Ask the Expert: CCTV in the Workplace – What Can Employers Legally Monitor?

Can employers use CCTV to check staff performance, listen to workplace conversations or investigate misconduct? Angela Clay speaks to Julie from HR:4UK about the rules employers need to understand before pressing play.

CCTV has become a familiar feature of everyday working life. From shops and restaurants to offices, warehouses and care settings, many businesses use cameras to protect their premises, safeguard employees and customers, and deter theft.

However modern CCTV systems can do much more than simply record pictures. Some capture sound, provide live access through mobile phones or allow employers to review what employees have been doing throughout the working day.

And that’s where things can become complicated.

I often speak to employers who assume that because they own the premises and have installed the cameras, they’re entitled to watch or listen to whatever has been recorded.

But is that actually the case? 

This month, I’m joined by Julie from our HR consultancy team to explore what employers can legally do with CCTV, where the boundaries lie and why getting it wrong can create problems far beyond the incident they were originally investigating.

Can employers legally install CCTV cameras in the workplace?

Julie: Yes, absolutely. CCTV can serve a perfectly legitimate purpose in the workplace.

Businesses may need cameras to protect their property, prevent theft, maintain security or safeguard employees, customers and visitors.

However, installing CCTV doesn’t give an employer unlimited rights to monitor employees.

Under UK data protection law, employers must have a lawful basis for using CCTV, identify a legitimate purpose and ensure that the monitoring is necessary and proportionate.

They also need to consider whether the same objective could be achieved through a less intrusive approach.

For example, cameras monitoring entrances, exits or areas where valuable equipment is stored may be relatively easy to justify but placing a camera directly above someone’s desk to monitor their every movement throughout the day is a very different proposition.

The important thing is understanding why the cameras are needed and making sure their use is appropriate.

Do employers need to register with the ICO if they have CCTV?

Julie: Generally speaking, yes, although there is an important distinction.

Businesses operating CCTV that captures identifiable individuals will usually need to register with the Information Commissioner’s Office (ICO) and pay an annual data protection fee, unless an exemption applies.

However, many employers will already be registered with the ICO because of the personal information they process as part of running their business.

If that’s the case, there’s no need for a separate CCTV registration or an additional fee.

What employers shouldn’t assume is that they’re automatically exempt simply because they’re a small business or only have a couple of cameras.

If you’re using CCTV for security or crime prevention purposes, you’ll generally be required to pay the annual data protection fee.

My advice would be to check that your ICO registration is current and that the appropriate fee has been paid. It’s a relatively straightforward compliance check, but one that can easily be overlooked.

Employers should also remember that if they operate CCTV which captures identifiable individuals, they are required to register with the Information Commissioner’s Office (ICO) and pay an annual data protection fee, unless an exemption applies.

Many businesses will already be registered with the ICO because they process other personal data, but employers should check that their registration is current and that the appropriate fee has been paid.

If employees know CCTV cameras are installed, does that mean the employer can use the recordings however they wish?

Julie: No, and this is probably one of the biggest misconceptions we encounter.

An employer might install CCTV primarily for security purposes, but that doesn’t automatically mean the recordings can be used to monitor productivity, listen to conversations or investigate every minor workplace issue.

Under data protection law, personal information must be collected for specified, explicit and legitimate purposes. Using it for a different purpose requires further consideration of whether that use is compatible with the original purpose or otherwise legally justified.

For example, if CCTV installed to prevent theft captures an employee apparently stealing company property, it may be reasonable to review that footage as part of an investigation.

However, routinely watching security recordings to see whether employees are working quickly enough is much harder to justify.

Employers should have a clear CCTV policy explaining why monitoring takes place, what is recorded, who can access the recordings and the circumstances in which footage may be reviewed.

And that policy needs to reflect what actually happens in practice.

What about CCTV cameras that record sound? Can employers legally listen to employees’ conversations?

Julie: This is where employers need to be particularly careful.

There’s a significant difference between recording video footage and recording people’s conversations.

Audio monitoring is generally much more intrusive because it can capture personal discussions, confidential information and conversations that have nothing to do with the employer’s legitimate business interests.

The Information Commissioner’s Office, or ICO, makes it clear that continuous audio recording in the workplace is unlikely to be justified in most circumstances.

Its guidance is that audio recording capabilities should generally be switched off by default and used only in exceptional circumstances where there is a clear justification.

For example, a business may have CCTV cameras in a kitchen, reception area or office for security or safeguarding reasons but that doesn’t automatically justify recording everything employees say throughout their working day.

And simply putting up a sign saying CCTV is in operation doesn’t necessarily provide sufficient information about audio recording.

If a system captures sound, employers need to be transparent about that and have a proper justification for why it is necessary.

My advice would be to check the actual capabilities of your CCTV system. Some employers may not even appreciate that audio recording has been enabled.

Do employers need employees’ consent before using CCTV?

Julie: Not necessarily, and in most employment situations consent is unlikely to be the most appropriate lawful basis.

That’s because there’s an imbalance of power between an employer and an employee. An employee may feel they have little choice but to agree.

Employers will often need to consider another lawful basis, such as legitimate interests, depending on the circumstances.

However, having a lawful basis doesn’t remove the requirement to be transparent.

Employees should understand that monitoring is taking place, why it’s necessary, what information is collected and how it may be used.

Employers should also assess the privacy risks associated with monitoring, including completing a Data Protection Impact Assessment (DPIA) where required.

It’s not enough to say, “Everyone knows the cameras are there.”

