What should be taken into considaraton by an employer while planning the introduction of visual monitoring?
Today, on the website of President of the Office of Personal Data Protection (President of UODO), a video containing guidelines of the President of UODO regarding the use of video monitoring was published. Presentation of Dr Edyta Bielak is a continuation of the information campaign of the Office regarding this form of data processing – already in June 2018 the Office prepared a guide on the use of video monitoring. Familiarizing with the guidelines of the President of the UODO is particularly important for employers who use monitoring in their premises, because this form of personal data processing is included in this year’s list of planned Office inspections. Below are the most important matters that should be taken into account before the introduction of video monitoring in the workplace:
1.What form of video monitoring will be used?
The employer, when deciding to introduce monitoring, most often chooses a system in which the cameras automatically register the image all the time and regularly overwrite it. However, more advanced systems are also available to recognize face or registration plates of cars entering the premises. GDPR and the Labor Code impose on the employer various duties and restrictions depending on the chosen method of monitoring the workplace. For example, the use of a person-identifying system is allowed only in certain situations and may require a data protection impact assessment (DPIA).
2.What will be the purpose of carrying out video monitoring?
The employer has the right to use monitoring in order to ensure the safety of employees, property protection, production control or secret information, disclosure of which might expose the employer to detriment. Monitoring in the workplace cannot be used for other purposes, e.g. quality control of work performed by employees, verification of working time or the way employees spend their breaks, e.g. by observing a smoking room and a canteen.
3.Is the introduction of monitoring necessary?
Because video monitoring is considered to be a far-reaching interference with the privacy of employees, its use is allowed only if the employer is unable to achieve the goals indicated in point 1 by other means, for example by limited access to rooms or employment of a security company. It is recommended to carry out and document the so-called “equilibrium test” that will help the employer to assess whether in his particular case he can use monitoring due to legitimate interest of the data controller (Article 6 (1) point f of the GDPR). It should also be considered whether the introduction of monitoring will actually contribute to achieving the intended purpose, e.g. production control.
4.What area will be monitored?
The employer cannot freely place monitoring cameras on the premises of the workplace. It should be remembered that the location of the cameras must be carried out in accordance with the intended purpose of monitoring, and also that the camera image must not include neighboring properties, pavement around the premises and rooms in which, with some exceptions, monitoring cannot be used, for example, bathrooms, changing rooms or canteens. In the case of monitoring in the office, it is worth remembering not to violate the privacy of employees by registering, for example, a computer monitor image. Because employees have the right to know what area of the premises is covered by monitoring, it is forbidden to place dummy cameras.
5.Who will have access to recording of monitoring recordings?
The employer as an administrator of personal data can independently manage the monitoring system or use the services of external companies dealing with the protection of persons and property. In any case, he must remember to provide access to monitoring recordings only to those employees which are entitled on account of their professional responsibilities – after granting authorization to process the data. Employment of an external company will most often require the conclusion of a contract for entrusting the processing of personal data.
6.How long will the monitoring recordings be stored?
The employer has the right to process monitoring recordings for a relatively short period – as a rule, no more than 3 months. This term may be extended if the video recordings are evidence in law-based proceedings or if the employer has received a message that they may constitute evidence in such proceedings – until the final conclusion of the proceedings. When planning to introduce monitoring, it is worth setting up an internal instruction for storing and deleting recordings, as well as preserving them for the needs of ongoing proceedings.