CCTV in Workplace Canteen Ruled GDPR Breach

The Information and Data Protection Commissioner issued a decision finding that a controller violated the General Data Protection Regulation by installing CCTV cameras in its workplace canteen. The controller claimed the surveillance was justified by legitimate interest under Article 6(1)(f) to address documented patterns of workplace misconduct, including physical altercations, bullying, harassment, and alcohol-related incidents. The Commissioner rejected this justification, finding that the processing was excessive and not the least intrusive means available, particularly in an area designated for employee rest and breaks. The CCTV footage was accessed following an internal investigation and used to support disciplinary action against the complainant for consuming wine during his break time.

Employers across all sectors that operate CCTV in or near employee rest areas should review whether their surveillance measures can satisfy the necessity and proportionality requirements under GDPR. The IDPC's decision clarifies that legitimate interest cannot justify continuous monitoring of employees during rest periods without demonstrating that less intrusive alternatives would be insufficient. Organisations should ensure their privacy notices, data protection impact assessments, and legitimate interest assessments adequately address monitoring in sensitive areas such as canteens, break rooms, and changing facilities.