The use of (covert) cameras in the workplace: a nuance?

Introduction

After first explaining the procedure, the case will be outlined, after which the two ECHR rulings known as Lopez Ribalda v. Spain will be discussed. It will then indicate what is new based on the latest ruling, what criticisms can be made of it, and ultimately what the meaning will be for our Dutch law.

Room and Great Room

The ECtHR is divided into several Chambers. A Chamber rules with a total of seven judges. In exceptional cases, namely in the event of a serious question concerning the interpretation or application of the ECHR or in the event of a "serious question of public interest," any party involved in the case may request the Chamber to refer the case to the Grand Chamber (art. 43 ECHR). At the Grand Chamber, seventeen judges rule on the case. In this case, Spain requested that the case be referred to the Grand Chamber. This referral was accepted by the Grand Chamber.

The Chamber ruled in the Lopez Ribalda case that there was a violation of Article 8 ECHR. The Grand Chamber now rules that there was no violation of Article 8 ECHR. Neither the Chamber nor the Grand Chamber was unanimous in its judgment on all points. What is special about the publications of ECtHR rulings is that the dissenting opinion of the named judges is also published.(2)

The case study

A branch manager of a Spanish supermarket notices irregularities between the supermarket's stock level and what is sold daily. The amounts involved are significant. He suspects thefts. To find out exactly what is happening, he decides to install both visible and invisible cameras. The visible cameras are hung at the entrance and exit of the supermarket. The staff is informed about this. The hidden cameras are pointed at the cash registers for the purpose of monitoring the staff. About the deployment of the hidden cameras the manager does not inform his staff.

After about ten days, the hidden-camera footage shows that about five employees helped customers and colleagues commit thefts. Also, these employees themselves took products unpaid. As a result, the five employees are fired. The workers challenge their dismissal in the national courts, which rule on dismissal. They claim that the employer infringed on their privacy as enshrined in Article 8 ECHR. Both at first instance and on appeal, the camera footage is accepted as evidence and the courts rule that the invasion of privacy is justified. The creation of the secret camera footage is necessary to achieve the goal of catching the employees with irregularities. The measure is not disproportionate and there is no other less intrusive measure to achieve the goal, the Spanish judges said.

The opinion of the Chamber of the ECHR

The ECtHR finds that the Spanish national courts did not strike a "fair balance" between the fundamental right of Article 8 ECHR to respect for private life and the employer's property interest.

First, the camera use was not proportional. All employees were filmed for weeks during full working hours. Second, as required by Spanish law, the employer did not fulfill its obligation to inform the workers explicitly, precisely and unambiguously about the taking of the camera footage. At a minimum, the employees should have been given general information about the covert camera surveillance and about their rights under applicable privacy laws. The ECtHR ruled that there was a violation of Article 8 ECHR. The employees are entitled to damages from the Spanish government in the amount of €4,000 per person because of the breach of their privacy.

Spain disagrees with the Chamber's ruling and requests that the matter be referred to the Grand Chamber. The latter agrees with the referral and revisits the case entirely.

The judgment of the Grand Chamber of the ECHR

The Grand Chamber first formulates six guiding principles that should apply to measures to move to covert video surveillance:

• depending on the specific factual circumstances of each case, the notification must be clear about the nature of the control and precede the commissioning(duty to inform);

• the scope of surveillance must be limited in time, space and number of people who have access to the images(proportionality);

• the employer must have a legitimate purpose, with stronger monitoring calling for stronger justification(purpose);

• if there is a less intrusive remedy, it should be used(subsidiarity),

• consequences must be considered, with the use of the images consistent with the purpose(consequences/targeting);

• appropriate safeguards should be taken according to the degree of monitoring, such as informing the workers, staff representation or an independent body or the possibility of filing a complaint (safeguard/information).

Next, the ECtHR applies these criteria to the case of Lopez Ribalda. The starting point is whether the Spanish courts struck a fair balance between protecting the privacy rights of employees on the one hand and protecting the employer's property rights on the other.

The ECtHR considered as follows:

• the Spanish courts first determined that there was a legitimate purpose, namely, to take action against suspected thefts, which resulted in significant losses being recorded(purpose).

• the scope of the monitoring was limited as it concerned cameras covering the checkout area, the duration was no longer than necessary to confirm the suspicions of theft, although indeed there was camera surveillance throughout the day. To this, the ECHR adds, the tasks at the checkout are performed in a place that was open to the public. That affects the level of expectation of privacy protection. That expectation is high in closed work areas and markedly lower in places visible or accessible to colleagues or the public. The ten-day duration of monitoring is also not excessive. The images were also not viewed by more persons than strictly necessary(proportionality).

