Irish Data Protection Commission Case Studies

Data Controller breaches data protection law in regard to use of covert CCTV footage [2007] IEDPC 6 (31 December 2007)


I received a complaint in October 2006 from a data subject regarding the unfair obtaining by her employer of her personal information and its subsequent use as evidence to terminate her employment. The data subject had been employed in a supervisory capacity at the XX in Dublin for a number of years. In January 2005 she was called to a meeting by management, at which she was informed that covert cameras had been installed some time previously in the hotel for the purposes of an investigation. The investigation was initiated on foot of a complaint received by the hotel regarding cash handling at the bar. The data subject was not the subject of the investigation, she was not made aware of the investigation nor was she informed of the covert CCTV recordings. At the meeting, the data subject was confronted with a series of questions and was asked to explain some of her actions which had been recorded by the covert cameras. Later in 2005, she was dismissed from her employment with the hotel. Evidence taken from the covert CCTV recordings was used in the decision to terminate the data subject's employment. No criminal prosecutions took place following the hotel's investigation nor was the data subject interviewed by An Garda Síochána.

As part of the detailed investigation into this complaint, my Office initially sought the observations of XX regarding this issue, drawing particular attention to the fair obtaining principle of the Data Protection Acts 1988 & 2003. The use of recording mechanisms to obtain data without an individual's knowledge is generally unlawful. Such covert surveillance is normally only permitted on a case by case basis where the data is gathered for the purposes of preventing, detecting or investigating offences, or apprehending or prosecuting offenders. This provision automatically implies an actual involvement of An Garda Síochána or an intention to involve An Garda Síochána.


In response to our initial queries, the hotel stated that the cameras were installed for a legitimate and specified purpose -the investigation of a complaint regarding cash handling in this area. It stated that it was of the opinion that the processing of this information was necessary for the protection of a legitimate legal interest, the protection of property of the hotel in response to a specific concern it had. The hotel also emphasised in its early correspondence with my Office that at no point were the cameras hidden or covert and it presumed that all employees would have seen them.

During our investigation, the data subject supplied photographs of electrical type data boxes/sockets that were located in the bar area of the hotel as it was her understanding that the covert cameras were hidden within these boxes. My Office forwarded copies of these photographs to the hotel requesting clarification on the matter. In response it indicated that these electrical type data boxes were telephone connections, microphone connections and internet connections and were never used as a means to record images for CCTV footage.

As part of our investigation, my Office visited the XX for the purpose of viewing the CCTV footage in question and to inspect the area in which the CCTV footage had been recorded. During this inspection, as well as viewing the footage, we were shown two electrical type boxes located just below ceiling level in the bar area and these boxes were identified as having been the location for the covert cameras. The location of the boxes also matched the views of the bar area which could be seen in the CCTV footage. The boxes were marked "1" and "2" and they appeared to be the same as the electrical boxes which appeared in the photographs which were previously supplied by the data subject. This clearly conflicted with the earlier information which the hotel had supplied to my Office as part of its investigation. Following this inspection, my Office was satisfied, on the basis of all of the information which had been compiled during our investigation, that the data protection rights of the data subject had been breached. Covert CCTV cameras had been installed to investigate specific incidents. The data subject was not the subject matter of this investigation. The personal data of the persons captured on the footage was obtained for one purpose - the investigation of specific incidents in the hotel. In the case of this data subject, her personal data was further processed in a manner incompatible with the original purpose. Furthermore, the data subject's personal data was not processed in accordance with the requirements of 'fair processing' as she had not been informed by the data controller, at the time when the data controller first processed her data, of the purpose for which it intended to process her personal data.


As the Acts require me to try to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter which is the subject of a complaint, my Office asked both parties to consider this approach. Within a few weeks, a settlement was agreed between the parties. I was pleased that my Office was able to close its investigation file on the basis that an amicable resolution had been reached.