This post is also available in: Español
Employer’s obligation to inform employees is crucial for surveillance and control measures to be valid
We have just learned of several important rulings by the courts and the Spanish Data Protection Agency (the “AEPD”) regarding the legality of certain forms of control and surveillance in the workplace that use the employees’ personal data. As we will see below, they all have a common requirement: the employer’s duty to disclose information, to both employees and legal representatives, as the determining element to be able to restrict employees’ digital rights.
Legality of GPS-derived personal data
First, the Spanish Supreme Court’s judgment 766/2020, of September 15 (Appeal 528/2020) upheld the disciplinary dismissal of an employee who had used a company car out of working hours (when it was forbidden), based on the GPS data installed in the car. In this case, the court considered that the employee’s right to privacy and personal data protection were not affected because the company could prove that she had been expressly informed in advance of the installation, as required under Art. 90 of Spanish Act 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights (the “LOPDGDD”). The court also took into account the following circumstances: (i) the data obtained by the GPS referred to permanent location tracking of the vehicle, but did not reflect any of the employee’s personal circumstances; (ii) the employee was provided with the vehicle for professional purposes and only to be used within work hours; (iii) the employee expressly took responsibility for the state of the vehicle; and (iv) the GPS was installed to ensure the safety of the vehicle and for work coordination.
Cameras cannot be hidden in the workplace
In contrast, the High Court of Justice of Andalusia, in judgment 1146/2020, of June 1 (Appeal 4152/2018), confirmed the nullity of the dismissal of a security guard who was recorded asleep, barefoot and watching movies in his control room by the video surveillance system installed by the company, which concealed its location and existence. In this case, the court considered that the company infringed the employee’s right to privacy by not previously informing—either in person or with signs in the premises—about the cameras installed in the control center, and that these could be used for monitoring and penalties. Neither were there any warning signs that a camera was installed.
The legality of hidden cameras has caused a lot of legal conflict in recent times. For example, in its judgment of the case of López Ribalda (discussed here), of October 17, 2019, the European Court of Human Rights admitted into evidence the recording obtained from hidden cameras temporarily installed in the workplace in the presence of signs of serious misconduct.
Although the judgment does not specifically refer to the LOPDGDD because the facts took place before it entered into force, it should be remembered that Art. 89 allows the use of recordings obtained from video surveillance cameras installed in the workplace, provided that the company informs the employees—and their representatives if applicable—in advance about the specific measure in a clear and concise manner. The only exception to this rule is when cameras record an unlawful act that is committed flagrantly, in which case the mere installation of a warning sign is admitted.
Employees must also be informed of audio recordings in the workplace
Finally, the AEPD has just issued a decision in a sanctioning procedure against a company for recording employees’ conversations in the workplace without proof that they informed the employees and the employees’ legal representatives in advance. As part of an internal investigation—and using recorders hung around their necks—the company’s middle managers recorded personal conversations with the employees in their workplace, without the employees’ consent and without having satisfactorily informed the work council of the purpose and processing of the recordings.
The AEPD concludes that, although the company is entitled to use means of labor control, as in this case by using voice recorders (under Art. 89.3 LOPDGDD), it is also obliged to inform the employees about these measures expressly, clearly and concisely, which did not happen. Consequently, the AEPD requires the company to fulfill its duty to inform within one month.
Therefore, an important notice for companies: when you are adopting measures or thinking of using information (e.g., for disciplinary sanctions) that compromises the privacy or image of your employees, remember to confirm if you have met the requirement to inform employees in advance, according to the data protection regulations and case law. The cost of not doing so could be the nullity, not only of the evidence, but also of the business decision, as well as the corresponding AEPD fine.
Authors: Jennifer Bel and Jorge Monclús
This post is also available in: Español