SHOULD A WORKER be disciplined when found doing something on CCTV, when his employer accessed that footage to look at a completely different, and far more serious, matter?

This very question came before the High Court in recent months – and in her ruling on the case, the judge conceded that it had raised a “discrete question”. 

In late February, the court ruled in favour of a man who claimed that CCTV was unlawfully used to discipline him for taking unauthorised breaks. This was after gardaí had advised the hospice he worked for to view cameras to help track down who wrote “Kill all whites – Isis is my life” on the wall of a staff room. 

Cormac Doolin took the case against the Data Protection Commissioner (DPC) in this specific case, after that body ruled that his rights under the Data Protection Acts were not breached when he was disciplined by Our Lady’s Hospice and Care Services in Harold’s Cross in Dublin.

In effect, his case was that it was unlawful for his employer to discipline him for taking unauthorised breaks using evidence gained from CCTV, when that CCTV footage was originally looked at in relation to an alleged criminal act (the graffiti).

Ms Justice Niamh Hyland, in a judgement delivered last month, found that the DPC had made an error in law on its assessment on data “processing” in regards to Doolin and set aside its conclusions.

Background

On 19 November 2015, Our Lady’s Hospice found a threatening graffiti message in a staff room on one of the buildings on campus which said “Kill all whites – Isis is my life”. 

The matter was reported to gardaí, who advised Our Lady’s in connection with a criminal investigation to review CCTV footage to see who had accessed the staff room on the period in question in November 2015.

It was through this access to CCTV footage that the employer also began an investigation into the use of the room for unauthorised breaks.

Doolin – who had nothing to do with the graffiti – was found by the investigation to have taken unauthorised breaks on three occasions around the same time the graffiti was written.

As part of the disciplinary procedure, training was recommended to be carried out with Doolin, access through electronic fobs to the staff area was taken away from him, and he was invited to a disciplinary hearing.

After this process, he made a complaint about how his data was processed to the DPC. 

The DPC summarised Doolin’s complaint as being that Our Lady’s Hospice “used the
CCTV footage for disciplinary proceedings related to unauthorised breaks”.

Ms Justice Hyland summarised: “[Our Lady's] stated that the investigation panel did not view the CCTV after interviewing staff members.

It further stated that the footage showed staff entering the room, that there was no work related reason for them to be there, that in interviews they were asked their reason for being in the room and some of them admitted to taking an unofficial additional break.

Disciplinary action was taken on the basis of that admission. Accordingly, OLHCS stated that the Appellant’s personal information was not processed by it by using CCTV as part of the disciplinary matter.

Doolin clarified to the DPC that he felt that it wasn’t the CCTV footage that was used to sanction him, but data retrieved, processed and used in an incorrect/unfair manner – from CCTV footage – that led to the “illegal sanction” against him. 

In other words, they’d looked at the CCTV for one reason (to find who did the graffiti) and were now using the CCTV in disciplining him for another reason (unauthorised breaks).

The DPC found that the hospice had a lawful basis under a “legitimate interest provision” for the very limited processing of his personal data which had taken place.

It found that while viewing of Doolin’s images had initially been carried out in connection with a security incident alone, it wasn’t considered that viewing the footage in relation disciplinary proceedings against him constituted “a different purpose”.

The DPC had decided that the hospice had not violated the Data Protection Acts in relation to him. So Doolin then initiated court proceedings against the DPC to try to appeal this decision.

At one hearing before the Circuit Civil Court, counsel for Doolin said that he admitted taking unauthorised breaks. However, he also insisted the hospice had used data arising from an inquiry “masquerading as a criminal investigation” to carry out a disciplinary investigation against Doolin with regard to unauthorised breaks. 

High Court ruling

In her ruling, Ms Justice Hyland rejected the DPC’s assessment that using the CCTV footage for the disciplinary action wasn’t a “different purpose” to using it to originally look at the graffiti incident.

She said: “It is indisputable that the information contained in the CCTV footage was used for the disciplinary proceedings, which use constituted a different purpose from the one for which the data was originally collected.

The fact that it was not downloaded for use [specifically for disciplinary proceedings] does not mean no further processing took place.

Data protection legislation requires that personal data must not be processed for purposes other than the purpose for which it had originally been collected.

“Accordingly, I conclude that as a matter of law, having regard to the definition of processing in the Act, and contrary to the conclusion reached by the DPC, the CCTV images were further processed,” Ms Justice Hyland said. 

She said that the DPC had made an error in law in holding that no further processing of data took place as this conclusion “was founded upon an incorrect interpretation of ‘processing’” under the law. 

Judge Hyland set aside the previous conclusions of the DPC in this matter but pointed out that it was within her power to set aside the previous judgement, but not prescribe what should happen next.

At a subsequent hearing last week, the parties agreed that the matter shouldn’t be referred back to the DPC with an order made that it had made an error of law in this matter. 

Comments are closed for legal reasons