Caught on camera: Employer’s use of covert CCTV was proportionate and admissible in evidence
In the case of López Ribalda v Spain the European Court of Human Rights (ECtHR) ruled on the use of covert CCTV surveillance in the… Read more
In the case of López Ribalda v Spain the European Court of Human Rights (ECtHR) ruled on the use of covert CCTV surveillance in the workplace and the admissibility of evidence. While the Chamber held 8/1 in favour of the applicants, on appeal, the Grand Chamber reversed the judgment 14/3 in favour of Spain finding that the covert surveillance, which provided evidence of theft by cashiers at a supermarket, was a justified and proportionate interference with the privacy of the employees notwithstanding the employer’s failure to give them prior notice that they were being monitored.
Five Spanish nationals formerly working as cashiers and sales assistants in a supermarket brought proceedings against Spain in the ECtHR in relation to:
- being dismissed by the supermarket on the basis of evidence obtained through covert video-surveillance implemented in breach of their right to private life under Article 8 of the European Convention of Human Rights (Convention); and
- admitting the unlawful CCTV footage and settlement agreements signed under duress in evidence in breach of the right to a fair hearing under Article 6 of the Convention.
The ECtHR held that, within the “margin of appreciation”:
- the Spanish legal framework provided for significant safeguards under civil, administrative and criminal law which complied with Article 8, including remedies under data protection laws which the applicants failed to use;
- the covert video-surveillance was justified and proportionate; and
- the use of the footage and settlement agreements as evidence did not undermine the fairness of the Spanish proceedings.
A bit of context
It is common practice that a cashier starts the day with a set amount money and the register then keeps track of all transactions during the day. When a cashier clocks out for the day their cash drawer is pulled and counted, then the count is compared to the register’s recorded transactions. If the balance does not add up, what happens next is determined by the amount that is missing. If a few cents are missing, this is considered human error. Larger amounts can lead to companies to start investigating.
It is not uncommon for each register to have a camera that covers both the cashier and customer. The CCTV footage will help determine if the missing cash was taken by the cashier or if a customer managed to pull money from the drawer while the cashier wasn’t looking.
Whilst such cameras are normally conspicuous, the present case is about covert monitoring.
The supermarket installed the covert CCTV to investigate theft which it suspected because of significant monthly losses reaching €24,000 at one point. A general notice about CCTV was provided but it did not inform about the hidden cameras. The footage revealed that some cashiers scanned items but later cancelled them and allowed customers to walk out without payment.
Without being shown the footage, each of the 14 implicated workers were handed a letter of dismissal in individual meetings held with the manager, union representative and the supermarket’s legal representative. Some workers admitted to the theft.
In the criminal proceedings initiated by the supermarket after the dismissals the judge held that on the evidence each of the thefts was a “minor offence” not exceeding €400 per person.
Right to private life
The ECtHR reminded us that the concept of private life includes the “inner circle” of an individual but also his or her “private social life” which could include professional activities.
Whilst the taking of payments for purchases by customers was not intimate or private, the creation of a systematic or permanent recording of images of identified persons even in public could affect their private life.
The Article 8 right is not a mere prohibition on arbitrary interference with privacy by public authorities, but it also implies a positive obligation for the state to ensure the effective protection of the right.
Balancing exercise and proportionality
The big question was whether the Spanish courts, when considering the proportionality of covert monitoring, struck the right balance between the right to private life and the employer’s interest in ensuring the protection of property and the smooth operation of business. This Spanish constitutional right expressly empowers the employer to adopt monitoring and supervision measures to verify that the workers are complying with their employment duties.
The following Spanish constitutional principles applied:
- Appropriateness test: Any measures interfering with the privacy of employees had to pursue a legitimate aim. The ECtHR held that the existence of “reasonable suspicion that serious misconduct has been committed” in the context of the significant losses identified by the supermarket which pointed to a concerted action by multiple offenders constituted a “weighty justification”.
- Necessity test: Such measures had to be necessary for the fulfilment of the aim pursued. In this case, the recordings were necessary evidence of the wrongdoing.
- Strict proportionality test: The measures had to be proportionate to the circumstances of each case. Surprisingly, despite the significant consequences for the workers and the breach of Spanish law (as further discussed below), the ECtHR held that the privacy intrusion “did not attain a high degree of seriousness” since the recording was:
- purpose-specific (i.e. used only as was necessary to prove the theft);
- targeted (i.e. zoomed in on the checkout counters where theft was likely to occur); and
- short-term (i.e. only 14 days which was sufficient to confirm this was a repeated unlawful conduct)
The ECtHR helpfully reiterated factors for determining proportionality borrowed from the Bărbulescu and Köpke decisions:
- notice about the purposes and nature of monitoring;
- extent of monitoring and degree of intrusion;
- legitimate justification appropriate to the level of intrusion;
- existence of less intrusive methods;
- consequences for the individual of the use of the recordings for the purpose; and
- appropriate safeguards, such as consultation with worker representatives, notification to an independent body and ensuring individuals’ right to complain.
Transparency, the main point of contention
The ECtHR referred to Treaty 108 and various opinions of the Council of Europe and the Article 29 Working Party highlighting the requirement of transparency and prior consultation with worker representatives. According to these documents, in case of “well-founded suspicion”, “secret surveillance should only be allowed, and then only on a temporary basis, if proven necessary because of lack of adequate alternatives”. It must be deployed in the “least intrusive way possible” and “targeted on the risk area”.
