Everyone is generally aware that when they provide personal information on a job application form that this information will be kept confidentially, in a safe place, and disclosed to no third party, who does not have a reasonable and lawful basis for requesting specific and personal information about an individual without having objective justification.

However, whilst individuals may voluntarily declare information about themselves in a job application, which is a document, afforded the protection of the Data Protection Act, what issues arise regarding the use of images of an individual captured by way of Closed Circuit Television (CCTV).

Prior to the Data Protection Act 1998, which came into force on 1 March 2000, there was no statutory regulation on the use of CCTV in the workplace.  The Act places responsibilities on companies to process personal data (data relating to identifiable living individual), which it holds in a fair and proper way and the Information Commissioner has confirmed that CCTV images of an individual are deemed to be ‘data’.

There are both civil and criminal penalties for breaching the Act. The Information Commissioner has published a draft code on the use of personal data in the work place.  It is intended to help employers comply with the Act and establish good practice regarding the handling of personal data in the workplace.

The code applies to all aspects of monitoring employees in the workplace, including the use of CCTV.  While it is not legally enforceable, it contains the Information Commissioner’s recommendations on how the legal requirements of the Act can be complied with and may be cited in any enforcement action. The company would, therefore be strongly advised to follow the code. Under the code employers must:

Ensure that they have a specific purpose for introducing the CCTV before they put it into operation. This is important, as it will affect whether the monitoring, particularly if it is to be covert is permissible. Generally, all employees should be advised that CCTV will be in operation and the areas that are to be subject to monitoring. However, the Commissioner has confirmed that in exceptional circumstances, where to alert employee’s that CCTV is to be used  would prevent or prejudice the detection of  a crime, then covert surveillance may be used but only for as long as is ‘reasonably practicable’

As a general guide, the Commissioner has advised that if the issue is sufficiently serious that it would warrant the Police becoming involved, then this would generally justify the use of covert monitoring.

You should determine if and how the CCTV monitoring should be introduced by carrying out a detailed impact assessment.  This must take into account that the monitoring must be no more than is necessary and proportionate to achieve the business purpose. 

Accordingly, monitoring by CCTV in parts of the work place other than where the employer suspects that a criminal act is being committed will not be justified.

In most cases staff should be made aware that they are being monitored.  They should also know why the CCTV is being introduced. This is necessary where the monitoring is being introduced to prevent or detect criminal activity as it may tip off the person being monitored. 

The employer must also not use personal information collected through CCTV monitoring for purposes other than the prevention or detection of the criminal activity for which monitoring was introduced.  The only exception is when the information is such that no reasonable employer could ignore it because, for example, it reveals other criminal activity or gross misconduct.  Once the purpose for which the monitoring was introduced has been achieved the monitoring must cease.

Lastly, all CCTV footage should be securely locked away to comply with the Data Protection Act.  The company has legal duties and responsibilities regarding the collection and use of CCTV footage including a common law duty of confidence.  Any footage should only be used for the purposes for which it was introduced.

The Code of Practice: Monitoring at Work gives guidance on how to avoid employees calling in the lawyers over breaching the provisions of the DPA.  The Code provides that before such monitoring is introduced, an impact assessment must be carried out to determine what (if any) monitoring is justified by the benefits of that monitoring.  Under the DPA, any CCTV monitoring must normally be open and backed by fulfilling reasons.

The Information Commissioner’s Office published its first CCTV Data Protection Code of Practice in 2000 to help CCTV operators comply with the Data Protection Act 1998 and follow good practice.

A worker may ask his employer in writing not to process personal data or ask that he stop processing it, where it is causing, or is likely to cause, substantial unwarranted damage or substantial distress to the worker or anyone else.  The employer who has received such a request must respond within 21 days stating whether he is going to comply with the request or not.  If the employer believes that the request is unjustified then he must give the reasons.  A worker can also submit a subject access request to find out what personal or sensitive data is held about him and this would include any images captured on CCTV and held on disc or other electronic means.

Before installing any CCTV we would suggest that you contact the ICO so that they can assist you with a detailed impact assessment.