Spanish authority in charge of personal data protection has recently fined a personal data controller for using the audio recording option of its surveillance system, which data was subsequently used for termination of an employment contract.
Facts
Employer used the existing surveillance system for audio recording of the communication between an employee and clients, for which reason, given that the employer considered the recorded communication inappropriate, that employee’s employment contract was later terminated. The employee instituted a court proceeding for annulment of decision on termination of employment and addressed the Spanish personal data protection authority over unlawful workplace communication surveillance.
Although the conversation that caused the employee’s dismissal happened outside working hours, the termination notice referred to it nevertheless. According to the employer, the employee had been notified in writing about the possibility of audio recording through surveillance system in the employer’s premises, while the recording of the subject conversation could not be provided as it was automatically deleted by the system 30 days after it had been created, according to the standard procedure.
The dispute regarding the termination of employment was amicably resolved, i.e., by a settlement in which the employer acknowledged dismissal to be void, while the case was before the Agency for Personal Data Protection finished by fining of the employer.
Reasons for the decision
The acting authority found that provisions of the local Law on Personal Data Protection were infringed on this occasion, in particular Article 89 that stipulates employees’ right to privacy and prescribes that video and/or audio recording of working processes is allowed within legal framework. Although recording devices were not installed in inadmissible places, their use in this particular case was not reasonable in terms of domestic legislation and court practice, considering that Article 89, paragraph 3 of the local regulation indicates that the use of audio recording devices at workplace is permitted only in the event of risk against safety of installations, objects and persons, with respect to principles of rationality and minimization.
Given that the processor in this case failed to prove that audio recording of communication between the employee and clients was necessary for monitoring the work process, such processing is considered unlawful, i.e., processing done without relevant basis in terms of Article 6 of GDPR.
The fine was designated in the amount of EUR 6,000, considering all mitigating (e.g., that only one person’s right to personal data protection was infringed) and aggravating circumstances of the case (e.g., that infringement was done intentionally).
This decision is interesting from the aspect of domestic legislation in the field of personal data protection, as well as in terms of the practice of competent authorities, particularly considering that employers in the Republic of Serbia are increasingly using various tools for supervising employees’ work, such as video surveillance, GPS, tracker software, etc.
This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.
By Ivana Ruzicic, Managing Partner, and Lara Maksimovic, Senior Associate, PR Legal