Where an employer has reason to believe that an employee absent on sick leave is working elsewhere can it arrange for covert surveillance?
In considering whether or not to arrange covert surveillance to investigate employee misconduct, an employer must have regard both to art.8 of the European Convention on Human Rights, the right to respect for private and family life, and to its duties under the General Data Protection Regulation (2016/679 EU) (GDPR) to process information about the employee lawfully and fairly.
Covert surveillance will be justified only in exceptional circumstances. In López Ribalda and others v Spain 9 January 2018 ECHR, the European Court of Human Rights (ECHR) held that Spanish shop workers' right to privacy was violated when a supermarket installed hidden cameras without their knowledge to monitor employee thefts. The ECHR concluded that the Spanish courts had failed to strike a fair balance between the applicants' right to respect for their private life and the employer's interest in the protection of its property rights.
However, in City and County of Swansea v Gayle  IRLR 768 EAT, the Employment Appeal Tribunal (EAT) held that there had been no breach of art.8 when the employer arranged covert video surveillance of an employee whom it believed was regularly leaving work early (without permission) to go and play squash. It held that the employee could not have had a reasonable expectation of privacy because he had been filmed in a public space. It was also relevant that he had been filmed during working time and the employer was entitled to know where he was and what he was doing during working hours. The employer's use of covert video surveillance did not affect the reasonableness of its investigation and did not make the subsequent dismissal unfair.
The Information Commissioner's Employment practices data protection code, says that, before considering arranging for covert surveillance to be carried out on an employee, the employer's senior management should carry out an impact assessment to decide if and how to carry out the surveillance. The impact assessment should clearly identify the purpose behind the covert surveillance and consider alternative ways in which the surveillance might be carried out. The employer must have reasonable grounds for its belief in the employee's misconduct and must be satisfied that notifying the employee about the surveillance would prejudice detection of the malpractice. While the code relates to the Data Protection Act 1998, rather than the GDPR regime, it remains useful for employers, pending updated guidance from the Information Commissioner.
The code states that covert surveillance should be used only in exceptional circumstances where there is suspected criminal activity or equivalent malpractice. An evidence-based suspicion that an employee is claiming company sick pay when he or she is not really sick and is working elsewhere could be an example of this, but this would depend on the circumstances. For example, if the outside work is not incompatible with the reason for sickness absence and takes place outside the employee's normal working hours, it is unlikely to justify surveillance.
To show that the use of covert monitoring is justified and a reasonable part of the investigation, the employer must ensure that the surveillance does not go beyond that which is reasonably necessary to protect the business, ie it must be a proportionate response to the problem that it is seeking to address. Monitoring should be strictly restricted to the specific investigation being conducted and kept within a fixed time frame. The employer should set out clear rules limiting disclosure of and access to the information obtained. If information that is not relevant to the investigation is revealed in the course of surveillance it should be deleted. If the employer engages a private investigator, this should be under a contract that requires the investigator to collect information only in accordance with the employer's instructions and in a way that satisfies its obligations under the code.