Further processing videosurveillance recordings for assessing performance of employees is inadmissible.

Personal Data Protection Commission has issued an opinion on the admissibility of the use of video surveillance to assess performance of the work duties of its employees for the purpose of the determination of their additional remuneration. The opinion was issued upon explicit request by a company that owns a chain of gas stations on. The company was developing a system in which, based on pre-defined criteria for the fulfillment of components of the work duties, bonuses will be provided to the employees. The goal of the Company was to have objective monitoring of the performance of its employees instead of relying on the subjective judgment of the managers.

During the recent years the Commission has issued a numerous opinions regarding videorecording and videosurveillance activities. These activities in Bulgaria are far more challenging from legal perspective than in other EU member states since besides GDPR toward this activity Bulgarian Constitution applies. Under Bulgarian Constitution (Art. 32, Para. 2) no one can be photographed, filmed, recorded or subjected to other similar actions without their knowledge or despite their express disagreement, except in the cases provided by law. In the same time, there is a substancial gap and only for a very limited number of purposes current Bulgarian legislation explicitly regulates the admissibility of videosurveillance activities. This results in the necessity of the Commission to often respond to matters related to such activities to balance the legislative gap with the society needs for using such technologies.
In the present case, the key arguments of the Commission for the inadmissibility of the activity are:

(1)    the gas stations are publicly accessible areas, so an unlimited number of different categories of data subjects will be affected, not only employees of the Company (customers, visitors, incl. children);

(2)    according to Art. 107f (107и), para. 3, item 7 of the Labour Code the employer can introduce, a monitoring system, if necessary, in the workplace and the written consent of the worker or employee has been obtained for this. The expression "if necessary" according to the Commission implies that the employer's objectives cannot be achieved by other means, which is not the case at hand.

(3)    the necessity to comply with the data minimization principle. The use of video surveillance for the purpose of monitoring how personnel perform their work duties should be avoided, except in exceptional cases - when required by legislation or in high-risk production activities (eg in the pharmaceutical, chemical industry, nuclear power, etc.).

(4)    the planned activity constitutes a form of further processing of personal data and the criteria of Art. 6, Para. 4 GDPR for compatibility between the initial and the subsequent purpose are not in place and in the same time it is not possible to obtain valid consent from the employees for such processing.

As a result, the Commission concludes that the evaluation of the personal performance of the employees is a further processing which is absolutely incompatible with the initial (security) purpose of the collection of the data and it is therefore, inadmissible.

Article provided by INPLP member: Desislava Krusteva (Dimitrov, Petrov & Co., Bulgaria)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)