Background information
- Date of final decision: 6 October 2022
- Controller: employer in private sector
- Legal Reference: National Law (Personal Data Protection Act)
- Decision: Order to comply
- Key words: Video surveillance in work areas
Summary of the Decision
Origin of the case
The data controller, engaged in metal machining, installed video surveillance inter alia in work areas. According to the national law, video surveillance within work areas may only be implemented in exceptional cases when it is necessarily required for the safety of people or property or to protect secret data and business secrets. Video surveillance in work areas can be implemented exceptionally, when it is absolutely necessary for safeguarding the legal assets and this purpose cannot be reached by milder measures.
Key Findings
The controller stated that cameras were installed for the purpose of monitoring the proper use of machinery, preventing serious injury or death and major damage to property. Video surveillance is aimed at distracting the workers from carrying out their tasks in contravention to the workplace safety rules. The controller also claimed that video surveillance enables him to determine the causes of accidents which prevent future accidents.
The Slovenian Supervisory Authority, SA found that the cameras were recording the entire working area.
Decision
Slovenian SA emphasised that other factors, which relate to workplace safety need to be considered. Employer is obligated to ensure workplace safety and monitor the compliance of work tasks with working safety rules. Nevertheless, for achieving this goal he is not permitted to use all means at his disposal, disregarding the rights and freedoms of individuals. The controller did not demonstrate that safety of people and property cannot be ensured with milder measures.
Slovenian SA confirmed that it is possible to reconstruct the accidents and injuries when working with machinery by examining video recordings, but highlighted that this is not the only way to determine course of events. For example, the controller can collect statements of employees and use the data, processed by the machinery itself. The risks posed by machine operation and measures to be taken to prevent the danger are well-known to the employer and to workers. Risks are not detected only at the time of reconstruction. Also, the reconstruction happens after the accident has already occurred. For preventing accidents, the employer has to inform and alert the employees of correct use of machinery and implementation of prescribed measures.
Slovenian SA ordered the controller to remove the cameras monitoring the work area, since it did not demonstrate the absolute necessity of such a measure.
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.