• the images were also not used for any purpose other than tracing those responsible(target bonding/consequences).

• further, the Spanish courts had also determined that there was no other way to achieve the objective pursued(subsidiarity).

• admittedly, the courts did not take into account the prior information required by Spanish law, even if in general terms, but that is only one of the criteria for determining whether the national courts struck a proper balance between the interests of the employer and the employee. Prior information can be passed only if there is a very good reason for doing so. That reason is present in this case because it involves serious staff misconduct. In this case, the smooth functioning of a company was jeopardized not just by employee misconduct but by the suspicion of a coordinated action by several employees, creating an atmosphere of mistrust in the workplace. Thereby, national law provided the legal remedy to complain to the Spanish authority about the employer's failure to provide prior information. Having failed to do so, the workers lose the opportunity to complain about this to the ECHR (guarantee/information).

Given all these circumstances, the ECtHR said, there is no violation of Article 8 ECHR.

What's New

First, the ECHR formulates six rules that secret camera surveillance in the workplace must meet. The test criteria are not surprising. They include purpose, purpose limitation, proportionality, subsidiarity and information. But there is some nuance to the interpretation of the criteria. For example, the ECHR makes a difference between closed workplaces and open workplaces. In open spaces, where the public can come or where several colleagues can come, the employee can expect less privacy. For the employer, that means less strict attention to proportionality. So then some more and longer filming is allowed, according to the ECHR. About providing information, it says that the information must be provided in advance and must be clear. On the other hand, it is said that the criterion of prior information is only one of the criteria for determining "a fair balance" between the rights of privacy and property protection. While precisely the prior knowledge is important for foreseeability, knowability and the prevention of possible arbitrariness, which is after all a criterion from Article 8(2) ECHR.

For an invasion of privacy to be lawful, Article 8(2) ECHR requires, among other things, that the criterion of 'foreseen by law' be met. The breach must be foreseen by law. If the infringement is done by a government body (in vertical relationships), this criterion is strictly interpreted. In horizontal relationships between private parties, because it is about 'a fair balance' between the rights of parties, this criterion is interpreted less strictly. For example, in labor law, established case law suffices as an interpretation of the word 'law.'(4) Art. 7:611 of the Civil Code on good employer and employee citizenship forms the basis. As long as it is knowable and foreseeable, so that at least as much arbitrariness as possible is avoided. In the Chamber's ruling in the Lopez Ribalda case, it was sufficient if prior information had been given in general terms. Then the knowability and foreseeability criterion had been met. But there is other ECtHR jurisprudence that prior information must nevertheless include information to the employee about the nature and extent of the control to be carried out. This was decided in the Barbulescu case.(5) The ECtHR does not seem to hold the line of the Barbulescu case.(6)

Perhaps this "lesser severity" about the guarantee to inform prior, even if in general terms, was also motivated by the seriousness of the wrongdoing, which the employer wanted to counter. The case involved five employees committing organized thefts. The question, however, is whether the ECHR is not overly guided here by the final outcome of the camera footage. Prior to the installation of the cameras, although there were significant stock discrepancies, it was not clear or foreseeable at the time that thefts were so organized. Is there a so-called "outcome-bias" here? The test moment must remain the moment the cameras are placed. The guarantee to inform in advance, even if it is in general terms, cannot be tested less rigorously because it turns out afterwards that it is a 'serious misconduct'.

In the Spanish case of Lopez Ribalda (but also in the Barbulescu case mentioned earlier), there was a provision in national law labor law that prior notice had to be given. In our Dutch law we have no such regulation. Our legislator did not use when introducing the AVG to formulate separate rules for labor law (see Art. 88 AVG). Nevertheless, it could also be concluded in our law that the employer must inform prior to the installation of secret cameras. This can also be done by making policy on possible checks to be carried out. First, Art. 12 of the AVG offers a possibility to do so. The recording of camera images also means that personal data are processed automatically. The AVG applies in addition to art. 8 ECHR. Art. 12 AVG indicates that the controller, the employer in this case, must be transparent and provide information about the processing. The AVG also gives the obligation to conduct a data protection impact assessment (DPIA) prior to implementing any high-risk processing of personal data. Upon which even a prior consultation of the Personal Data Authority (AP) may follow (Art.36 AVG). Art. 139f of the Criminal Code indicates that in case there is no prior warning, making secret camera images may even be punishable. And if the employer is obliged to set up a Works Council, the employer will have to seek the consent of this Works Council prior to the proposed decision to make secret camera images (art. 27 subsections 1 under k and l WOR).

