Videoed in work

There is no law against one person taking a video of another.

I presume you are concerned about disciplinary action from your employer, so the 'good' news is that it's a lot more complicated when it comes to an employer using footage in a hearing when the employees have not been told that they may be recorded at work.

If a complaint is made, it's gross misconduct and dismissal territory. Being drunk on the job isn't like knocking off five minutes early or sneaking a cigarette during your shift. Depending on the nature of the job, you're potentially putting yourself, colleagues or customers at risk, and certainly the reputation of the company.

If it came to a WRC hearing, I think the employer could make a strong case that it was critical to get all the available evidence and that his obligations to keep the workplace safe override the privacy concerns of the employee.

I'm going to assume these drinks weren't consumed in the course of an office Christmas lunch function.

Is a video enough to prove intoxication? Is there video or pics of a bottle of alcohol? An employer has to thread very carefully

Yes, that is correct. But in this case, the employer did not collect or process the data (we don't even know if they've seen it yet) so it's a grey area at best in terms of their obligations.

Assuming the guy with the camera is not routinely recording people but only did so to record the misconduct, I don't think GDPR is going to save the offender.

Highlighting the GDPR issues may well cause the employer to think twice about using the video as part of the disciplinary process, which in turn may well have a significant impact on the outcome.

The only reason I ask that is because I take medication which can make me drowsy and affect my speech so I could appear drunk so people should be careful before whipping the camera out.

Ok first off GDPR doesn't apply here. GDPR is about the processing of a person's information & the storage of the same by a business. Not one employee recording another.

Secondly, as someone who investigates whistleblower cases like these, we would use the video evidence if it was uploaded as part of the whistleblowing complaint. It could not be solely relied upon & a full investigation would have to take place but it can be used as part of it. If nothing else it can identify other potential witnesses who would be interviewed to get their understanding of what happened. Also it doesn't matter if it was recorded on a work phone or a personal phone either.

Most companies take a very dim view of being intoxicated in the workplace and while it might not be able to be proven too much after the fact, it may lead to a heavy formal warning going onto the employees file.

As for use of CCTV - if there is CCTV in the workplace anyway, it is perfectly allowable to access it in the case of an investigation into behaviour and this is allowed under it's usage. Now there should be stringent policies in place about who is allowed to access that and that a proper formal request is documented to review it but it is there to protect employees, which in this case would be those other than the alleged intoxicated person as that person could cause injury to another employee by being impaired.

Read what I said.

SOME information. Not detailed or even fully factual. Probably something like "X has an issue which causes him/her to appear sleepy sometimes. If this happens you should do xyz"

Because employees should absolutely not be tolerating their colleagues appearing to be drunk in the workplace. If someone sees and reports an apparently drunk employee on-site, and management say and do nothing, then it looks like it's allowed.

Data privacy company needs to say they are using cameras and for what intention. Any video can only be used to support that actual intention.

they can’t use it for everything

I'm well versed in it thanks. GDPR allows for the processing of the information if:

• The processing is necessary for compliance with a legal obligation, or
• It is deemed to be a “legitimate interest” of the controller, company or third-party

Which does apply in the above. Now the number of people who see the information should be limited and in compliance with the GDPR policy within the business and also with the legislation. When it comes to whistleblowing cases where there is a legitimate risk to people (which can definitely happen is someone is intoxicated on site) then it can fall into the 2 categories above. The legal part as the employer is obligated to provide a safe environment for employees (which includes protecting them from accidents caused by someone who is not able to complete their duties) and also the legitimate interest part as it forms part of a whistleblower complaint which also is legal as you're legal obligated to investigate them.

I agree on the CCTV - the policy must be clear as to how and when this can be used but most companies will have it included in their CCTV policy that they can review in the event of a complaint. It must be a specific complaint & also with controls around who can see it as it could identify the whistleblower who is entitled to anonymity. CCTV can't be used for continuous monitoring of employees but again in this case, I'd say they'd be looking for corroboration of the phone video evidence.

Peer-to-peer doesn't count in whistleblowing - anyone is entitled to raise a complaint or concern about anyone else either anonymously or not regardless of level within the organisation and have it investigated. Also the recording on the phone isn't necessarily under corporate control as the phone is most likely available to the employee for outside corporate use so does fall into a more grey area than something like CCTV. Now if the employee is sharing that video amongst other employees, that can be a case against them too as that is not allowed.

The EU Whistelblower Directive which came into effect at the end of 2021 covers off on the right to process under GDPR and also the right of the company to not inform in the instance where there could be hinderance to the investigation until that risk is reduced. I'd recommend reading this to understand it: https://blog.complylog.com/whistleblowing/gdpr-and-whistleblowing

Again. The company was not using cameras for anything. The video was taken by another employee on his/her phone. Citing the rules for CCTV over and over again isn't really helpful.

