Video surveillance in the workplace: legal regulations under GDPR

Mihaela Murariu, Attorney at Law at Grecu Partners Business Law Firm, analyzes the risks that companies who use video surveillance on their employees are facing in Romania.

In the modern context, the use of video surveillance systems in professional environments has become an increasingly widespread practice with purposes such as asset protection, employee safety, or monitoring productivity. However, implementing these measures raises essential questions regarding employees’ right to privacy. The General Data Protection Regulation (GDPR) and national legislation, specifically Law no. 190/2018, impose clear and strict rules to prevent the abusive use of video surveillance. Employers must comply with the legal conditions to ensure that video monitoring in the workplace aligns with GDPR provisions, protecting both the employer’s interests and the employees’ fundamental rights. Current practices significantly impact employees’ privacy. The goal of the regulations is to safeguard employees’ right to privacy and limit the abusive processing of personal data.

Thus, according to Article 5 of the GDPR (EU Regulation 2016/679), the processing of personal data must adhere to the following principles:

• Lawfulness and transparency – Surveillance must have a clear legal basis and be transparently communicated to employees.
• Specific purpose – Monitoring must be justified by legitimate interests, such as security of assets or employee protection.
• Data minimization – Processing must be limited to what is strictly necessary; invasive methods such as audio recording should be avoided if the purpose can be achieved through other means.
• Limited storage duration – Collected data must not be kept for more than 30 days, except in well-justified cases.

A recent case investigated by the National Supervisory Authority for Personal Data Processing (ANSPDCP) illustrates the consequences of failing to comply with applicable personal data processing legislation. According to a statement published on the ANSPDCP website, the Cluj-Napoca Public Transport Company was fined 19,902 lei (4,000 euros) for the illegal use of audio-video surveillance systems in drivers’ cabins. Following the complaints received, ANSPDCP found that the audio-video surveillance systems installed in the drivers’ cabins enabled real-time online monitoring of employees’ images and voices. The surveillance was carried out without a clear and legal justification, violating the principles of legality, transparency, and purpose limitation. The collected data (images and sounds) were even used for disciplinary sanctions against employees, a purpose not initially declared. This practice affected not only employees but also passengers, as the surveillance systems collected sounds/voices from them.