CCTV cameras have long been celebrated for being able to deter criminals and provide crucial evidence in legal disputes. It’s not just these obvious benefits that they can provide. Research shows that having CCTV in the workplace can increase profitability and productivity for businesses, making surveillance paramount for organisations. However, many are unsure about the laws relating to CCTV in the workplace, and how they can install CCTV cameras whilst protecting the privacy and data of their staff.



Why would a business want to monitor their workplace?

Businesses may want to monitor their workplaces for a number of reasons. These include:

  • Keeping employees safe – CCTV can keep staff safe by helping to prevent theft, violence, and other crimes.
  • Protecting business interests – CCTV surveillance may achieve this in a variety of ways, such as through preventing stealing, malingering, and vandalism. It can also be used to assess and improve the business generally. For example, CCTV footage may show that employees are struggling to complete certain tasks, or that there is overcrowding in areas of the building. This enables management to flag up such issues and resolve them.
  • Training staff – CCTV can also be effective in training staff, with video clips being used to show employees how to and how not to undertake certain tasks. It could also be used to monitor staff that are being trained up to ensure they are completing tasks correctly.
  • Upholding health and safety rules – Monitoring a workplace can ensure that health and safety rules are complied with and provide evidence in the event of any breaches.


Is it illegal to watch staff on CCTV?

Employers are free to install and use CCTV cameras in the workplace as long as they respect the legal rights and protections that their employees enjoy. These include:

  • Human Rights Act 1998 (HRA) – Employees have the right to privacy under the HRA, and intrusive and disproportionate CCTV monitoring may breach this right. Breaches to this right could manifest as filming in areas where individuals would expect privacy, such as in toilets or break areas.
  • General Data Protection Regulation (GDPR) – Employees have strong protection of their individual data under the GDPR. Any infringements can lead to severe sanctions for employers — in some cases they can receive a fine of up to 4% of their global annual turnover for the previous year, or €20m. For other breaches, like failing to comply with security obligations, the fine can be up to €10m or 2% of global annual turnover. Employees have the right to make subject access requests (SARs) for disclosure of data about them, and must receive this within 30 days. The regulation also prevents an employer from using the cameras for a different reason than originally intended. So, for instance, if they say it will be used to prevent theft, they cannot then record the entry and exit of workers from the workplace.
  • Mutual trust and confidence – Employers must not act in a manner that is likely to destroy or damage the relationship of mutual trust and confidence between themselves and employees. Therefore, contravening their privacy by inappropriately filming them is likely to breach this, giving employees the right to resign and claim constructive unfair dismissal.

Employers can only covertly monitor staff without their knowledge in exceptional circumstances where they have reasonable and proper cause to do so. This may include scenarios where there are grounds to suspect criminal activity or very serious malpractice. Employers should ensure that senior management authorises this usage, that it is only implemented as part of a specific investigation, and that the risk of intruding on the privacy of those not suspected of a crime is considered.


How can businesses help protect these individual rights?

There are numerous ways businesses can minimise the potential risks CCTV surveillance poses to staff, and in turn ensure their legal rights are upheld.

  • Carry out an impact assessment – Employers should carry out an impact assessment before installing CCTV in the workplace, as recommended by the ICO. This could prove critical in justifying the use of CCTV by identifying aspects like: the purpose and benefits of filming a workplace, obligations that will arise from doing so, whether there will be any negative impacts, and whether there are alternative ways of achieving this purpose.
  • Make clear the levels of privacy employees can expect – Businesses should make it crystal clear where the cameras will be going and how this will affect employee privacy. For instance, the use of CCTV in toilets is highly likely unjustifiable, whereas filming in areas where privacy expectations are low is generally fine. Employers may also want to display signs to show staff where the cameras are.
  • Create a written policy – A great way to ensure that employees are aware of where the cameras will be placed, as well as the reasons justifying their placement, is through a written policy. This should be readily available (such as on the company intranet) to ensure that there is no confusion or misunderstanding between employers and employees around the use of the cameras. This also gives employees a clear reference for receiving redress if the CCTV cameras are used for reasons not stated in the policy. It is advisable to get employees to sign the policy to acknowledge they have read it.
  • Encourage employee conversations about the monitoring – Businesses should ensure that employees are able to voice any concerns about the cameras in confidence and have the opportunity to explain or contest any footage used for disciplinary reasons. If not, employers could risk staff seeking an enforcement notice from the ICO that prevents the use of this data.
  • Handle the data correctly – Employers must ensure they store and process the data collected in compliance with the GDPR, meaning the information captured must be relevant, not excessive, securely stored, and not kept for longer than is necessary (whilst there are no strict guidelines on this, a retention time of 31 days is common and recommended by police). This ensures that individual rights are protected and that footage can be used as evidence if required.
  • Deal with SARs effectively – Businesses should also make sure they have a clear system in place so that they can respond to any SARs within the 40 day time frame.
  • Businesses must hold themselves accountable – Those involved in monitoring must be subject to rigorous confidentiality and security obligations.

Overall, introducing CCTV into a workplace can prove highly beneficial for a business, but there are a multitude of considerations that must be taken into account. This makes installing CCTV cameras a complex process that is fraught with risks, meaning businesses should think carefully about whether doing so. However, following the advice above should ensure that the process runs smoothly and they get the best out of having CCTV in the workplace.