In short: reasons to assume that prior information is necessary under Dutch law as well. Incidentally, the AP also indicates on its site that an employer must inform an employee in advance that in some situations the installation of hidden cameras may be possible. Such information can then be contained in a personnel or camera surveillance regulation.

One final comment concerns the use of the national courts. Lopez Ribalda had gone through all the labor law procedures in her home country. After that, she could turn to the ECtHR. However, that proved insufficient, according to the ECtHR. For about the violation of the prior obligation to provide information, perhaps the criminal court or the Spanish privacy regulator could also have been called in through a complaint. Now that this has not happened, this is all the more reason for the ECtHR to test less strictly the criterion of providing the prior information. Apparently, if you have not engaged all possible, different national bodies, you forfeit the right to successfully complain to the ECtHR about the failure to provide the prior information. Does that now also mean that in every labor dispute in the Netherlands about hidden cameras a complaint must also be filed with the AP? Or that Article 139f of the Criminal Code must be invoked? For the legal counsel acting on behalf of the employee, my advice would certainly be to do so.

Worth reading

"We respectfully disagree...," begins the text of the "dissenting opinions" of 3 of the 17 judges who disagree with the decision of the Grand Chamber. As mentioned above, at the ECtHR the dissenting opinions of judges are also published. And the text of the dissenting judges' opinions is "sharp" and worth reading. The judges begin by referring to the growth of the influence of modern technology in our daily lives. That development requires additional protection of our private lives. Already in the Köpke judgment, from the year 2010, it was considered that it is important to look at the current state of technology ("...at the relevant time..."). The invasion of privacy can be great with camera images. At any time, at any place, a large number of people within the employer's organization can view images. Thus these three judges. Therefore, the safeguards provided must be strictly applied. If, as in Spanish law, in order to prevent arbitrariness, one important guarantee is given, namely prior information, even if in general terms, then that guarantee must be considered decisive. Especially when it comes to labor law, because the employer has opportunities to abuse its control capabilities. As an employee, you also cannot evade the fact that images are made. After all, as an employee, you are obliged to perform the work at that location.

This means, according to these judges, that "prior notice" should be seen as a decisive criterion, even if the trade-offs are to achieve "a fair balance" between fundamental rights. The Spanish courts should have examined more closely whether the workers had been given prior notice, and if not, those Spanish courts should have sanctioned it. Now that this did not happen, the ECtHR should have concluded that there was a violation of Article 8 ECHR, according to these judges. This is all the more true now that it concerns surveillance of a covert nature. That is precisely when extra safeguards should apply, and you cannot turn a blind eye to one of them. A reasonable suspicion of theft in no way justifies this.

In addition, the judges find that the Spanish courts did not sufficiently investigate other, lesser privacy-restricting measures (subsidiarity). The purpose limitation was also violated. The employer had two goals, namely to stop the thefts and to identify who did it. But in this case, the images were also used for dismissal. The first goal could have been achieved by warning that cameras would be placed at the cash registers. For the second purpose, one might question whether clearing up a theft belongs to the realm of private individuals. These judges feel that the ECHR's approach invites private individuals to take legal matters, such as the detection of crimes like theft, into their own hands. That can never be the intention of the ECtHR.

Finally, this ruling would not be in line with previous ECtHR jurisprudence. In the Köpke judgment, secret footage was deemed admissible because it involved a limited number of people being followed (two people), with a limited prior duration (14 days) and no all-day filming. In this case, all staff near the cash registers were filmed throughout the day. The duration prior was not limited. These differences were not given sufficient weight in the Lopez Ribalda ruling. It also does not follow the strict requirements as formulated in the Barbulescu and Vukota-Bojic rulings.(7) In the Barbulescu case, the ECtHR found that in the event the employer monitors (in this case, mail behavior), the employer must be clear and open about it. This means that it must formulate policies stating why and for what purpose monitoring is carried out. Also, the manner in which should be indicated. In Vukota-Bojic, the ECtHR found that legislation to allow secret video surveillance of a social security authority must provide clarity on how the data may be obtained and stored, protection against access to the data by third parties, rules on the duration of the surveillance, the reasons why such surveillance may be instituted, and a possibility of proper judicial review. If the legislation does not comply with these, then the member state is not doing enough to protect the privacy of its citizens. Along the lines of those strict conditions on the obligation to provide information, the ECtHR does not hold here, because it ignores precisely that strict obligation to provide information.

