Abstract

The article presents video monitoring, as regulated by the Act of 26 June 1974 – Labour Code, in the context of the employer's obligations as a data controller. The author focuses on presenting monitoring as a designed practice of processing personal data meeting the principles and requirements set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The hitherto employer experience with workplace monitoring indicates that the lack of regulation in this area has been causing a significant number of problems. Hence, the statutory regulation of the principles of workplace monitoring should be regarded as a step in the right direction. At first glance, it may seem that the regulation in the Labour Code is skimpy. However, taking into account the fact that monitoring also, and perhaps above all, involves the practice of data processing, the reading of the Labour Code regulations together with the provisions of the General Data Protection Regulation would allow, in the author’s opinion, for a more complete understanding of the problem.

It should be emphasized that the implementation of video monitoring at a workplace cannot be based solely on installing cameras. It is the duty of every employer not only to protect their company, but also to ensure appropriate employee protection. Hence, the provisions of Art. 22² and 22³ of the Labour Code should be read as an exercise of the national legislator’s powers to ensure the appropriate protection of rights and freedoms of employees in the processing of their personal data. These provisions, however, are not exhaustive. The General Data Protection Regulation stresses the independence of data controllers in planning and preparing such technical, IT or organizational security measures that would be adequate for the operations undertaken on personal data, as well as the adopted objectives. Therefore, it is the employer, as a data controller, who is responsible for proper preparation for monitoring.