Unless the company starts sharing the video on the office WhatsApp or some other inappropriate use of the footage, then they are absolutely entitled to view it and use it.

If I walked into the office, punched a co-worker in the face and it was captured on cameraphones by 20 of my co-workers, would I be able to claim GDPR protection?

Did you? I didn't say it overrode GDPR requirements but that the individual accused of being intoxicated can't cite GDPR as a reason to not have the video used.

From the link:

4.1 Ensure lawfulness of data processingWith regard to the lawfulness of your processing data relating to whistleblowing reports, you can justify using one of two different reasons, as set out in the data protection directive:

• You are doing so to comply with a legal obligation
• You are pursuing a legitimate interest using the data.  

In most cases, your legal basis for data processing will fall under the first reason. When a whistleblower makes a report, you are obliged to investigate, which requires processing data. If the first reason does not apply, you would have to prove that you were processing data in the public interest, relating to national or EU law, to justify your actions under the second reason. 

If there is a whistleblowing claim you are legally obliged to investigate it. The legal basis isn't in retrospect at all. Employers do not have to have policies about what people do with their phones in regards recording other employees as it is not a company thing. They do around CCTV however but that is only if they want to access the CCTV to confirm the incident.

Also from that article:

In order to comply with GDPR, you should inform persons concerned about the fact you are processing their data. However, as this could hinder any investigation, you are allowed to delay disclosure until the high risk of obstructing the reporting process is diminished. Article 14.5(b) of GDPR offers an exemption in cases where disclosure is “likely to render impossible or seriously impair the achievement of the objectives of that processing.“ 

So please explain to me where I said that it overrode GDPR and also anything I said that was incorrect? What I did say was that the employee cannot make this go away or get the company fined under GDPR legislation because they don't like that another employee (level doesn't actually matter in the cases of whistleblowing) took a video of them.

There is another element of GDPR relating to the collection and retention of PII.

If you collect data for one purpose, it cannot usually be used for another unrelated purpose.

In this case the data was collected specifically for the purpose of making a whistleblower complaint as part of a formal or informal investigation.

Whistleblowing policies & procedures are required legally to be in place since the end of 2021. All employers should have them and it does allow for that. It does not have to be covered in any employment contracting as whistleblowing is protected as is the person who is doing the whistleblowing. Policies must be available to all employees and also the information as to where & how to report but no update to contracts are needed. If the company (i.e. as the organisation not an individual) is covertly recording, this would be a problem but someone recording someone doing something they perceive as dangerous in the workplace is not going to be a problem. They won't find themselves facing any fines under GDPR if they are processing provided information (either verbal, written or video) under whistleblowing. Seriously this is not complicated and is well covered under both the GDPR and the Whistleblowing directives and legislation. And whistleblowing is legally protected so that there can be no come back on a whistleblower unless malintent has been proven which is seriously difficult to do. It's protected under law. And also as companies are legally obligated to investigate all whistleblowing (no matter how stupid the report may seem), the processing of any information under that is again protected by a legal obligation.

there was a case in the WRC where the guy was awarded $15 k because the company didnt/couldnt test the employee. the company needs to send the employee to the company doctor to get a sample taken. the video probably wont be enough to get fired.

https://www.ibec.ie/employer-hub/hr-management-guide/dismissal/case-law/welder-awarded-15000-in-unfair-dismissal-claim-despite-admitting-he-consumed-alcohol-before-work

If they don't have the legal basis for processing and other requirements set out in their Privacy Policy beforehand, then they're not processing data in accordance with GDPR.

It allows for "allows for the processing of all relevant provided information during the course of an investigation" provided that the information is processed in a GDPR compliant manner, as detailed in the article you quoted. It's not a hall pass to ignore GDPR requirements to have a Privacy Policy setting out what information you use, what the legal basis for use is, and how it will be processed and retained.

They still have to comply with GDPR, and unless their Privacy Policy sets out the legal basis for using covert video taken by a manager, they are not complying with GDPR and are exposing themselves legally.

I'm gonna leave it there, as we're largely going round in circles now, but you can't use Whistleblowing regulations to take short cuts on GDPR.

Ah come on? Now you're suggesting collusion between managers to record an event? And if there was, wouldn't that indicate a longerterm problem with the employee and suspected intoxication. At which point, most companies could invoke Health & Safety policies which will often include a clause around testing employees for drugs or alcohol. You're now just reaching. Most likely thing was the person involved grabbed the phone and recorded it. 9 times out of 10 they simple explanation is the correct one.