The proof

The question was also raised as to whether, in the event of unlawfully obtained evidence from the secret camera surveillance, this evidence could still play a role in the dismissal procedure. The Chamber had already indicated that art. 6 ECHR is about the fairness of the trial and not about how evidence should be evaluated. That evaluation of evidence is up to the member states. In the Netherlands this is stated in art. 152 Rv: the evaluation of the evidence is up to the judge. However, there is a violation of art. 6 ECHR if the person concerned could not dispute the authenticity of the evidence and could not object to its use, or the evidence is of insufficient quality (reliable and accurate) and if the material was not supported by other evidence (in the Lopez Ribalda case there were also witness statements and questionable receipts). With regard to reliability and accuracy, the Grand Chamber adds that the circumstances under which the evidence was obtained are also important. Remarkably, the Grand Chamber still formulates that if the illegal evidence is the only evidence, but is strong and reliable, then the need for corroborating evidence is less. Here again, but in this case unanimously, the Grand Chamber seems to nuance the position of the person involved, read employee, to the detriment of that person given the Chamber's earlier ruling.

It follows from a ruling by our Supreme Court that in civil law, illegally obtained evidence should only be set aside in special circumstances.(8) The criteria under Art. 6 ECHR of the ECHR may then apply as special circumstances.

In conclusion

Based on a report by the AP on camera surveillance and an opinion by the former Art. 29 Working Group, now European Data Protection Board (EDPB), and based on the case law of the ECHR, you, as an employer, had to meet the following conditions when performing covert camera surveillance:(9)

• There must be a legitimate interest (Art. 6(1)(f) AVG),

• Camera surveillance must be necessary (Art. 8(2) ECHR),

• Camera surveillance must not be disproportionate or disproportionate (Art. 8(2) AVG and Art. 6(1)(f) AVG),

• The policy must be knowable and foreseeable and not lead to arbitrariness (Art. 8(2) ECHR, Art. 12-14 AVG, Art. 139f Sr)),

• The policy should also be clear (as to the nature, scope, extent and manner of monitoring), specific and unambiguous (case law (10), art. 12-14 AVG),

• Employees must be informed about the use afterwards (after the purpose of "stealth" has expired, the obligation to inform revives, Art. 12-14 AVG),

• A DPIA must be held upon implementation and sometimes prior consultation with the AP is required (Art. 35-36 AVG),

• Pursuant to Article 27 (1) (k) or (l) of the WOR, the entrepreneur/employer must ask the Works Council for consent when making a proposed decision.

Following the decision of the Grand Chamber, one can add that in public places there is less likely to be disproportionality of covert camera surveillance due to a reduced expectation of privacy in these spaces. Advance notice also has nuances, according to the ECtHR. After all, according to the ECtHR, it is only one of the aspects to be considered and not a decisive one. It is certainly advisable as legal counsel, assisting the employee, to always also file a complaint with the AP if prior information from the employer is lacking. Perhaps even to file a report under art. 139f Sr. Should you act as legal counsel for that employee and be involved in a "robust" lawsuit, even the dissenting opinion of the three judges at the Grand Chamber's ruling provides enough clues to still try to make the case for the employee that there is a violation of art. 8 ECHR.

For now, there seems to be plenty of room for maneuver in the Grand Chamber's list of criteria for assessing the permissibility of covert camera surveillance.

Footnotes

1. ECHR 9 January 2018, Nos. 1874/13 and 8567/13 and ECHR 17 October 2019, Nos. 1874/13 and 8567/13, Lopez Ribalda and Others v. Spain.
2. See footnote 1.
3. See note J.P.E. Lousberg under ECHR 9 January 2018, No. 1874/13, Personal Data Protection Jurisprudence, 2018/25.
4 Köpke case, ECHR 5 October 2010, No. 420/07, Köpke t. Germany.
5. Barbulescu Case, ECHR 12 January 2016, 61496/08, Barbulescu v. Romania,JAR 2016/43, with note C.M. Jakimowicz.
6. See also Vukota-Bojic case, ECHR 18 October 2016, AR Updates, AR 2017-0173, Vukota-Bojic t. Switzerland, with note F.G. Laagland. The Vukota-Bojic case is between a body implementing social security legislation in Switzerland versus Ms. Vukota-Bojic. There, the strict disclosure requirement is applied mainly in vertical relationships.
7. See footnote 6.
8. HR July 11, 2014, ECLI:HR:2014:1632.
9. See Report on Camera Surveillance, Policy Rules on the Application of Provisions of the Personal Data Protection Act, January 28, 2016, Personal Data Authority. See also Opinion 4/2004 processing of Personal Data by means of Video surveillance, 11750/02/EN WP89, Art. 29 Working Party, dated February 11, 2004).
10. See notes 5 and 6.

This article can also be found in the Privacy in the Workplace file