Employers : think carefully before using covert means to monitor employees' activities at work -- DPP1(1), 1(2) and 5
The Complaint
It was reported in local newspapers that pinhole cameras were found installed by a government department in the working areas, near the toilets and changing rooms of its regional office. The department's response was that pinhole cameras were installed for the purpose of detecting crime as a result of a series of theft cases occurring in the office. The department believed that the use of pinhole cameras was an effective way for them to identify the culprit(s) and gather evidence.
Findings of the Privacy Commissioner
Site investigation conducted by the Privacy Commissioner's officers revealed that six pinhole cameras were installed at different working locations of the office. The cameras were discreetly concealed inside a socket-like box and it was difficult for anyone to notice their existence.
Under the "Privacy Guidelines: Monitoring and Personal Data Privacy at Work" issued by the Privacy Commissioner, covert monitoring is not to be used unless justified as last resort measures and being absolutely necessary in detecting or gathering evidence of unlawful activities, and the monitoring should be limited in scope and duration. Further, the employer should formulate a clear employee monitoring policy by making known and communicating to the employees the purposes of monitoring, the circumstances under which monitoring will take place and the kind of personal data that will be collected.
Though the department do have a legitimate purpose to protect its and its customers' property from theft, the evidence available did not show the existence of a risk of loss to such extent as to justify the engaging in vast scale video monitoring activities using pinhole cameras which was highly privacy intrusive. The dimension and extensiveness of the monitoring activity carried out was out of proportion to attaining the purpose of collection, and the department was intent upon engaging in continuous and universal preventive monitoring. The Commissioner was therefore of the view that the engaging in employee monitoring activities in such dimension and scale by the department to collect evidence of crime, given the vast amount of personal data that could be captured without the knowledge of the employees, was excessive and thus in breach of DPP1(1).
There was no evidence showing that the department had given due consideration to the use of other less privacy intrusive alternatives or that the use of overt means would necessarily frustrate the purpose of collection. The universal and continuous covert monitoring without a definite plan or policy for its duration is highly privacy intrusive, aggravating the harm, if any, that may be inflicted upon innocent parties. The Commissioner found that the covert monitoring was carried out in an unreasonable and unfair manner, contravening the requirement of DPP1(2).
Where employee monitoring is to be undertaken, reasonable practical steps should be taken to formulate and communicate a clear privacy policy statement to persons affected by the monitoring activity. Since (before using the pinhole cameras) the department had already installed overt CCTV cameras for security reason through which personal data might be collected, there was a real need to implement an effective monitoring policy which should be brought to the attention of the employees affected. On the basis that the department did not have any privacy policy to address employee monitoring activity by using video recording system, the Privacy Commissioner found that the department had contravened the requirement of DPP5.
Action by the Privacy Commissioner
An enforcement notice was served on the department and, as directed, the department ceased the practice of covert monitoring, dismantled all the pinhole cameras, destroyed all relevant recordings and formulated a privacy policy in relation to video monitoring activities undertaken by it.