CCTV in the workplace under the Polish law
Until recently, the matter of video surveillance in the workplace has not been explicitly regulated by Polish law. However, the new changes to the employment law dated May 10, 2018, address the issue of the use of video surveillance in the workplace. Pursuant to the recently adopted law, the employer is allowed to install video surveillance in case such CCTV is necessary to:
- Ensure the safety of the employees.
- Protect property.
- Control the process of production.
- Protect the trade secrets, which disclosure might cause damage to the employer.
It shall be noted that the above list does not include the purposes of exercising control over the working time and off-duty activities performed by the employees during the working hours.
Video surveillance may be introduced in the workplace area as well as at its surroundings; however, to lawfully install it in sanitary rooms, cloakrooms, canteens, smoking rooms or premises made available to trade union organizations, the employer shall ensure that such monitoring is necessary for the mentioned purposes and that it does not violate either the dignity and other personal rights of the employee or the principles of freedom and independence of trade unions; the employer may achieve this in particular through the use of techniques preventing recognition of persons staying in such rooms.
As the aim of the Polish legislator was to ensure compliance of CCTV monitoring with the EU General Data Protection Regulation, including the principles of purpose and storage limitation, the registered image recordings shall be processed by the employer solely for the purposes for which they were collected and stored for a period not exceeding three months. However, the new regulation provides for an exception — in case the image recording is evidence in legal proceedings or the employer has been informed that it may be evidence in such proceedings, the aforementioned time limit is extended until the final disposal of those proceedings. After the expiry of the relevant periods, the employer is obliged to destroy registered image recordings containing personal data.
The GDPR places a strong emphasis on ensuring that the data subjects would be duly informed of the fact that their data are being processed, as well as of the scope, legal basis and purposes of such processing. Taking into account the context of employment, as well as the binding Polish employment law regulations, the Polish legislature obliged the employer to regulate in collective agreements with trade unions or in the internal workplace policies the purposes, scope and the way of use of the CCTV surveillance. If there is no collective agreement or the employer, pursuant to the labour law provisions, is not obliged to set workplace regulations — the above should be described in a notice addressed to the employees. This information shall be provided in writing to each employee before the employee starts to exercise work duties. In each case, however, informing the employees on the actual introduction of the video surveillance is required within two weeks before launch of CCTV. The employer is also obliged to indicate the monitored rooms and areas in a clear and visible manner, through the use of appropriate signs or acoustic signals — no later than one day before the launch of the video surveillance.
The Polish legislature states expressly that the aforementioned obligations are without prejudice to the obligations deriving from Article 12 and 13 of the GDPR — regarding, among others, the principle of transparent communication with the data subjects and the obligation to provide them with a determined set of information while the data is being collected.
Email monitoring under the Polish law
The changes to the employment law regulate also the issue of email correspondence surveillance conducted by the employers. Unlike video surveillance, email surveillance may be introduced when it is necessary "to ensure the workflow enables full use of the working hours and proper use of work tools handed to the employee." As a result, the employer is allowed to use this type of surveillance to exercise control over the working time and the potential off-duty activities performed by the employees in the workplace. However, the email surveillance cannot infringe the privacy of correspondence and the personal rights of the employees, which may be difficult in practice for the employers.
Apart from the differences regarding the permitted purposes, the employer's information obligations in relation to such monitoring correspond with the obligations imposed on the employer in case of video surveillance. The employment law provisions provide also for a possibility to introduce other types of surveillance, for the same purposes as in the case of email surveillance; in such case the introduced monitoring would be subject to the same rules.
The recent introduction of the provisions regarding surveillance conducted in the workplace should be perceived as favorable, as the lack of comprehensive regulations had been causing considerable uncertainty among the employers — in particular regarding the lawfulness of such processing and the proper retention period (such period, though, for the moment has been established with the respect to video surveillance only). The Polish employers when introducing video or email surveillance, however, shall be aware of the necessity to bear in mind not only the GDPR provisions, but also other obligations imposed on them by Polish law — including labor law and civil law, in the context of personal rights and privacy of correspondence.
photo credit: Polish flag via photopin(license)