Employers can use CCTV footage in a disciplinary case under GDPR, but only when the use is lawful, proportionate, and consistent with the reason the cameras were installed in the first place. Having the footage does not automatically mean the employer can rely on it for any purpose.
The first question HR needs to answer
If the company installed CCTV cameras to keep the building safe, then watching the footage to look into a break-in or a fight is usually considered appropriate. Pulling the same footage to check how long someone took on lunch probably does not. GDPR requires that personal data be processed only for the purpose it was collected. Stretching that purpose is where employers run into problems.
Employees need to be told that cameras operate in the workplace and that footage may be reviewed during investigations. The ICO’s guidance on video surveillance sets out how employers can communicate this.
When footage typically holds up
Three conditions usually need to be present. The employer is investigating something serious: theft, violence, or gross misconduct. The footage is directly relevant to what happened. And there was no less intrusive way to establish the facts. When all three are met, the employer can generally show that reviewing the recording was a proportionate response.
When using footage means a higher risk
Problems tend to start when the footage is pulled for something minor, like micromanaging an employee. These uses are harder to justify under GDPR because they go beyond the stated purpose.
Covert cameras raise the stakes further. If employees did not know they were being recorded, using that footage in a hearing is very difficult to defend. And when other evidence was available, but the employer reached for CCTV instead, that weakens the case too. An Irish hospice lost a data protection case because it used CCTV to penalize an employee, but the cameras were not installed to monitor that conduct in the first place.
What employees can ask for
Staff have the right to know that CCTV is active. If video appears when managers meet to discipline employees, that fact cannot surprise them. They can also ask to see video that involves them, though companies might need to blur or hide other people before they hand it over.
Teams that review how they handle CCTV evidence as part of a broader effort to conduct an HR audit are better positioned to show they were following GDPR rulings.
TL;DR
- Employers can use CCTV video to discipline staff under GDPR if why they use it fits the first reason they installed the cameras.Â
- Footage is typically valid when investigating theft, violence, or serious misconduct.
- Risk rises when managers use video for minor problems or when they fail to tell staff about the cameras.