On Oct. 17, Israel's data protection authority, which recently changed its name to the Privacy Protection Authority (formerly the ILITA), published guidelines on the use of surveillance cameras in the workplace and in the framework of an employment relationship. The new guidelines constitute supplementary materials to previous guidelines on the more general issue of privacy consideration in the use of surveillance cameras.
In the new guidelines, the DPA expresses the position that in the context of employer-employee relations, the importance of privacy considerations is amplified, and stricter privacy protection measures should be implemented. In the modern workplace, where the employee spends a considerable amount of time, the implications of using surveillance means by the employer are greatly intensified. These include the continuous supervision of the employee, constantly being under scrutiny, and in case the video outputs are recorded, the ability to go back and review past behavior. In addition, such data is susceptible to big data analysis and cross-referencing, and by and large, enables clear identification of the data subjects surveilled.
The underlying assumption of the guidelines, as supported by case law, is that the employee possesses a right to a private space which follows them in the workplace, regardless of the employer's property rights in the workplace and in the equipment and networks therein. An additional underlying assumption is that the employer is obligated to determine and specify an explicit and detailed policy regarding employees' use of IT in the workplace and provide employees with proper notification regarding the policy, as well as consider alternative, less invasive measures to accomplish the purpose of surveillance.
The guidelines state that the employer's prerogative to use surveillance means in the workplace is subject to doctrines of reasonableness, proportionality, good faith and fairness. These principles apply also to businesses required by law enforcement to place surveillance cameras on their premises. The guidelines specify the manner in which these principles should be implemented, derivative requirements and possible implications, as further detailed below.
Legitimacy
An employer may collect personal data regarding their employees only for specific and legitimate purposes, necessary for the workplace and in line with the business' objectives, or as required by law or a competent authority. Such legitimate purposes may include for example, protection of the safety of persons on the business' premises, protection of property, protection of sensitive personal data and systems containing it, and supervising employee discipline and quality of service.
Transparency
An employer must formulate and publicize a clear and explicit privacy policy, and update such policy periodically. The guidelines include a new stipulation according to which the employer should, if feasible, consult with the employees (or their representatives) and take their views into account when formulating the privacy policy.
The guidelines state that concealing the existence or location of surveillance cameras from employees does not meet the reasonableness requirement, and is prohibited, except under rare and extreme circumstances. Further, it is stipulated that obtaining the employees' consent to concealed surveillance does not enable such surveillance, as consent provided by employees to their employer is not regarded as "free consent."
The principles underlying the employee's rights to privacy in the workplace further infer that the employer may only use the data obtained through surveillance for the same purpose for which it was collected. For example, footage from surveillance cameras intended for security reasons may not be used to check employee attendance or output.
Proportionality – location of the cameras
The proportionality of using surveillance cameras shall be determined by the employee's reasonable expectation of privacy, and the differentiation between private and public spaces:
- Private places: Places such as bathrooms, dressing rooms and personal workstations or offices, as well as shared offices and workstations, constitute private locations, which should be susceptible to surveillance only under extraordinary circumstances. However, in locations where work which is not ordinary office work (such as using phones or computers) takes place, for example manufacturing lines, vaults, etc., it may be reasonable to place cameras for legitimate purposes such as safety of persons or property.
- Resting places: Kitchens, lounges and other resting places used by employees for breaks should not be surveilled, and employees have a heightened expectation of privacy regarding such places.
- Public places: Hallways, lobbies and spaces open to customers or the general public, constitute public places, and should not be regarded as places where employees have an expectation of privacy.
The above constitutes supplementary guidelines to the DPA's general guidelines on using surveillance cameras in public places.
photo credit: Office Politics: A Rise to the Top via photopin (license)