Data Protection Annual Report 2013 - Important Updates for CCTV and Medical Certs

The 2012 Annual Report for the Data Protection Commissioner has been published and, as always, it makes for some interesting reading. Some of the key stats from the report include 1,349 complaints for investigation were made to the office of the Data Protection commissioner, exceeding last year’s record high number through an increase of 188 complaints. However, by far the most interesting news for employers centers around the Commissioners report on the use of CCTV footage in the workplace and also on an employer’s entitlement to information in respect of employee medical certificates. The Use of CCTV Footage This concerned a complaint made to the Commissioner concerning a nursing home which had installed cameras all over the building. Concerns were raised as access to the footage was linked to the nursing home owner’s private residence where they could log in remotely at night and monitor the footage. Footage was also available via smart phone. The nursing home said that this was to ensure safety, protection and quality of care in the premises. However, the Data Protection Commissioner notified the nursing home that it “could not see any basis under which the use of smart phones for live monitoring purposes could operate legitimately in accordance with the Data Protection Acts” and as a result the nursing home was instructed to cease this practice. This is a hot topic at the moment. Industries such as nursing homes and child care crèches are now very much concerned with the treatment of vulnerable persons by staff members and there has been a lot of talk in recent months about the need for CCTV footage which can be instantly viewed by parents, family members and employers. Thus, the following excerpt from the Annual Report should be of particular interest to employers: “Remote access to CCTV cameras, by whatever means, is becoming more frequent with advances in technology. Clearly such technology is helpful in terms of providing security monitoring of an empty building at night time or at weekends and no data protection issues arise in such situations. However, concerns from a data protection perspective arise where the remote access takes place in relation to areas such as manned workplaces and where workers perceive that their work performance is being monitored on a live basis... Such situations are difficult to reconcile with the requirements of the Data Protection Acts and this Office cannot see any legal basis to justify the monitoring of individuals in the course of their normal activities by such means. In instances such as that outlined in this case study, where there is no valid justification for the use of remote access technology to link to CCTV cameras, we will continue to order that the remote access concerned be terminated.” Medical Certificates The second case study we have highlighted is something that affects every employer. It is common practice that an employer will insist that an employee who has taken sick leave for a specific amount of time will be required to submit a medical cert which clearly outlines the nature of employee’s sickness. Indeed, this is what had occurred in the Department of Education where a medical certificate would only be acceptable if it highlighted the specific nature of the illness. The Department informed the Commissioner that this was required as they have a duty of care to employees and students not to expose them to a health and safety risk. The Commissioner accepted that “in certain very specific circumstances a doctor may be legally obliged to report certain illnesses to an employer for health and safety reasons and we recognise the need for this practice, particularly in the case of contagious diseases. However, any general practice of requiring all employees to specifically disclose their condition or illness to account for their sick absences from work does give rise to serious concerns from a data protection perspective as it does not adequately protect the sensitive personal data of those employees who may have an illness/condition which they consider private or sensitive.” In essence, the Data Protection Commissioner stated that only in exceptional circumstances can an employer insist on the nature of the medical condition and aside from this they are only really entitled to know that (a) the employee is unfit to work, (b) how long they will be unfit for, and (c) that they are medically fit to return.  Data Protection is a growing area of employment law and as we just read it can impact on a variety of issues ranging from CCTV footage to medical absences. Therefore, employers are encouraged to seek advice from the experienced Peninsula Employment Law Consultants who are ready and available to take your call 24 hours a day, 365 days a year, on 01 855 50 50.