Print this page

Report of the Data Protection Commissioner 2010

The report of the Data Protections Commissioner for 2010 is extremely instructive for employers in identifying issues that arise in compliance with the provisions of the Data Protection Acts. The entire report is worth reviewing for those who process personal data of any kind however we have selected below “highlights”.

It is clear that many employers are not aware of the implications of gathering and retaining personal information relating to their staff or clients. It is important that staff members are adequately trained to respond to Data Protection issues that may be raised by staff or clients, otherwise the employer may face compliance issues that could otherwise be avoided.

Account of proceedings between employer and Data Protection Commissioner in use of biometric systems

The report gives considerable comment to the use of biometric systems in the workplace. It refers to a data protection audit of a major retail outlet in which a biometric system had been operating for some time.

Staff members had not been given an opportunity to opt out of using this system and ere not supplied with information about the processing of personal data through the use of the system. An Enforcement Notice was served by the Data Protection Commissioner on the employer which it appealed to the Circuit Court.

Ultimately settlement was reached in which the employer agreed to put up a notice at all of its hand scanners as well as in its Employee Handbook and in its Contract of Employment setting out a range of data protection information. The employer gave an undertaking to the Court that if an employee objected to using the system they will be informed of an alternative process. The alternative system would be considered by the employer if a legitimate reason was put forward by the employee.

The employer accepted that this did not interfere with the Data Protection Commissioner's discretion to determine what might constitute a legitimate reason in any specific case. It was also confirmed to the Court that the Data Protection Commissioner would not regard a mere dislike of the system or desire not to use it as a legitimate reason which would give rise to an investigation on its part.

In the report the Commissioner expressed concern that some employers wished to use biometric time and attendance systems as an alternative to the employment of staff supervisors from nightshifts in particular. The employers appear to believe that because a staff member must run their hand or finger over a scanning devise when entering the workplace there is some certainty that staff are on site and will remain there. This has taken to remove the requirement to employ a supervisor. This argument in favour of the use of biometric systems is not credible.

Gross misuse of CCTV footage at a place of work

Case Study 8 in the report relates to a complaint of the alleged gross misuse of CCTV footage at a place of work. There was no signage in place at the place of work to inform the public of the presence of CCTV.

The complainant in this case visited the premises and purchased some items. The complainant then spent some time speaking with the staff member on duty. The member of staff received a letter from his employer which related to a number of work related performance issues and in particular referred to the fact that that the staff member had spent some time chatting with the complainant. This was the subject of the complaint by the customer to the Commissioner.

The employer at the time apologised to the complainant for the use of CCTV cameras in which he was identified without him having notice of the possibility of his being recorded while at the workplace. The Data Protection Commissioner has extensive guidance on its website on the use of CCTV in a business or the workplace.

Biometric systems in the workplace and how not to deal with an inspection from the Office of the Commissioner

Case Study 10 in the report relates to a complaint to the Commissioner from employees of a company called Boran Plastic Packaging Limited as to the use by management of CCTV on the factory floor for the purpose of monitoring staff and the use of biometric system for recording employee time and attendance.

The Commissioner carried out an unannounced inspection at the premises to establish the facts. The Commissioner comments on the obstructive approach of the factory manager to his dealings with the Commissioner's representatives. Such a level of discourtesy displayed towards the authorised officers in the performance of their functions that they considered issuing a caution against the factory manager with a view to formally charging him with an offence under Section 24 of the Data Protection Act, however, cooperation increased as the inspection continued.

It emerged that the CCTV images were accessed by a non-staff member who is a member of the owner's family and had access off site to real time CCTV views. It appeared that the company had no Data Protection policies in relation to the CCTV and biometric systems.

As a result of the Commissioner's engagement with the company, the company agreed that there would be no live monitoring of images captured on CCTV and recorded images would be viewed only following the rare occasions when a security breach, employment personal protection or health and safety incident occurs. The company also confirmed that access was now restricted to two members of staff who had onsite access only. The company's policy was amended to provide that should an employee have a legitimate privacy concern or any other concern in relation to the biometric hand scanner they could contact a member of staff in the HR Department about their concerns. If legitimate privacy concerns were expressed that employee had a right to opt out of the system.

Example of lawful use of CCTV in the workplace - guidance on the use of Covert Cameras

Case Study 11 of the Report relates to the lawful use of CCTV cameras by an employer. In this case the cameras were put in place as members of staff had complained that money had gone missing from their purses.

Garda Síochána had been involved in the decision to install the covert cameras. It is generally the Commissioner's view in relation to the installation of covert CCTV cameras, that recording mechanisms to obtain data without an individual's knowledge is generally unlawful. Covert CCTV for surveillance is normally only permitted on a case by case basis where the information is kept for the purposes of preventing, detecting or investigating offences or apprehending or prosecuting offenders. This provision automatically implies an actual involvement of An Garda Síochána or an intention to involve Garda Síochána. C covert surveillance must be focused on short duration and only specific (and relevant) individuals should be recorded. If no evidence is obtained within a reasonable period the surveillance should cease.

In this case the employer had met these thresholds.

Use of tracking devices on Company vehicles- Guidelines from the Commissioner

Case Study 13 of the report related to the use of tracking devices in vehicles. In this particular instance the employer had installed tracking devices in company cars and private cars used by their owners for business purposes connected to their employment.

The complainants alleged that they felt they were being tracked and monitored 24 hours per day, seven days per week as they had no means of switching off the tracking devices. The owner of the private car in question expressed concern that he felt his wife and children were being tracked when they were using the car outside of working hours.

The Data Protection Commissioner takes the view that the use of tracking systems in vehicles can give rise to Data Protection issues if they are not deployed in a manner that takes accounts of the legitimate privacy expectations of vehicle drivers, particularly when they are off duty. Monitoring or tracking, including vehicle monitoring must comply with the transparency requirement of the Data Protection Acts.

Staff must be informed of the existence of the tracking equipment and for the purposes for which their personal data is processed. In this case while privacy switches were fitted when tracking devices were installed drivers had not been shown how to use them. The Commissioner has said that any organisation deploying vehicle tracking devices should abide by the following rules: -

i.If a company vehicle is permitted to be driven for personal use outside of working hours a privacy switch must be fitted.

ii.The employer is responsible to ensure that drivers are given training on the operation of the privacy switch.

iii.The employer must inform the drivers of the purpose for which the personal information processed by the tracking device will be used and that personal information may not be used for any purpose other than the stated purpose.

iv.Employers should make available to drivers a policy on the use of tracking devices. This should also set out the employer's policy on the use of company vehicles for private use.

v.New employees should be made aware of the existence of tracking devices on company vehicles and should be trained on the operation of the privacy switch.

vi.There is no requirement to fit a privacy switch if a company vehicle is used exclusively for work related purposes.

The report emphasises that vehicle tracking devices are not staff tracking devices. Their key function is to track and monitor the location of the vehicles in which they are installed. Employers should not regard them as devices to track and monitor the behaviour or whereabouts of the drivers or other staff.

Seeking Employment Law Litigation Advice

For further information and advice regarding your legal rights and entitlements, please contact Malcomson Law by calling 01 8744422 or complete an Online Enquiry Form. Your enquiry will be forwarded to a Solicitor who specialises in Employment Law.

This news section contains stories of interest from publicly available news sources. Where we are representing the clients referred to in the news material we will say so. Where we do not represent individuals or bodies mentioned or quoted, the inclusion of the news story in our news section is not intended nor should it be taken to imply that we act for the individual or body concerned.