In its recently issued opinion Serbian DPA gave partial answer to the question whether an employer can use video surveillence to monitor if its employees abide by preventive measures and wear protective masks at work during Covid-19 pandemic.
At the beginning of the opinion, the DPA stated that it is not in its authority to issue an opinion whether video surveillance can be used to monitor abidence by the measure of wearing protective masks during Covid-19 pandemic and that such opinion should be sought from the Ministry of Labour, Employment, Veteran and Social Affairs, since the question concerns data processing in the field of employment. Notwithstanding, the DPA has stated that when it comes to video surveillance according to the Serbian Law on Personal Data Protection (hereinafter: “LPDP”) a controller should carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before it starts with the processing, in order to determine technical and organisational measures that will be taken in order to protect personal data.
Furthermore, the DPA underlined that each and every data processing must be done in accordance with the appropriate legal basis and regular, explicit, justified and lawful purpose. The processed data must be appropriate, relevant and limited to what is necessary in relation to the purpose of the processing. This means that in the situation of video surveillance, employer has to bear in mind that employees have the right to privacy even in the work environment. In that sense, the DPA emphasized that employees will not always expect the employer to monitor them during the performance of work, i.e. the supervision of employees during their work performance is allowed only exceptionally in certain situations and for justified purposes (for example, monitoring of employees who work in the bank's branches at the cash register, in which case video surveillance may be installed only in the cash register area monitoring exclusively handling the cash). This is the reason why the employer should consider the necessity and proportionality of the intended processing in relation to the given circumstances, including the possibility to achieve the appropriate result in a less intrusive way.
In the end, the DPA in a more general way stated that whenever employer uses video surveillance there is a requirement to give to the employees precise and clear notice in respect to all relevant aspects of the processing.
Even though the DPA does not give a clear and precise answer, the overall conclusion which can be drawn is following. Namely, introducing video surveillence in order to monitor whether employees wear masks is not allowed if there is another mean that is less intrusive, efficient and undoubtedly achieves the same goal. This measure may be, for example, engagement of Covid wardners who will control whether employees wear masks and keep the distance, and whether other epidemiological measures are respected. However, in our opinion in certain cases introducing video surveillence may be allowed, but the employer would need to obtain the approval from the DPA. For example, this may be the case when there is a large number of employees and a large number of offices so the purpose cannot be achieved by other means, such as hiring a Covid wardner. This would require submitting to the DPA a reasoned request for the introduction of video surveillance with a statement of purpose, a detailed explanation that the employer as controller considered all other means which proved ineffective, has performed a risk assessment and found that the only solution is video surveillance.
Article provided by: Ana Popović (Živković Samardžić, Serbia)
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)
