Yes. But not before you have done three things: set a specific purpose and legal basis, carried out a data protection impact assessment, and informed employees against signature. The third step is the one almost nobody takes in practice, and it is precisely because of it that a recording meant to serve as evidence becomes evidence of an infringement. Employee consent replaces none of these three steps and in most cases is not valid. Below \u2014 why, and what to do instead.<\/p>\r\n
Before buying the equipment, you have to answer what it is for. \u201cSo that we can see\u201d is not a purpose. A purpose is, for example, protecting property in a warehouse at night, or monitoring vehicle routes during working hours.<\/p>\r\n
In employment relationships, the legal basis is almost always legitimate interest \u2014 Article 6(1)(f) of the General Data Protection Regulation (GDPR). This basis requires the employer's interest to be weighed against the employee's rights and freedoms, and that balancing must be kept in writing. If the same purpose can be achieved by a less intrusive means, legitimate interest prevails less often.<\/p>\r\n
The practical line we give clients: GPS that operates outside working hours, and a camera permanently pointed at an employee's workstation, are the two measures that are hardest to defend. A limit on time or on direction often resolves the whole question.<\/p>\r\n
Systematic monitoring of employees is exactly the case for which Article 35 GDPR is designed. The assessment is not a formality \u2014 it describes the purpose, the means, the scope, the risk to employees and how that risk is mitigated.<\/p>\r\n
In practice, the assessment often changes the answer as well. Until the risk is written down, the camera looks harmless. Once it is written down, it turns out that the camera also films the rest area, and that the recordings are seen by three people who have no need to see them.<\/p>\r\n
Here there is a separate Lithuanian rule that is not in the GDPR, and not knowing it costs the most. Article 5(4) of the Law on the Legal Protection of Personal Data (ADTA\u012e) provides:<\/p>\r\n
\r\n\u201cWhere video and\/or audio data are processed at the workplace and in the premises or territories of the controller where its employees work, or where personal data related to the monitoring of employees' behaviour, location or movement are processed, those employees must be informed of such processing of their personal data against signature or by other means proving the fact of their having been informed, by being provided with the information referred to in Article 13(1) and (2) of Regulation (EU) 2016\/679.\u201d<\/p>\r\n<\/blockquote>\r\n
Three points follow from this sentence. First, it also covers monitoring of location and movement \u2014 and therefore GPS, not only cameras. Second, employees must be informed against signature or by some other means that can be proven \u2014 a sign on the wall does not do that. Third, what must be provided is not a general phrase but the full information listed in Article 13(1) and (2) GDPR: who the controller is, what the purpose and legal basis are, to whom the data are disclosed, how long they are kept, and what the employee's rights are.<\/p>\r\n
One case: the consent annex we did not draft<\/h2>\r\n
A client came to us with a specific task \u2014 to draft a consent annex for employees to sign for individual monitoring situations. The task was clear and the work was small.<\/p>\r\n
We did not draft the annex, and we explained why. An employee is legally and economically dependent on the employer and therefore cannot give consent freely. The exception is narrow: only where the consent is of such minor significance that no doubt could arise as to free will and the ability to withdraw it without adverse consequences. Monitoring does not fall within this exception.<\/p>\r\n
We said plainly that by drafting such an annex we would risk committing an infringement rather than avoiding one. A document that looks like protection becomes, during an inspection, evidence that the wrong legal basis was chosen. We chose a different basis \u2014 legitimate interest \u2014 and drafted what was actually needed: a written balancing of interests and a notice to employees acknowledged against signature.<\/p>\r\n
This is a case in which we told the client not to do what they had asked for. We say so openly, because cases like this are frequent in this area.<\/p>\r\n
One case: remote work<\/h2>\r\n
This is how we answered a real enquiry about monitoring employees who work remotely.<\/p>\r\n
First, the organisation must have adopted a remote working procedure. Without it there is nothing to monitor \u2014 nothing is written down about what the employee has to comply with.<\/p>\r\n
Second, if the employer wants to check whether the employee complies with that procedure, or determines the employee's location, a data protection impact assessment must be carried out and the employee must be informed that they are or may be monitored. Determining location falls squarely within the wording of Article 5(4) quoted above.<\/p>\r\n
A practical note: most questions about monitoring remote work are resolved in the procedure document, not in software. Once availability hours and results are agreed, the need for monitoring usually disappears.<\/p>\r\n
The most common mistake<\/h2>\r\n
The mistake is not the camera, and it is not the GPS. The mistake is that nobody informs employees against signature.<\/p>\r\n
The consequence is the exact opposite of what was intended. The recording was made so that there would be evidence if it was ever needed. Without the notice, the same recording becomes evidence of an infringement \u2014 it shows both that monitoring took place and that the employee was not informed of it in the way the law requires.<\/p>\r\n
That is why the order matters. Documents first, equipment only afterwards. The reverse order costs more, because by then the equipment has to be justified.<\/p>\r\n
A short checklist<\/h2>\r\n
Is the purpose written down in one sentence? Is there a written balancing of interests under Article 6(1)(f) GDPR? Has an assessment been carried out under Article 35 GDPR? Have employees been informed against signature under Article 5(4) ADTA\u012e, with the information listed in Article 13(1) and (2) GDPR? Is it defined who sees the recordings and how long they are kept? Are newly hired employees informed in the same way?<\/p>\r\n
In practice, the last point is the first to slip. Employees are informed once, when the system is introduced, and a year later half the team are new people.<\/p>\r\n
How to start<\/h2>\r\n
Write to us about what you want to monitor and why, and where those measures would be. We will tell you whether the legal basis will withstand an inspection, what needs to be prepared and in what order. The first assessment is free of charge.<\/p>\r\n
Tel. +370 5 212 1506, email info@linden.lt<\/p>\r\n