The real question is whether employees have been properly informed about the nature and extent of the monitoring.

Can an employer use CCTV footage as evidence in a disciplinary investigation?

Julie: Potentially, yes.

CCTV footage can be valuable evidence where an employer is investigating allegations of theft, violence, serious misconduct or other workplace incidents.

However, employers need to consider why the footage was originally collected, whether reviewing it for the investigation is lawful and proportionate, and whether employees were informed that recordings might be used for this purpose.

Let’s imagine a manager witnesses an incident involving two employees and subsequently reviews CCTV footage to establish exactly what happened.

That may be entirely reasonable, depending on the circumstances.

But it’s important to distinguish between reviewing a specific recording for a legitimate investigation and routinely trawling through hours of footage looking for evidence of employee wrongdoing.

Employers also need to remember that CCTV footage doesn’t always tell the whole story.

A recording might show what happened, but it may not explain the circumstances leading up to an incident.

Employees should still be given an appropriate opportunity to respond to allegations, and employers must follow a fair process.

CCTV should support a proper investigation, not replace one.

Can employers secretly record employees if they suspect misconduct?

Julie: Covert monitoring is something employers should approach with extreme caution.

There may be exceptional circumstances where covert monitoring can be justified, particularly where there are reasonable grounds to suspect serious wrongdoing and informing the employee would prejudice a specific investigation.

However, it must be strictly targeted, proportionate and limited to what is necessary.

It should not become a general exercise in secretly monitoring employees.

For example, an employer who suspects serious theft may be able to justify carefully controlled covert monitoring in particular circumstances, but secretly recording ordinary workplace conversations simply because a manager wants to know what employees are saying would be very difficult to defend.

Employers should always seek specialist advice before introducing covert surveillance.

Are there places where employers should never install CCTV cameras?

Julie: Employees have a reasonable expectation of privacy, even when they’re at work.

Cameras in toilets, changing rooms and other highly private areas will almost always be inappropriate, except in truly exceptional circumstances where a compelling justification exists and strict safeguards are in place.

Employers should also be cautious about monitoring staff rest areas or places where employees may reasonably expect a greater degree of privacy.

The location of a camera is just as important as the reason for installing it.

A camera overlooking a warehouse entrance raises very different privacy concerns from one recording employees throughout their lunch break.

The guiding principle is that monitoring should be targeted, necessary and proportionate.

If an employee asks to see CCTV footage of themselves, does the employer have to provide it?

Julie: In many cases, yes.

CCTV footage showing an identifiable employee is personal data, and employees have the right to request access to their personal information under data protection law.

This is commonly known as a Subject Access Request, or SAR.

An employer will usually need to respond within one calendar month, subject to the applicable rules and any permitted extension.

However, CCTV footage often includes other employees, customers or members of the public.

That means employers need to consider the rights of those individuals before disclosing the recording.

In some circumstances, it may be necessary to blur or redact third-party images or take other appropriate steps.

Employers should also think carefully about retention periods.

If footage is routinely overwritten after a short period, they need to ensure that relevant recordings are preserved when a valid request or investigation requires them.

It’s another reason why businesses should understand how their CCTV systems operate before a problem arises.

What are the risks if an employer gets CCTV monitoring wrong?

Julie: There are several.

Employees may complain to the ICO if they believe their personal information has been collected or used unlawfully.

Depending on the circumstances, inappropriate monitoring may also contribute to employment disputes, grievances, discrimination claims or allegations that the employer has breached the implied duty of mutual trust and confidence.

There are reputational risks too.

Employees who feel they’re being watched constantly, or that their private conversations are being recorded without proper justification, may lose trust in their employer.

And from a management perspective, excessive surveillance can create an unhealthy working environment.

I think it’s important to remember that good people management should be based on clear expectations, communication and accountability.

CCTV may provide useful evidence when something goes wrong, but it shouldn’t become a substitute for managing employees properly.

Finally, Julie, what advice would you give employers who already have CCTV installed?

Julie: I’d encourage them to review their arrangements rather than simply assume everything is compliant because the cameras have been there for years.

Start by checking why the cameras were installed and whether they’re still being used for those purposes.

Make sure employees have been properly informed about the monitoring, that the CCTV policy accurately reflects current practices and that access to recordings is restricted to appropriate individuals.

Check whether audio recording is enabled and, if so, whether there is a genuinely compelling reason for it.

Employers should also understand how long recordings are retained, how footage can be retrieved and how they would respond to a Subject Access Request.

And if they’re considering using CCTV footage to investigate an employee, I’d strongly recommend taking HR advice before doing so.

Finally, check that your business is appropriately registered with the ICO and that your annual data protection fee is up to date.

The key message is simple: owning the cameras doesn’t mean you have unrestricted rights to use the recordings.

CCTV can be an important tool for protecting a business, but it must be used responsibly, transparently and for legitimate purposes.

Thank you, Julie. I think that’s a really important distinction, particularly for smaller employers who may have installed CCTV years ago without giving much thought to how the technology, or their responsibilities, have changed.

It’s easy to assume that because something has been recorded, you’re entitled to watch it, listen to it or use it; but as we’ve discussed, that’s not always the case.

And sometimes, the safest approach is to seek advice before pressing play.

At HR:4UK, we help employers navigate the practical and legal challenges of workplace monitoring, disciplinary investigations, employee privacy and Subject Access Requests. If you’re unsure whether your CCTV arrangements are appropriate, or whether recordings can lawfully be used in an employment matter, speak to your HR:4UK consultant before taking action.