Mihaela Murariu, Attorney at Law at Grecu Partners Business Law Firm, analyzes the risks that companies who use video surveillance on their employees are facing in Romania.

In the modern context, the use of video surveillance systems in professional environments has become an increasingly widespread practice with purposes such as asset protection, employee safety, or monitoring productivity. However, implementing these measures raises essential questions regarding employees’ right to privacy. The General Data Protection Regulation (GDPR) and national legislation, specifically Law no. 190/2018, impose clear and strict rules to prevent the abusive use of video surveillance. Employers must comply with the legal conditions to ensure that video monitoring in the workplace aligns with GDPR provisions, protecting both the employer’s interests and the employees’ fundamental rights. Current practices significantly impact employees’ privacy. The goal of the regulations is to safeguard employees’ right to privacy and limit the abusive processing of personal data.

Thus, according to Article 5 of the GDPR (EU Regulation 2016/679), the processing of personal data must adhere to the following principles:

• Lawfulness and transparency – Surveillance must have a clear legal basis and be transparently communicated to employees.
• Specific purpose – Monitoring must be justified by legitimate interests, such as security of assets or employee protection.
• Data minimization – Processing must be limited to what is strictly necessary; invasive methods such as audio recording should be avoided if the purpose can be achieved through other means.
• Limited storage duration – Collected data must not be kept for more than 30 days, except in well-justified cases.

A recent case investigated by the National Supervisory Authority for Personal Data Processing (ANSPDCP) illustrates the consequences of failing to comply with applicable personal data processing legislation. According to a statement published on the ANSPDCP website, the Cluj-Napoca Public Transport Company was fined 19,902 lei (4,000 euros) for the illegal use of audio-video surveillance systems in drivers’ cabins. Following the complaints received, ANSPDCP found that the audio-video surveillance systems installed in the drivers’ cabins enabled real-time online monitoring of employees’ images and voices. The surveillance was carried out without a clear and legal justification, violating the principles of legality, transparency, and purpose limitation. The collected data (images and sounds) were even used for disciplinary sanctions against employees, a purpose not initially declared. This practice affected not only employees but also passengers, as the surveillance systems collected sounds/voices from them.

On the other hand, it is accepted that the absence of video surveillance tools can lead to several unfavorable consequences for both employers and employees. Depending on the nature of the activity, companies may face challenges such as managing security, preventing theft, identifying causes of workplace accidents, and addressing vulnerabilities like financial losses caused by thefts or employee negligence. Therefore, the purpose of processing personal data through video surveillance means is closely related to the risks associated with workplace activities. Moreover, the legitimacy of data processing lies precisely in the purpose and risks identified by each operator, which is why only strictly necessary data should be collected to achieve the intended purpose.

In Romania, Law 190/2018 provides additional clarifications regarding employee monitoring:

• Justification of the employer’s legitimate interest – The employer must demonstrate that surveillance is necessary and proportionate to the intended purpose.
• Prior notification of employees – Employees must be clearly informed about the existence, purpose, and duration of monitoring.
• Consultation with the union/employee representatives – Any decision to install surveillance systems must be discussed with social partners.
• Choosing less invasive methods – If the purpose can be achieved through other means, video or audio monitoring must be avoided.
• Limitation of data storage – The maximum duration for keeping images is 30 days, except in justified cases.

By conducting impact assessments, the operator ensures compliance with data protection regulations and those applicable to the protection of the rights and freedoms of the data subjects (employees).

In conclusion, video surveillance systems must be implemented with maximum responsibility and only under the conditions imposed by law. The case of the Cluj-Napoca Public Transport Company highlights how easily employees’ and other data subjects’ rights can be violated through abusive practices. Employers are required to demonstrate the necessity of surveillance, clearly inform affected individuals, and avoid invasive methods that could jeopardize the right to privacy. Alternative, less intrusive solutions must always be analyzed before implementing a monitoring system.

For further information or any additional inquiries, please contact office@grecupartners.ro.

*This is Partner Content.

(Photo source: 135335589 © Chernetskaya | Dreamstime.com)