According to a Spanish Court, hidden cameras in a workplace do not necessarily infringe the GDPR

A city bus company in Zaragoza received multiple complaints from users, and from the local police (who also received complaints from citizens) regarding the misbehaviour and “precariousness” of the transportation service from certain bus drivers. Based on these complaints, the company advised its employees they were going to take all the necessary follow-up measures to identify the neglectful drivers. In this sense, they proceeded to appoint a private detective company who installed hidden cameras in the driving seat and placed four in-person controls on board in different bus lines. The investigations results showed the ex-employee did not follow the mandatory standards established by the company; specifically: used to smoke, eat, and use her phone while driving, didn’t use the proper covid-protection mask and failed to charge certain passengers for the service, which all resulted in her subsequent dismissal.

She alleged that the images used as the basis of her dismissal were unlawfully obtained as the company never informed about the processing of her personal data, hence, was unable to exercise her rights according to the GDPR. However, the Court considered that (i) the company did advise about the possibility of exercising labour control measures; and, (ii) since the company used the private detectives’ services, the applicable law in this case was the Private Security Law (hereinafter, "PSL"), which not only did not require them to previously inform about video surveillance, but dictates that private investigators have to comply with the principle of confidentiality and the duty of secrecy. This means that they would not be able to provide information about their investigations. 

Both the Spanish data protection law (art. 22 of LOPDGDD) and the Spanish supervisory authority (hereinafter, "AEPD" - guidance on the use of video cameras for security and other purposes of the AEPD) foresees video surveillance for labour control purposes as well as hiring private detectives for investigational purposes based on the employer's legitimate interest. The own PSL, which regulates the private detective activity, foresees the obligation to comply with personal data protection laws, and with principles such as "reasonableness, necessity, appropriateness and proportionality".

Regarding the employer's obligation of transparency, it is obvious that due to the nature of the private detective service, the same will not be applicable as it would also be against the duty of professional secrecy. The art. 14 of the GDPR includes an exception to this obligation when it is likely to render impossible or seriously impair the achievement of the objectives of that processing. Nevertheless, both the PSL and the AEPD expressly indicate that the processing through a private detective must be based on legitimate interest with reasonable and well-founded reasons for the use of such evidence. 

According to the AEPD criteria, hiring a private security company shall be considered as the appointment of the processor. Therefore, the employer keeps being the controller of their employees’ data processing and the obligation of proving the legitimate interest corresponds to them, although the private security company must ensure that it’s duly accredited (art. 48.2 PSL).

The legitimate interest entails having a prevailing interest over the individual’s rights. In this case, it appears to depend on the severity of the infraction, as the former driver may have affected the functionality of the transportation service, therefore, the security of the passengers (i.e., the usage of the phone while driving could result in a serious and negative outcome). Nevertheless, this wasn’t mentioned by the Court.

Moreover, when it comes to the principles of necessity and proportionality, we must mention the European Court of Human Rights (hereinafter "HUDOC") case law emitted in this matter. The Grand Chamber of the Court concluded that the proportionality test of "hidden cameras in the workplace" can be passed when there is reasonable suspicion of severe infringements and with undoubted damage, and if it had been notified in advance, the measure would not have served its intended purpose. In this context, the necessity was based on the suspicion of robbery by employees (which have already robbed 250,000 euros), thus, the severity and the damages were clearly perceived. However, in this case, neither the grade of severity or the damages are that much perceivable to undermine the rights of privacy and data protection of an individual, specially when there may be other ways to verify the misbehaviours of the drivers (i.e., through the presence of private detectives reporting the events).

Although the Court relies on this HUDOC criteria to indicate that the proportionality test in this case has been passed successfully, this judgement leaves us wishing for a more exhaustive legal substantiation and with several inquiries: should the "infractions" made by the former driver be considered as severe enough to determine that installing hidden cameras was indeed proportional? Was it truly necessary to install those cameras, or the misbehaviour of this driver could have been proven in some other way that is less intrusive for privacy? May this judgement provoke that from now on all the employers hire private security companies to avoid their obligation to inform? We’ll have to wait and see if there is a subsequent appeal and if the Supreme Court confirms this statement.