Video surveillance in the workplace – What is permitted?

Video surveillance in the workplace are like Cameras in the workplace are generally a very sensitive issue, and not just from a data protection perspective. Do cameras in the workplace mean total surveillance, or do they represent a commitment to security? Video surveillance in a company highlights the tension between security and employer interests on one side, and the personal rights of employees and legal data protection requirements on the other.

We provide an overview of the legal requirements and explain why camera surveillance in the workplace is problematic under data protection law.

Video surveillance: Rights of employees and employers

The topic of video surveillance in the workplace is closely linked to various rights, both for employers and employees:

• In principle, every individual has the protected right to their own image and can therefore decide for themselves how it is used.
• Furthermore, camera surveillance regularly constitutes an infringement of the general right of personality of the individuals concerned (Art. 2 (1) in conjunction with Art. 1 (1) of the Basic Law).
• Video surveillance in general involves the processing of personal data, which, according to the GDPR, is generally subject to a prohibition with a reservation of permission. This means that recording and further processing of filmed material is only permitted if there is a legal basis for it in accordance with Art. 6 (1) GDPR.
• If employees are to be filmed permanently (e.g., at a bar or counter), their written consent could be considered in accordance with Art. 6 (1) (a) GDPR. However, the problem here is that consent must be given voluntarily and can be revoked at any time with effect for the future. This means, on the one hand, that individual employees could not be filmed, or could no longer be filmed, if they do not give their consent or subsequently revoke it. On the other hand, the validity of consent will generally fail due to the lack of voluntariness caused by the dependency relationship between employees and employers. Consent is therefore generally not recommended as a way to make video surveillance of employees permissible.  
• Instead, the legal basis of legitimate interest must be assessed in accordance with Art. 6 (1) (f) GDPR. If video surveillance is based on a legitimate interest, for example, due to an increase in burglaries or thefts at the company, a balancing of interests must be performed: The conflict arises here in weighing the interests and rights of those responsible for the video recordings (in a company, the employers) such as their property rights under Art. 14 of the Basic Law and the freedom to practice a profession under Art. 12 of the Basic Law on the one hand, against the interests, fundamental rights, and freedoms of the data subjects (in a company, the affected employees) on the other.
  A permanent video surveillance of employees at their workstations cannot be justified by a legitimate interest of the employer, except in possible isolated cases. The interests, fundamental rights, and freedoms of the employees generally outweigh those of the employer in this context. However, video surveillance of, for example, entrance areas for the purpose of preventing theft and burglary may be in the legitimate interest of the controller, provided they ensure that neither public areas are filmed nor employees are monitored on a permanent basis.

On the safe side legally

Especially in everyday situations, it is not always easy to correctly apply legal data protection provisions. In addition to technical knowledge, this often requires specialized expertise. We are happy to support you in optimizing your internal data protection for the long term.

What circumstances can justify camera surveillance in the workplace?

There is no question that safety in the workplace must be guaranteed. However, the same applies to maintaining the relationship of trust between employers and employees, for example, when it comes to extended breaks or the theft of company property. It is the employer's right to be informed about events within their company – but this does not mean they are permitted to install cameras for this purpose.

Before employers decide on camera surveillance in the workplace, a comprehensive balancing of interestsis required: If employees overstay their break by a few minutes, this will usually not be sufficient to justify such drastic measures as video surveillance in the company. Stolen internal documents, on the other hand, are a significantly more serious motive.

However, the balancing of interests alone is not enough. Planned video surveillance must also be necessary, appropriate, and proportionate to achieve the intended purpose. In plain language: Only when the purpose of the surveillance cannot be achieved by a less intrusive means does the law allow employers to implement video surveillance in the workplace – and even then, only for a limited period and in a limited area.

Furthermore, if a company has a works council, it must be involved in such a far-reaching decision. The works council has additional co-determination rights here, for example regarding the type of camera, the purpose of the surveillance, and the duration of data storage. It is important to define and record the purpose of the surveillance in advance in accordance with the GDPR so that this documentation can be presented in the event of an inspection by the supervisory authorities .
Temporary covert video surveillance is only permitted in exceptional cases and within strictly defined legal boundaries, such as when there are concrete and substantiated suspicions against specific individuals. Conversely, permanent covert video surveillance in the workplace without a specific reason is not permissible under German law.  

In general, the following applies: The workforce must be informed transparently about whether, where, why, and at what times video surveillance is taking place.

Legal regulations and further employer obligations regarding cameras in the workplace

On March 27, 2019, the Federal Administrative Court declared the rules that had been in effect until then (Section 4 (1) of the German Federal Data Protection Act (BDSG) in its new version) regarding specific requirements for video surveillance in the workplace to be in violation of European law. Now, the admissibility of video surveillance is governed solely by the general rules for data processing (pursuant to Art. 6 (1) GDPR). In addition, for any video surveillance:

• As the data controllers, employers must fulfill their information obligations (Art. 13 GDPR and Art. 14 GDPR) and transparently inform all persons who might enter the monitored area, such as visitors or customers, about the video surveillance and provide their contact details. These contact details allow individuals affected by the video surveillance, including affected employees, to contact the controller.
• Social areas such as changing rooms, washrooms, sleeping quarters, toilets, and showers, on the other hand, are strictly off-limits without exception for video recording.
  

Handling data obtained from video surveillance

Video surveillance data must be deleted without delay if it is no longer necessary for the purposes for which it was collected (Art. 5 (1) (e) GDPR) or if the protected interests of the data subjects preclude further storage. Whether it is necessary to secure the material can generally be determined within one to two days. Taking into account the data protection principles of "data minimization" and "storage limitation," recordings should therefore generally be deleted after 48 hours, unless there are reasons that justify longer storage of the data.

Overall, video surveillance in the workplace is a very sensitive issue, not only from a data protection perspective. If surveillance is carried out without observing data protection requirements, employers face the risk of high fines in the event of an inspection by the supervisory authority – not to mention the loss of employee trust.

What do you need to know about video surveillance in advance? How can such a measure be prepared from a data protection perspective? You can find everything you need to know on the subject in our GDPR Video Surveillance Checklist.