A council that ordered covert surveillance on a sick employee has been told to review its approach after an Information Commissioner's Office (ICO) investigation.

The ICO found that Caerphilly Council breached the Data Protection Act when it ordered the surveillance of an employee suspected of fraudulently claiming to be sick.

The ICO investigation found that the surveillance was only authorised on anecdotal evidence and began only four weeks into the employee's sickness absence. No other measures were taken to discuss the employee's absence before the decision to use the covert surveillance, and the report, which was produced by a third-party company, was never used. The ICO determined that the council did not have sufficient grounds to undertake the surveillance, particularly at such an early stage of the employee's absence.

The ICO accepts that in exceptional circumstances, covert surveillance of employees can be justified. The employer, however, must be satisfied that there are grounds for suspecting criminal activity or equivalent malpractice and that notifying the individuals would prejudice prevention or detection of the issue. Covert surveillance should therefore be used as a last resort when alternative mechanisms that respect the employee’s privacy have been considered and determined as not appropriate.

The ICO's Employment Practices Code provides guidance on the key issues to consider for the monitoring of employees at work.