The Spanish Data Protection Agency (AEPD) concluded in a decision that punishing one employee on the basis of images captured with a mobile phone of another employee breaches data protection legislation. Companies must be extremely careful about how they obtain proof to take action against employees on disciplinary grounds.
In its decision, the AEPD addressed the case of a company that had suspended one of its employees without pay for 45 days, due to facts that it became aware of from images recorded by another worker. This other worker, “sick and tired of having to cover for the claimant” (the worker that received the punishment) “and his continuous absences from his work post”, decided to monitor his colleague daily, in order to record him with his mobile phone and subsequently hand over the recordings to the employer.
In this context, the AEPD considered that the use of these images by the company constitute data processing and therefore comes under the scope of that legislation, even though the images were not obtained through the company’s video surveillance system. According to the AEPD, the company used images captured on a similar system (an employee’s mobile) in order to control activities at the workplace.
As a result, the AEPD held that the company had processed data as controller, since it had received, stored and used the data to control a worker’s activities. Indeed, the AEPD concluded that the company, which owns the establishment at which the punished worker provides his services, used the recordings for disciplinary purposes, as the data controller, without informing the employee that his image was being captured for the purposes of workforce supervision or of the rights associated with such data collection. It therefore held that the company had breached article 18.4 of the Spanish Constitution (“the law will limit the use of information technologies in order to guarantee citizens’ right to honor, personal and family privacy and to exercise their rights in full”) and article 5.1.a) of the General Data Protection Regulation, which establishes that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”.
This decision stresses that companies must bear in mind that not anything goes when it comes to monitoring employees’ work activities and that steps that do not respect workers’ rights can thwart employers’ actions, regardless of whether or not they are justified. Specifically, as far as video surveillance is concerned – the AEPD considered that in this instance the use that had been made of the images was similar to video surveillance – there are a wide variety of cases, many of which have been addressed by the courts, as we can see here or here. For example, the decisions by the Labor Chamber of the Madrid High Court, of January 16, 2020 and September 28, 2018, confirmed that images captured by a company’s video surveillance system were inadmissible as evidence and, that therefore the dismissals carried out were unjustified because the employee had not been expressly informed of the existence of the system and informative signs had not been placed in the workplace telling employees that they were being recorded during working hours.
Garrigues Employment & Labor Law Department
