First published: July 4th 2017
Last updated: August 23rd 2023
The Data Protection Commission periodically publishes case studies examining the legitimate use of audio recording and photographic data.
One such case examined the use of audio recordings and photographic data during a disciplinary process which subsequently led to the dismissal of an employee working in a residential care home.
Facts
In summary, on two separate occasions, the complainant had been found asleep during the night shift by his supervisor. On both occasions, the complainant was the only employee on duty and responsible for the care of highly vulnerable and dependent adults. The adults, who had complex medical and care needs, were required to be checked on a regular basis.
On the first occasion, the complainant’s supervisor warned the complainant that if it happened again, it would be reported in line with the company’s disciplinary and grievance procedures.
On the second occasion, the supervisor found the complainant asleep on a recliner, covered with a blanket with the lights turned down and the television off. On this occasion, the supervisor took a photograph of the complainant asleep, along with an audio recording of the complainant snoring.
Investigation
During the investigation, all of the supporting evidence was provided to the complainant. The investigation team upheld the allegations and the complainant was invited to a disciplinary hearing.
The employer subsequently dismissed the complainant for gross misconduct and outlined that the reasons for dismissal were primarily due to the vulnerabilities and dependencies of the clients in the complainant’s care.
Complaint to the Data Protection Commission
Following the dismissal, the complainant submitted a complaint to the Data Protection Commission alleging that his personal data was recorded, photographed and used for an illegal purpose as supporting evidence in a disciplinary hearing.
The Data Commissioner investigated the complaint and found that no breach of the Data Protection Acts 1998 and 2003 had occurred. They said:
“In this case, we considered that the processing of the complainant’s data, by way of the photograph and audio recording made by the supervisor, and the subsequent disclosure of these to the employer was necessary for the purposes of the legitimate interests pursued by the data controller, the employer, under Section 2A(1)(d) of the Data Protection Acts 1988 and 2003.
This legal basis for processing requires the balancing of the data controller’s (or a third party’s or parties’) legitimate interests against the fundamental rights and freedoms or legitimate interests of the data subject, including an evaluation of any prejudice caused to those rights of the data subject.”
“We considered that the processing of personal data here was limited in nature and scope as it consisted of a one-off taking of a photograph and the making of an audio recording by the supervisor, who acted of their own volition and not in response to any direction or request from the employer.”
They found that in the circumstances the processing “was proportionate and that the legitimate interests of the data controller (and indeed the legitimate interests of third parties, being the clients of the residential care home) outweighed the complainant’s right to protection of their personal data.”
They also noted that protection of data is a fundamental right under EU law, however, such rights are not absolute. The Data Protection Commission stated that “a fair balance [needs] to be struck… In particular, as this case demonstrates, data protection rights should not be used to ‘trump’ the rights of particularly vulnerable members of society or the legitimate interests pursued by those organisations responsible for safeguarding the health and life of such persons in discharging their duties of care and protection.”
Impact for Employers
This isn’t a ‘one-size-fits-all’ case. Employers should note that each case will be determined on its own facts.
The Data Protection Commission was also careful to note that this decision did not set a precedent.
The key takeaways for employers to note are:
- The supervisor acted of his own accord. If he had been instructed to take the audio recording or photograph, the outcome may well have been different.
- The legitimate interests of both the employer and the third parties in its care were clear in this case. As the employer was protecting the rights of vulnerable and dependent members of society, they found the processing of the data to be reasonable and proportionate.
If you have any questions around your data protection obligations or any aspect of Irish employment law, call a Graphite HR expert today on 01 886 0350
