Workers do not leave their rights at the door of the company. This lesson explains what the employer may and may not do with cameras, identification systems and email. The rules are in the Código do Trabalho (Articles 20 to 22) and in Lei n.º 58/2019 (Articles 19 and 28).
Remote monitoring
Article 20 of the Código do Trabalho says:
- the employer may not use remote monitoring equipment, using technology, to control the worker's professional performance (paragraph 1);
- its use is lawful when its purpose is the protection and safety of people and property, or when particular requirements of the activity justify it (paragraph 2);
- in those cases, the employer informs the worker of the existence and purpose of the equipment, and displays notices in the places concerned such as "This place is under closed-circuit television surveillance", with the identifying symbol (paragraph 3).
A camera in a shop to prevent theft is, in principle, acceptable. A camera to count the minutes each person spends at the counter in order to assess their output is not.
Where cameras may not point
Article 19(2) of Lei n.º 58/2019 prohibits cameras directed at:
- public roads and neighbouring properties, except for what is strictly necessary to cover the entrances to the building;
- the area where PINs are typed at cash machines or payment terminals;
- areas reserved for customers where privacy must be respected, such as toilets, waiting rooms and fitting rooms;
- areas reserved for workers, such as eating areas, changing rooms, gyms, toilets and rest areas.
Where video surveillance is allowed, sound may not be captured, except when the premises are closed or with the CNPD's prior authorisation (paragraph 4). Since the GDPR, the employer no longer asks the CNPD for authorisation to install cameras: the CNPD considers that requirement of the Código do Trabalho incompatible with the GDPR. The employer remains responsible for the rules and must have a lawful basis.
What may be done with the images
Article 28(4) of Lei n.º 58/2019 says that images and other data collected by these means may be used only in criminal proceedings. They may also serve to establish disciplinary liability, to the extent that they are used in the criminal proceedings (paragraph 5). Watching recordings "to see what happened" without authorisation, or showing them to colleagues, is misuse. Access is reserved for those who are authorised for it.
Biometric data
Fingerprint, facial or iris recognition are biometric data. Processing workers' biometric data is legitimate only for attendance control and for access control to the employer's premises. Only representations of the biometric data may be used, and the collection must not allow reversibility (Article 28(6) of Lei n.º 58/2019). The Código do Trabalho (Article 18) also requires that the data be necessary, adequate and proportionate.
Messages, email and browsing
Article 22 of the Código do Trabalho guarantees the worker privacy and confidentiality as to the content of personal messages and access to non-professional information that they send, receive or consult, in particular by email. The employer may, however, lay down rules on the use of the company's means of communication, for example prohibit or limit personal use of email. What the employer cannot do is read personal messages.
Good practice
- Read the company's rules on email, internet and mobile phones. If there are none, ask for information.
- Keep personal email separate from work email wherever possible.
- Anyone with access to images or access logs uses them only for the intended purpose.
Summary: monitoring to protect people and property is possible, with information. Monitoring to assess performance is not. Personal messages stay confidential.