The Spanish Data Protection Agency has sanctioned a restaurant with a fine of EUR 12,000 (reduced to EUR 9,600 for voluntary payment) for imposing a disciplinary sanction on an employee using images from a mobile phone video recording made by another employee in the restaurant as evidence.

Facts of the case

An employee who worked as a waiter in a restaurant filed a complaint with the Spanish Data Protection Agency stating that he worked in a restaurant where ‘video surveillance cameras have apparently been installed’ and ‘had recorded him and these recordings have been used inside and outside the premises to impose disciplinary sanctions in the workplace.’

The employee added in the complaint:

‘I was not informed of the existence of these cameras and although they are visible, the truth is that the employer said that they are not active, but these recordings have led to disciplinary proceedings.’

The employee was sanctioned for committing various acts that constitute breaches of his obligations (the sanction was suspension of employment and salary for 45 days).

The company provided evidence to justify the sanction, consisting of several videos made by another employee of the restaurant.

The company argued that the recordings referred to by the claimant (the sanctioned worker) were not made by video surveillance cameras in the bar but with an employee’s the private mobile phone. The employee was ‘tired of having to make up for the complainant’s failure to fufil his functions and continued absences from his job’, and the images were not made known to the company until two months after the events occurred, when the employee informed the company of the facts and delivered the recordings.

Findings

The Data Protection Authority makes it clear that in this case it has been proved that on the date of the facts stated in the letter of sanction to the employee, the claimant had not been offered information on the use and purpose of data collection using the video surveillance system or similar. In this case, given that a mobile phone was used individually, images were only captured from the claimant. This resulted in prejudice to the claimant and led to the imposition of the sanction.

The sanction letter also stated that images have been captured from outside the establishment on a public road showing the claimant’s movements on several days and at various of the day.

Although the images were not obtained using the video surveillance system, which was not connected, they came from a mobile phone, whose owner was unknown to the claimant, who therefore thought the images were captured by cameras set up in the bar.

A mobile phone recording that collects images of an individual who can be identified falls within the scope of protection of Article 1 of the GDPR. The company decided on the purpose and use of the images obtained by an employee, and has processed data for which he is responsible. The company has received the data, has saved and used it without the knowledge of the claimant, who was being followed several times a day, daily.

If these images are used, as in this case, to have a legal effect in an employment monitoring context, with an accompanying disciplinary sanction, the data protection regulations and their guarantees apply fully, particularly given that the company did not inform him about the data collection or his rights associated with it.

In this case, according to the Data Protection Authority, the images obtained and used reproduced the claimant’s image and allowed surveillance of his actions via the recording of him. This constitutes personal data, and this data was used to monitor his compliance with his employment contract.

From the proven facts, for the purposes of the GDPR, the owner of the establishment where the claimant provided services is the legal entity that used the recordings. He is responsible for processing the data without having previously informed the employee about monitoring of his work-related activities associated with recordings of him. He had therefore violated article 18.4 of the Constitution and article 5.1 (a) of the GDPR.

Before taking this decision, the owner should have taken into account that a CCTV system was already set up for recording images and using such a means of surveillance was likely to be deemed disproportionate and arbitrary since the employee was not aware that this data was in his employer´s possession nor that it could be used to monitor his working activities and sanction him.

For all these reasons, the Data Protection Authority imposed a sanction of EUR 12,000 for infringement of Article 5.1 (a) of the GDPR, as described in Article 83.5 of the GDPR. On 13 August 2019, the company paid a EUR 9600 penalty, making use of the reduction provided for in the proposed resolution, which combines a reduced payment with a waiver of any action or administrative appeal against the penalty.