens, Bronsgeest Deur
Back to list of contributing countries
If the Ribalda case was decided in New Zealand, the outcome would have been similar and the employer is likely to be found to have acted lawfully. Under New Zealand law, it is lawful to covertly record video footage of employees in the workplace if there is a reasonable belief of the occurrence of wrongdoing. The video footage can only be used to prove the wrongdoing. The threshold for the suspicion is similar to that in Spain: a slight suspicion is less likely to justify secret recordings. A New Zealand court or tribunal would also factor into its decision the lack of availability of less intrusive means and the fact that informing any member of staff about the covert video surveillance could have thwarted its purpose.
Peter Kiely, Kiely Thompson Caisley
Back to list of contributing countries
The Peruvian Authority for the Protection of Personal Data (APDP) has issued the Advisory Opinion No. 049-2018-JUS / DGTAIPD, which states that:
The APDP has also published a draft Directive on Video Surveillance that prohibits the installation of video surveillance systems in places intended for employees’ recreation. Where the employer takes action based on information from these systems, it is required to notify the employee, providing the images so that the employee can exercise his or her right of defence. The Video Surveillance Directive is currently pending final approval.
Carol Quiroz Santaya, Estudio Olaechea
Back to list of contributing countries
The judgment in the Ribalda case maintains the proportionality requirement as the basic principle for monitoring that constitutes a form of intrusion into employees' privacy. In Poland, quite strict provisions have been in place since May 2019 on when monitoring of employees’ is allowed and how it should be introduced and maintained by employers. Hidden video surveillance of employees can be hard to defend, since, according to the relevant legal provisions, employees must, with no exceptions, be informed they are being monitored. However, it seems that, as in the Ribalda case, covert video monitoring of employees under certain specific circumstances can be justified.
Paulina Szymczak-Kaminska, Raczkowski
Back to list of contributing countries
With this decision, the ECHR opens some room for a disputed but necessary debate. To the extent that the interests of both parties are preserved, it is important that the implementation of mechanisms for safeguarding employees' privacy does not become absolute vis-à-vis the interests of employers.
In Portugal the debate will be even more challenging, since the recent Data Protection Law which ensures the implementation of GDPR, establishes strict rules for the collection and processing of personal data, particularly that collected by video surveillance systems. According to the Portuguese legal regime, this data may only be used for disciplinary purposes when simultaneously used in a specific criminal procedure. The advisable balance between the employer’s interests and the individual’s personal data protection is not going to be easy to achieve, particularly taking into consideration the recent Portuguese Data Protection Law.
Pedro do Carmo Bleguinhas, pbbr
Back to list of contributing countries
Video surveillance in the workplace must comply with Russian labour and data protection laws, as well as the basic principles laid down under Russian Constitution.
Russian law prohibits covert video surveillance, except for the limited cases specified directly by the law (such as investigative activities). Employees must be notified regarding video surveillance. In particular, the company’s internal policy must explain the purpose of monitoring and its implications for employees, legal grounds for monitoring, employees’ and employer’s rights and obligations, personal data processing conditions and implications.
If any third party is involved in the employee data processing in the course of monitoring, the employees’ written consent to transfer their personal data to the third party must be obtained.
Anastasia Petrova, ALRUD
Back to list of contributing countries
According to the rules in the Slovak Labour Code, an employer can only monitor employees if:
The Slovak Data Protection Office has not yet issued any formal view on whether an employer can monitor employees for a legitimate interest (such as protection of its property) without prior notification about the manner and extent of monitoring. Should such a case occur, the Slovak Data Protection Office will certainly need to take the latest ECHR decision into consideration. We believe that this decision might indeed open the door to a slightly different approach to the protection of employees´ privacy in specific cases.
Peter Marciš, Nitschneider & Partners
Back to list of contributing countries
In Sweden, public authorities and other organisations that carry out duties in the public interest must apply to the Data Protection Agency to receive permission for video surveillance of public areas. It is not likely that the authority would approve an application if the circumstances were the same as those in the Ribalda case.
Private companies or public authorities carrying out video surveillance outside public areas are not required to obtain permission. If the private organisation or public authority is bound by a collective bargaining agreement, it has to negotiate the surveillance with the relevant trade union before it can be carried out.
Sofia Lysén, Elmzell
Back to list of contributing countries
The UK has more of a culture of employee monitoring compared to some other European jurisdictions; however that is not to say that monitoring may be undertaken without restriction. The right to private life applies in UK workplaces under Article 8 of the European Convention and under the UK Human Rights Act 1998, which incorporates this right into UK law. Whilst not technically binding, this judgment must be ‘taken into account’ by UK domestic courts determining questions on the right to private life. As in Spain, the right to privacy in the UK is a ‘qualified right’ (as opposed to an ‘absolute right’), meaning that it may be infringed where it is necessary and proportionate to do so. This judgment represents a common-sense approach to the use of CCTV in the workplace.
Benjamin Favaro, Lewis Silkin
