CCTV in the WC: yes or no?

Viewpoints
March 30, 2022
2 minutes

Is it ever justified to put CCTV cameras in the toilets?  Employers might argue that it’s needed in a small number of extreme cases.  But ask employees and they’ll say the whole thing stinks (sorry…).

Last week, Swedish furniture company Ikea announced the results of an internal investigation into the use of CCTV cameras in certain of the toilet areas of its distribution centre in Cambridgeshire.  According to the BBC, the cameras had been installed in 2015 following concerns that employees were taking drugs and supplying false urine samples in the toilets.  But when ceiling tiles became loose, other parts of the toilets — which reportedly did not include the cubicles — were visible.

It’s difficult to think of many situations in which the processing of CCTV footage in this context would be justifiable or fair for the purposes of European data protection law.  You might consider that the use of cameras in toilets to identify drug taking (in a work place that involves using heavy machinery) or bullying (in schools) sounds reasonable, given the potentially serious consequences of ignoring those activities.  And there's certainly a part of me — mostly the non-lawyer part — which gets that. 

The question is: does that potential benefit outweigh the significant intrusion that would be suffered by everyone else whose personal data are processed?  Whilst it possibly feels callous, the conclusion would almost always be “no”.  And if you choose to take a different view, you’ll need to have in place clearly reasoned and robust supporting documentation (LIA, DPIA) and ensure that the key GDPR principles — security, minimisation, retention, etc — have been thought through and firmly buttoned down.  

Interestingly, the ICO’s (pre-GDPR) employment guidance refers to “installing a hidden camera when workers are suspected of drug dealing on the employer’s premises”, suggesting that it may be receptive to such practices in limited cases (the surveillance, not the dealing).  Respondents to the ICO’s recent call for views on its updated guidance asked for clarification on the use of surveillance cameras in the workplace, so the ICO's position could be fleshed out in the months to come.

In the meantime, this remains one of those cases that makes data protection so interesting.  Even if you can make the argument that a practice may be (just about) lawful, the fact that it doesn’t feel right can be enough to stop the idea in its tracks.