Videoed in work

The video isn't needed, if someone reports drinking onsite the boss will open an investigation and then follow process

I think you are reaching.

As an investigator I would look at the facts that are presented, interview witnesses and obtain the evidence that is available to me. I would not spend my time looking for potential collusion unless there was some evidence of it. Also it would go against all whistleblowing legislation about the protection of whistleblowers from retaliation for reporting unless there is clear malice in it. You'd find yourself in a lot of trouble over that. As an investigator of a whistleblowing claim, you are looking at the incident reported & if there is any relevant history of the individual who the claim is made against. Indeed the person making the claim & who has submitted the video can choose to remain anonymous which means you legally cannot look at anything to do with them even if you know yourself who it is.

And actually it wouldn't change the GDPR position on the processing of it as it would still be covered under the need to look at it & assess it under the whistleblowing. Yes it's on a managers phone but a phone is a personal device as opposed to something like CCTV which is company owned and operated. And as pointed out above, if the person reported anonymously, you literally can't go off your own ideas who it is to investigate it.

This is the beginning, middle and end of the correct response to the issue raised.

If disciplinary action is being considered, the strength of testimony of the witness should be considered on its own merits.

Ok re-read your second paragraph there. It was someone reporting the actions of someone else - that is whistleblowing. It's literally the essence. While the companies have to have official channels in place, people can also just report it to anyone & it still has to be treated the same. And also the same could be said for you banging on about GDPR continuously without understanding some of the nuances in it.

And yes the data has to be processed in line with GDPR but there are specific understandings around that for the cases of whistleblowing. Like not necessarily having to inform the person straight away if it would hinder an investigation. And you were the one with all the conjecture about "saving the company" or the managers intentions etc. None of that actually matters.

Company phone or not it is not owned & operated by the company. It's operated by an individual. It doesn't matter their level or not, it's the operator. For someone who's so pedantic on GDPR you should understand those terms. Also you do get in to the realms of was it the company phone or not as some people have 2 so how could they know which was used to make the recording. See I can reach too.

Your employer is almost certainly breaking data protection law. If you're concerned, you can report them to the DPC now, or you can wait until they try to use the CCTV in their dealings with staff and report them then.

If you're in a union, it would certainly be worthwhile getting the union involved. If you're not in a union, this would be a good time to consider organising.

Sorry, but when did a simple management communication become 'whistle blowing'? Is every communication relating to any employee error now whistle blowing? If I email one of my team saying "I didn't like the way you did X, please do Y the next time" am I whistle blowing?

There are now 'understandings' in relation to GDPR compliance. There are specific legal obligations, and when companies screw up on these, it costs them big money - tens of thousands, hundreds of thousands, millions or billions.

The company phone is operated by the individual, as part of their employment - same as any company owned equipment - same as CCTV or factory equipment or anything else. You seem to be spinning here to try to distance yourself from GDPR obligations, but employers are responsible for how company equipment is used. It's up to the employer to have appropriate policies and controls in place.

And if it was a personal phone, companies have obligations to have appropriate procedures in place also about how personal phones are used in the workplace.

Yes, you can certainly reach.

That's a big leap there, from someone being under the influence (as the OP stated) to posing a danger to others. We've had nothing from the OP to suggest there was a danger to others.

And anyway, how do you define 'danger'? Is an employee error that will result in reduced profits a danger to others? Is an employee error that causes slight reputational damage a danger to others?

The specific type of processing may well be allowed, but it STILL needs to be covered in the privacy policy of the organisation.

Honestly, you're reaching so far here you're about to topple over.

There is absolutely nothing in the OP about danger. Yes, that is a possibility in certain conditions in certain workplaces, but it's a fair old stretch to say there's danger here so this is a whistleblowing scenario.

There is absolutely nothing in the OP about whistleblowing. I'd bet a fiver if you asked the person who did the video recording if they were whistleblowing, they would look back at you with a confused stare. There's nothing to suggest that this is a whistleblowing scenario.

You really don't seem to understand how GDPR policies work. Of course this personal data category has to be called out specifically. That's the whole purpose of these policies. If it's not called out specifically in the policies, then the data is not being processed in compliance with GDPR, which is a requirement for whistleblowing, according to the link you posted yourself.