Covert monitoring at work




The human right to respect for private and family life (Article 8, European Convention on Human Rights) is engaged whenever an employer conducts covert surveillance at work. Covert surveillance should only be used to investigate suspected serious misconduct, such as theft or fraud (McGowan v Scottish Water [2005] IRLR 167).




Article 8 is unlikely to be engaged if surveillance takes place in a public place where there is no reasonable expectation of privacy (City and County of Swansea v Gayle [2013] UKEAT/0501/12/RN). 


Covert surveillance is unlikely to infringe the human right to privacy if: 



• the employer can demonstrate a serious and legitimate purpose, usually the need to investigate suspected fraud or theft; 



• surveillance is time-limited, for example, just one week;





• surveillance is reactive, in other words, installed as a short-term response to legitimate suspicions of grave and serious misconduct such as suspected theft, as opposed to being permanently in situ waiting to catch people out;





• alternatives to covert surveillance have been considered;




• staff have been consulted in advance (through the union, where one is recognised); and





• staff have been clearly warned in advance that covert surveillance is a possibility, for example, with posters and written policies). 




The European Court of Human Rights (ECHR) has described covert video surveillance at work as a “considerable intrusion” into workers’ private life in this case: 



Part 3 of the ICO Employment Code of Practice contains guidance on covert surveillance at work. It says that covert monitoring can “rarely be justified” and must be authorised at the highest level. There must be reason to suspect criminal activity or equivalent malpractice which would be hard to prevent or detect if staff were warned in advance about the monitoring (Code, Para 3.4). The Code says that covert surveillance must not be used in places where people have a reasonable expectation of privacy such as changing rooms, toilets or rest rooms, save in exceptional circumstances.



Covert surveillance must also comply with the more stringent standards of the GDPR. In particular, employers must conduct a data protection impact assessment (also known as a privacy impact assessment) whenever data processing is “likely to result in a high risk to the rights and freedoms of natural persons” (Article 35(1), GDPR) and employers should consult data subjects or their representatives where appropriate. Records must be kept.