Workplace video surveillance: regulatory evolution and legal basis under the GDPR

Workplace video surveillance: regulatory evolution and legal basis under the GDPR

In recent years, regulations governing workplace video surveillance and employer monitoring through cameras have evolved significantly, especially following the application of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). These instruments have refined the traditional doctrine of the Spanish Constitutional Court, which, in its Judgment of March 3, 2016, accepted the possibility of recording employees without their prior consent, provided that the measure was necessary and proportionate to ensure compliance with the employment contract.

In that decision—concerning a Bershka employee who was dismissed after recordings demonstrated that she had repeatedly misappropriated cash—the Constitutional Court held that the installation of cameras in the cash register area was justified, suitable to verify the facts, necessary given the lack of less intrusive means, and proportionate as it was limited to a specific space. Consequently, it found no violation of the right to privacy enshrined in Article 18.1 of the Spanish Constitution, dismissing the employee’s constitutional appeal.

However, since the entry into force of the GDPR and the LOPDGDD, the legal assessment of such cases must be carried out under stricter parameters concerning personal data protection. Currently, the processing of images through video surveillance systems constitutes a processing of personal data under Article 4(2) of the GDPR, which requires compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, storage limitation and integrity and confidentiality, as set out in Article 5 of the GDPR.

In the employment context, the legal basis for processing is not the employee’s consent but rather the performance of the employment contract (Article 6(1)(b) GDPR) and, in certain cases, the legitimate interest of the employer (Article 6(1)(f) GDPR) in ensuring compliance with contractual obligations or guaranteeing the security of persons and property. This authority is supported by Article 20.3 of the Spanish Workers’ Statute (Estatuto de los Trabajadores), which allows employers to adopt monitoring and control measures to verify employees’ fulfillment of their duties, while always respecting their dignity.

Article 89 of the LOPDGDD specifically develops this provision, establishing that employers may process images obtained through cameras for the exercise of the control functions provided for in the Workers’ Statute, within the legal framework and its inherent limits. It also requires that employees be clearly and expressly informed in advance about the existence and purpose of such cameras, in accordance with Article 13 of the GDPR. Only in exceptional cases, where there are well-founded suspicions of unlawful behavior, may a reduced duty of information apply, with the mere placement of a visible notice being sufficient.

In all cases, the measure must be proportionate, necessary, and limited: cameras may only be installed in justified work areas, never in private spaces such as locker rooms or break rooms, and recordings must be retained for a maximum of 30 days, unless they are kept as evidence of an infraction (Article 22.3 LOPDGDD).

In conclusion, workplace video surveillance aimed at verifying compliance with employment obligations is legally justified without the need for employee consent, provided that the processing relies on a proper legal basis, respects the principle of proportionality, and complies with the duty of information. The Constitutional Court’s 2016 doctrine remains valid, but its application today must strictly adhere to the protective framework of the GDPR and the LOPDGDD, ensuring a real balance between the employer’s monitoring powers and the employees’ fundamental rights.