Past Spanish Constitutional case law suggested that, absent prior notice, proportionality alone may not be sufficient to comply with Article 8. Yet the Spanish court was satisfied that the surveillance was proportionate even if it failed to investigate the requirement of transparency. The lack of notice was a breach of Spanish law punishable by administrative fine but this, the Spanish court noted, had no impact on admissibility of just and proportionate covert video-surveillance.
The Chamber of the ECtHR had taken a different view and initially found for the applicants. It held that the monitoring was broad in scope, initially not limited in time, affecting all the employees working at the tills and covering all working hours, and in breach of the obligation under Spanish law to give prior notice. It held that at least a general prior notice of the installation of the covert video-surveillance system could have secured the employer’s rights.
On appeal, the Grand Chamber held that only an “overriding requirement relating to the protection of significant public or private interests” could justify the lack of prior notice. In this case, the court agreed with the supermarket that prior notice would likely have defeated the purpose of the operation.
Admissibility of evidence
Since Article 6 does not lay down any rules for admissibility, the ECtHR’s role was to consider the fairness of the proceedings as a whole. In this regard, the ECtHR held that the applicants were given an opportunity to challenge the authenticity of the evidence and to oppose its use.
Unfairness was alleged due to the failure of the Spanish courts to address the lack of notice which was a breach of domestic law. The ECtHR considered that this did not affect fairness of the proceedings because the Spanish courts had found, in line with the Spanish constitutional principles, that the video-surveillance had not been implemented in breach of the applicants’ right to private life.
In any case, the additional compelling evidence available to the supermarket could not be impaired by the viewing of the recordings. Such evidence included admission of theft by some workers to the union representative, the union representative’s testimony, acknowledgment of the offence in the settlement agreement, and the analysis of receipts which demonstrated that a significant number of purchases had been cancelled without payment.
Two of the applicants signed a settlement agreement acknowledging the theft and agreeing to the dismissal. Later they claimed the agreement was signed under threat of criminal proceedings and duress and deceitful manipulation by the union representatives.
The Spanish courts did not find any evidence of coercion, particularly given that not all employees ended up signing the settlement agreement, the prior admission to the union representative and the presence of the representative at the meeting. The ECtHR agreed this finding by the Spanish courts was not arbitrary or manifestly unreasonable.
The ECtHR agreed that the settlement agreements did not prevent access to justice as applicants were able to dispute it and oppose their admissibility as evidence.
The European Trade Union Confederation submitted that in situations where it was not required to give prior information to the employees themselves, the notification and consultation of their union representatives would be essential.
The three dissenting Grand Chamber judges submitted:
- The Convention must develop adequate legal safeguards to tackle intrusive modern technologies.
- The sole guarantee of prior notice is not sufficient. More guarantees must be provided in a clear and foreseeable legal framework with appropriate and effective safeguards.
- Data protection rights such as access and objection were not granted in this case. The Spanish courts failed to enforce the prior notice requirement under data protection laws. In addition, the Spanish court failed to consider less intrusive methods, which constitutes an important factor of the proportionality assessment.
- The court failed to condemn the employer’s initiative to investigate the offence through intrusive measures rather than going to the police. The existence of “reasonable suspicion of serious misconduct” cannot be sufficient to warrant such measures. The ECtHR has decided to allow a dangerous precedent of unlimited use of covert video-surveillance in the workplace without affording sufficient legal safeguards to individuals. In light of the growing influence of technology, individuals must not be allowed to take justice into their own hands.
In light of the monitoring capabilities of new technologies, one cannot help but wonder if the bar has been raised high enough.
The lack of notice and failure to appropriately consider less intrusive means may seem like an inconsequential procedural mistake but why should strict procedures not be required in relation to intrusive interference with the right to privacy? The EDPS recently commenting on facial recognition technology asked “Is there any evidence yet that we need the technology at all? Are there really no other less intrusive means to achieve the same goal?”. This principle of necessity which requires the controller to take certain procedural steps is a major safeguard for our right to privacy and this case has just approved of covert CCTV-surveillance the implementation of which suffered from procedural flaws.
At the same time, employers will welcome this decision which will empower them to investigate crimes without having to rely on the police which may not have the resources to deal with all matters. However, given the cautious approach by regulators in relation to monitoring, it remains clear that any employer who wishes to implement covert CCTV will have to carry out a detailed privacy impact assessment. A conservative approach is advised in relation to any assessment of proportionality.
Marta Dunphy-Moriel, Partner, and Alexander Dittel, Commercial Senior Associate, Kemp Little LLP
 López Ribalda v Spain, nos. 1874/13 and 8567/13, 17 October 2019.
 Bărbulescu v Romania [GC], no. 61496/08, § 70, 5 September 2017; Köpke v Germany (dec.), no. 420/07, 5 October 2010.
 Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108).
 Facial Recognition: A Solution in Search of a Problem?, EDPS, 28 October 2019, Link.
Share this blog
- Adtech & martech
- Artificial intelligence
- Cloud computing
- Complex & sensitive investigations
- Cryptocurrencies & blockchain
- Data analytics & big data
- Data breaches
- Data rights
- Digital commerce
- Digital content risk
- Digital health
- Digital media
- Digital infrastructure & telecoms
- Emerging businesses
- Financial services
- KLick DPO
- Open banking
- Software & services