Employers : think carefully before using covert means to monitor employees' activities at work -- DPP1(1), 1(2) and 5
It was reported in local newspapers that pinhole cameras were found installed by a government department in the working areas, near the toilets and changing rooms of its regional office. The department's response was that pinhole cameras were installed for the purpose of detecting crime as a result of a series of theft cases occurring in the office. The department believed that the use of pinhole cameras was an effective way for them to identify the culprit(s) and gather evidence.
Findings of the Privacy Commissioner
Site investigation conducted by the Privacy Commissioner's officers revealed that six pinhole cameras were installed at different working locations of the office. The cameras were discreetly concealed inside a socket-like box and it was difficult for anyone to notice their existence.
Under the "Privacy Guidelines: Monitoring and Personal Data Privacy at Work" issued by the Privacy Commissioner, covert monitoring is not to be used unless justified as last resort measures and being absolutely necessary in detecting or gathering evidence of unlawful activities, and the monitoring should be limited in scope and duration. Further, the employer should formulate a clear employee monitoring policy by making known and communicating to the employees the purposes of monitoring, the circumstances under which monitoring will take place and the kind of personal data that will be collected.
Though the department do have a legitimate purpose to protect its and its customers' property from theft, the evidence available did not show the existence of a risk of loss to such extent as to justify the engaging in vast scale video monitoring activities using pinhole cameras which was highly privacy intrusive. The dimension and extensiveness of the monitoring activity carried out was out of proportion to attaining the purpose of collection, and the department was intent upon engaging in continuous and universal preventive monitoring. The Commissioner was therefore of the view that the engaging in employee monitoring activities in such dimension and scale by the department to collect evidence of crime, given the vast amount of personal data that could be captured without the knowledge of the employees, was excessive and thus in breach of DPP1(1).
There was no evidence showing that the department had given due consideration to the use of other less privacy intrusive alternatives or that the use of overt means would necessarily frustrate the purpose of collection. The universal and continuous covert monitoring without a definite plan or policy for its duration is highly privacy intrusive, aggravating the harm, if any, that may be inflicted upon innocent parties. The Commissioner found that the covert monitoring was carried out in an unreasonable and unfair manner, contravening the requirement of DPP1(2).
Action by the Privacy Commissioner