cctc and data controllers

[tickymicky]

My employers are registered with the I.C.O.for cctv use.However,I have had some information come to me regarding a person in a high position who "allegedly" misused the cctv .
Apparently,they trawled through hours of cctv footage to see if an employee had done anything wrong.It all stememd from the employee getting a complaint which was not a criminal offence.I believe the person looking through the cctv footage wanted to hopefully find something else against the employee,but failed to do so.
I am on the understanding that if a supervisor,manager,director etc want to look at cctv footage,then they have to be authorised, and registered on the Data Controllers Register,or am I incorrect?.Does a supervisor,manager etc automatically have authorsation to view cctv footage?.
Where i work,ther eare currently 2 registered data controllers.
I was also on the understanding that it was illegal to trawl through cctv footage, and the incident in question only must be checked with 10 minutes either side of the timeframe?
Has there been a breach of the Data Protection Act 1998/2018, and /or a breach of the GDPR??.
Any help would be greatly appreciated as I believe the empolyee is going to put in a grievance against the person concerned.If there is no DPA/GDPR breach, then I will have to inform the employee before this gets out of hand.

[Peridot]

Hi Tickymicky,

Does your organisation have a CCTV policy in place (ICO recommends there should be). Here is the ACAS guidance on monitoring employees in the workplace (CCTV specifics are further down the page):- http://www.acas.org.uk/index.aspx?articleid=5721.

I have tried to locate up-dated information from the ICO following introduction of GDPR in May last yea. Amazingly most of the information is still referring to Data Protection Act (which is still relevant of course). The government website is also not referring to GDPR in respect of CCTV employee monitoring.

CAB has some info here:- https://www.citizensadvice.org.uk/wo...oring-at-work/

All that I can glean as far as GDPR is concerned is that the purpose for which the ICO have been informed the CCTV is required in the organisation, is the only purpose it can be used, for example if it is in place to prevent theft then the quality should be clear enough to identify an individual and the footage made available to the Police if necessary. The Employment Practice Code produced by the ICO again is DPA geared. Here is the code of practice if you haven't seen it:- https://ico.org.uk/media/for-organis...tices_code.pdf

Following GDPR the same codes apply and are beefed up if anything. It is all very much geared to identifying the purpose for CCTV monitoring and only carrying out what would be considered reasonable for that purpose. I have been unable to locate anything specific about the data controller being the only persons able to view CCTV or the 10minutes either side of a suspected incident being a requirement.

In my opinion if the CCTV is being checked for the purpose it has been installed then it wouldn't be unreasonable for a senior person within the organisation to do the 'checking' a manager may be of sufficient standing depending on the organisation set up. Depending on the organisations legitimate purpose for monitoring the employees via CCTV and what policies are in place to ensure employees are aware of the monitoring and for what purpose will be the crux of whether the behaviour of the manager is legitimate or not.

Your best bet would be to contact the ICO here:- https://ico.org.uk/global/contact-us/helpline/ There may be others on the forum with more practical knowledge I'll tag rob who may have some ideas.

[tickymicky]

Peridot,thank you for the advice and links.Very helpful.I'll update as soon as i get any mor einformation regarding the incident.