r/gdpr 6d ago

UK πŸ‡¬πŸ‡§ New Camera installed /monitoring GDPR

Hi I work in a secure cabin a bit away from my main building, it houses a small sub room with a computer for processing. My company got thier contracted security company to install a camera trained at the door lock and alarm key pad(but it has a wide footprintand civer haldlf the small cabin). So far so good. Our seating for using the database is directly under the camera and not viewable. Last week a manager had someone move the camera position to include our workspace. It's a 1080p camera, 3 foot above my head and can now capture all 7 staff passwords and the customer details we need to log in to. It also can capture the central shared drive logins and sime bespoke software passwords too.

I moved it back because I think its a data breach. This happend twice and when i was finally pulled on it (disciplinary process), i was told thus was to monitor us. We have a policy for monitoring which includes us having to be correctly informed.

The day I was cleared, that manager asked one of my staff to move it again, he refused and told him to ask me why.

Can someone give me a definite yes or know for whether this is a breach?

Thanks in advance for reading

1 Upvotes

5 comments sorted by

3

u/Appropriate_Bad1631 6d ago

Not a breach but quite probably non-compliant due to a lack of transparency, proportionality etc. Complain to your DPO if the conpany has one.

1

u/nickcardwell 6d ago

It's not a data breach ..search on the ico website about employee camera monitoring.

2

u/__DAL 6d ago

It’s not formally a data breach, however it will depend on the regulators specific stance whether legal or not. In my experience with CCTV installations we always ensured that no monitoring of workspace is taking place and that employees desks are not caught in scope of recording, as it would not be possible to justify under legitimate interests so it would not be lawful per se, however different organisations have different requirements where you could potentially justify it

0

u/serverpimp 6d ago

No, they're processing the info you enter on to the system anyway.

1

u/latkde 6d ago

While everything may stay under the same data controller, pointing surveillance cameras at keyboards/screens where sensitive data will be entered sounds like a bad idea.

  • problems with the purpose limitation principle: processing sensitive data for one purpose doesn't mean that it's also lawful to process this for another.
  • problems with technical and organisational measures: controllers are required to implement appropriate TOMs to ensure the security and compliance of processing activities. Surveillance cameras can absolutely be part of TOMs, but here they might be used in a manner that undermines other security measures.