Data Protection Commission Releases Annual Report

The Data Protection Commission has issued the first report since the introduction of the General Data Protection Regulation (the “GDPR”) in May 2018. We have set out below some of the more interesting statistics from the Report along with a report on a case study which may be of interest to employers. Key Statistics from 25 May 2018 – 31 December 2018

• 2,864 – Total Complaints received by the Data Protection Commission
• 3,542 – Valid Data Security Breaches recorded
• 31,000 – Contacts made with Information and Assessment Unit

Case Study The Report includes a number of case studies. One of which will be of interest to employers is as follows: Provision of CCTV footage by a bar to an employer – A complaint was made about a city-centre bar for disclosing personal data to his employer without his consent. During a workplace social event which took place in a bar, an incident occurred between two employees. One employee was alleged to have committed a serious assault against the other employee. The incident was reported to An Garda Siochána and the employer organisation subsequently contacted the bar seeking a copy of the footage. The footage was provided to the employer organisation’s HR Manager who used the footage in order to address the matter with the employee. A complaint was made by the employee that the bar should not have released the CCTV footage as it was his personal data and they did not have his consent to do so, furthermore he alleged that the bar did not have proper signage informing members of the public that CCTV recording was taking place. In investigating the complaint, the DPC considered whether the provision of the CCTV footage to a third party was necessary for the purposes of the legitimate interests of the third party and whether it would prejudice the fundamental rights of the data subject pursuant to Section 2A(1)(d) of the Data Protection Acts 1988 and 2003. The DPC found that a refusal by the bar to allow the employer access to the footage would have impeded a full internal investigation of an alleged serious assault and the employer’s ability to protect its employees’ welfare. Therefore the DPC considered it to be reasonable, justifiable, and necessary for the bar to have provided the footage to the employer and that the employer’s legitimate interest took precedence over the rights and freedoms of the employee particularly where the information was not sensitive data and the processing was not excessive i.e. it was being used in a particular context. Furthermore, there was available signage which alerted patrons to the use of CCTV in the bar for the purpose of protection of staff and customers and the prevention of crime. Therefore the complainant was deemed on notice of the CCTV use. Ultimately the decision was made by the DPC that the bar was within its rights to release the CCTV footage to the employer. To view a full copy of the Report click here