Spain: Surveillance Cameras vs Video Recordings in the Workplace

A waiter was sanctioned with suspension of work and salary for the commission of several infractions that were recorded in a video by his colleague. In that video, the waiter appears performing tasks not related to his job.

The sanctioned employee filed a claim to the Spanish Data Protection Authority (AEPD), in which he reported that the company had not informed him about the existence of video surveillance cameras. He also claimed that information about the surveillance cameras had not been posted (i.e. in the form of signs) anywhere in the workplace, or otherwise made available for information purposes.

The company pointed out that the recordings at issue were not obtained from the video surveillance cameras in the restaurant  bar, (which were installed, but not operating). In fact, the images were captured by an employee on his mobile phone, who claimed to have made the recordings because he was tired of having to take on tasks that the sanctioned employee was responsible for, but failed to do.

The AEPD states that, although the recorded video was not obtained through the video surveillance cameras, those images were obtained through a mobile phone, which is a similar system as video surveillance cameras. In any case, the purpose was the control of the work by the company. In this sense, the data protection regulation states that employees must be informed in advance that they are being recorded, and the purpose for which the recordings are made.

The company used those images to control the performance of the employee at work and therefore, the images must be considered ‘personal data’. As the company did not fulfill the data protection regulation and had not informed the employee about the existence of that type of control, article 5.1 of the GDPR (General Data Protection Regulation) was violated. The aforementioned article requires legality, loyalty and transparency in the processing of personal data.

For the reasons explained above, the AEPD sanctioned the company with a fine of 12.000 €.