As an employer, you may have a number of reasons for monitoring your staff. You may track email and internet use, perform spot checks or use CCTV and video surveillance. These may be legal or regulatory requirements in some sectors, and others may use such measures for safeguarding purposes.

A recent data protection regulator decision reminds us of the risks to a business if monitoring activities are considered invasive.

Regulators in Germany have imposed a fine of €10.4 million on a notebook retailer after it was found to have conducted intrusive video surveillance against its employees. What is interesting to note is that this is a mid-sized business. The company, along with some legal commentators, says that “the fine is completely disproportionate [and] bears no relation to the size and financial strength of the company or to the seriousness of the alleged violation”.

While the decision falls out of our jurisdiction, there are lessons to learn from this. Remember, the UK still awaits an adequacy decision from the EU regarding data protection and our attitude towards similar scenarios is likely to influence such a decision. In short, employers need to take note.

Your data protection impact assessment (DPIA) and legitimate interest assessments (LIA) are valuable, not just a paper exercise.

In the German case, the State Commissioner said that the company had video-monitored its employees for at least two years without any legal basis.

This highlights the importance of your data protection impact assessments, which are intended to help you identify and minimize the data protection risks of a project or activity. Where legitimate interests is used as the legal basis, it is prudent to record your consideration of the individuals’ interests, rights and freedoms in the form of a legitimate interest assessment.

Your retention periods must be reasonable

In this matter it was also said that a retention period of CCTV footage of up to 60 days was far too long. What is reasonable depends on your justification for the activity in the first place. Again, your DPIA will be valuable here.

Mission drift must be avoided

It was acknowledged that there may be circumstances where the use of CCTV is permissible if there is reasonable suspicion against specific individuals. However, a general suspicion is not enough. The company claimed that the aim of the installed video cameras was to prevent and investigate criminal offences and to track the flow of goods in the warehouses. The CCTV was neither limited to a specific period nor to specific employees.

The State Commissioner summarised that “companies must understand that with such intensive video surveillance they are massively violating the rights of their employees”, stressing that employees should not give up their personal rights just because their employer puts them under general suspicion. It is the general view that other less invasive methods of employee monitoring exist such as random bag checks.

Deterrent effect

The regulator concluded that installing a system for monitoring your staff that violates personal rights for the aim of acting as an unprovoked, permanent deterrent is not reasonable.