Blog » HOW NOT TO USE CCTV AT WORKPLACE? – 15 MILLION FINE FOR AUCHAN HUNGARY
HOW NOT TO USE CCTV AT WORKPLACE? – 15 MILLION FINE FOR AUCHAN HUNGARY
09 April 2018
Auchan Hungary started this year with a HUF 15 Million data breach fine for operating CCTV at workplace in breach of data protection principles. Given that CCTV lies in the heart of GDPR entering into force in May 2018, it is worth to learn from the Auchan case so that you can avoid a similar penalty in Hungary.
A freely-given consent?
One of the key-questions of the Auchan case was the CCTV monitoring of employees. This was based on the written consent of employees, that the latter gave when signing the labour contract.
In this regard the Data Protection Authority stressed that those clauses of the labour contract in which the employee gave his consent to the monitoring by CCTV can not be considered as valid under data protection laws.
In the world of work we can not speak about “freely-given” consent, because it is called into question by the hierarchy between the parties. In addition, the employee can not withdraw unilaterally his consent, which is doubtful from data protection point of view.
Based on the above, instead employee consent, Auchan should have based the legal basis of CCTV monitoring of employees on a “legitimate interest assessment test”. In the test he should have assessed employee’s interest on the one hand and the employer’s on the other, and then decide, whether CCTV is necessary, and to what extent.
The Data Protection Authority has also established that the setting of cameras was not appropriate, since those were “zoomed” to one employee. This is only possible in very limited circumstances, when it is necessary by reason of a direct and real danger to life or health of the employee or to property security.
The eventual irregular handling of money by the cashier or mixing up items by the colleague responsible for vending is only a potential risk to property security, which can not justify the direct monitoring of the employee all day. Instead, it is better to direct the camera to the asset to be defended.
Lack of notification
Last but not least, the Data Protection Authority put Auchan in the wrong for informing only in a general manner the employees about the use of CCTV, but not providing detailed information about the following:
- the setting of the cameras, the territory monitored, and the goal of monitoring;
- whether the monitoring is recoded or not by the employer;
- the data security measures executed;
- about the fact that who, when, how long, and for what purposes can watch the recordings;
- finally, about the rights of data subjects.
About the amount of penalty
When determining the amount of the penalty the Data Protection Authority has taken into account that Auchan used the CCTV illegally in all of its 20 shopping malls, thereby more than 6.500 employees were concerned, let alone customers.
The significant market role of Auchan and the fact that it breached more data protection principles were also aggravating factors.
When using CCTV at workplace, you have to carefully comply with data protection laws.
It is not sufficient if you do the paperwork by get labour contract signed by the employee in which he gives his consent to monitoring. Instead of this, you should rely on your legitimate interest and conduct a legitimate interest assessment test which will be the basis of using CCTV. In addition, the proper setting of cameras and the notification of employees is crucial if you want to avoid a huge data protection fine in Hungary
CAN THE EMPLOYER EXPAND THE EMPLOYEES’ DUTIES WITHOUT CHANGING THE JOB DESCRIPTION IN HUNGARY?
The position and tasks of the employee are one of the key elements of the employment contract and are typically recorded in the job description. It is often a matter of dispute between the parties whether the employer can unilaterally modify the job description at all, and if so, to what extent. In a recent court decision, a Hungarian appellate court addressed the above question in a situation where the employer supplemented the employee's tasks with new tasks similar to his existing tasks. In this article, we analyse the recent decision on this matter.Read more »
CAN A HARSH FACEBOOK COMMENT BE A LAWFUL GROUND FOR DISMISSAL IN HUNGARY?
Social media platforms significantly changed the ways how people express their opinions: sharing views became easier than ever. On the one hand, this is positive, but on the other hand, it is also dangerous in the employment context, as the employee's opinion may be prejudicial to the employer's interests. A recent decision of the Hungarian Supreme Court gives answer to the question whether the employer can dismiss the employee for expressing his opinion on Facebook.Read more »
NEW EU – US DATA PRIVACY FRAMEWORK - SIMPLIFIED DATA TRANSFER TO THE US
With the Schrems II judgment, which invalidated the Privacy Shield, the CJEU (Court of Justice of the European Union) make it more difficult to comply with the GDPR for companies transferring personal data from the EU to the US. However, the new EU-US Data Privacy Framework (or “Framework”) adopted on 10 July aims to put an end to this situation. But how does the Framework make data transfers between the EU and US easier? In this short article, we explain the basics of the new Framework and answer the above question.Read more »