Start of main content

López Ribalda II, the use of video surveillance cameras in labour relations: can the duty of information be dispensed with?

| News | Employment Law and Social Security

Juan Pascual analyses the issue of the use of video surveillance cameras in the workplace in contrast to the rights of information and protection of the privacy of workers

In recent years we have witnessed a constant coming and going of judicial decisions of the European Court of Human Rights ("ECtHR") in the field of data protection which, fundamentally, have their cause in the extraordinary reviews carried out by the Grand Chamber of the judgments issued by the different sections of the Court.

In this sense, the Grand Chamber of the ECtHR issued a judgment on 5 September 2017 (LAW 114768/2017) in the case Bărbulescu versus Romania ("Bărbulescu II"), stating in that decision that in order to be able to review employees' e-mails, it was necessary for them to be aware, by means of a prior notice or communication, that their equipment could be monitored. This statement rectified the criterion set forth on January 12, 2016 (LAW 9953/2016) by the Fourth Section of the same Court ("Bărbulescu I"), where it had been held that the measures to review the employees' e-mails without prior notice were proportional to the specific circumstances of the case.

But once again, the Grand Chamber of the ECtHR revoked the criterion previously set by Section Three of the same Court. Thus, on 9 January 2018 (LAW 5/2018) the ECtHR issued the Ruling López Ribalda and others versus Spain ("López Ribalda I") in which it concluded that the applicants had the right to be informed "in advance in an express, precise and unequivocal manner" of "the existence of a file or processing of personal data, of the purpose of the collection of such data and of the recipients of the information".

On 17 October 2019 (LAW 141924/2019), the Grand Chamber of the ECtHR once again handed down a judgment in the case of López Ribalda and others versus Spain ("López Ribalda II"), revoking the criterion set out in the previous one. This ruling is very relevant in dealing with one of the most controversial issues analysed by judicial and scientific doctrine: the scope of workers' right to information, and the consequent labour obligation in the field of video surveillance at work.

Taking advantage of the fact that this December is the first year since the publication of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights (LA Ley 19303/2018) ("LOPD"), the object of this article will be to analyse the state of the question for the use of video-surveillance cameras after the publication of López Ribalda II, focusing on its most conflictive aspect: the duty of information in light of its configuration in the current LOPD.


1.1.- Brief summary of the doctrine of the Constitutional Court

Historically, the Constitutional Court ("TC") has dealt with the conflict that arises between the faculty of corporate control through video surveillance that has its origin in art. 20.3 of the ET (LA Ley 16117/2015), - a precept that is included at a constitutional level in the freedom of enterprise and private property ex arts. 38 (LA LEY 2500/1978) and 33 of the Spanish Constitution (LA LEY 2500/1978) ("CE"), respectively- and the fundamental rights ("DDFF") of workers; especially, the rights to privacy and personal data protection. Not in vain has the TC on numerous occasions pointed out the full effectiveness of the DDFF in the framework of the employment relationship.

Although these conflicts have been resolved by the highest constitutional interpreter, however, the responses have not always been the same. Specifically, to date, the TC has issued four rulings in which video surveillance has been analysed: (i) Ruling 98/2000, of 10 April (LAW 78877/2000) - La Toja Casino case; (ii) Ruling 186/2000, of 10 July (LAW 9715/2000) - Ensidesa case; (iii) Ruling 29/2013, of 11 February (LAW 11227/2013) - University of Seville case; and (iv) Ruling 39/2016, of 3 March (LAW 11275/2016) - Bershka case. In the latter two, the right to data protection is analysed, while the first two only analyse the right to privacy.

From all these pronouncements, it can be seen that the doctrine of the Court has been limited to assessing whether the control system implemented by the company exceeds the triple judgment of proportionality or triple canon of constitutionality.

1.2.- The most controversial aspect: the right of information

As anticipated, the weighting of the right to data protection, as a fundamental right of workers, has been subject to continuous changes in criteria.

Evident proof of this are the Rulings of the Constitutional Court (STC) 29/2013, of 11 February (LA Ley 11227/2013) -Subject University of Seville- ("STC 29/2013"); and the subsequent 39/2016, of 3 March -Subject Bershka- (" STC 39/2016 (LA Ley 11275/2016) "). These resolutions reached conclusions that have generated a great deal of legal uncertainty given the flexibility that occurs in the interpretation of the duty to inform, when barely three years have passed between the two pronouncements, and furthermore, without any normative change having occurred during that period that could justify the modification of the criterion.

In short, the constitutional debate on the subject of data protection in the labour field had as its starting point STC 29/2013; which considered that the duty of information was included within the "essential core" of the right to data protection, and based on this reasoning, came to make a rigorous interpretation of the duty of information provided for by law. Specifically, the TC demanded "prior and express, precise, clear and unequivocal information to the workers of the purpose of control of the work activity to which the collection could be directed". For this reason, we were faced with a very rigid interpretation, which meant that failure to comply with the duty to inform determined the illegitimate use of the images recorded for sanctioning purposes.

However, the STC 39/2016, subsequently understood the legality of the obtaining of images by the employer through the corresponding video-control, on the basis of giving generic and not specific information to the employees through the information badge regulated in instruction 1/2006 (LA Ley 11881/2006) of the Spanish Data Protection Agency ("ADPD") that informs of the existence of cameras in the workplace.

At this stage, it seems clear that the most conflictive point in terms of data protection is the duty of information to carry out labour control, with three scenarios: i) the absolute omission of the duty of information - hidden cameras; ii) information through a generic information sign - security cameras; or, finally, iii) prior and express, precise, clear and unequivocal information - cameras for labour control purposes.

On this point it is important to remember that the Constitutional Court (TC) understands that the fundamental right to data protection established in article 18.4 of the EC (LAW 2500/1978) seeks to guarantee all citizens the power to control their personal data, its use and destination, with the aim of preventing its illicit trafficking and that which is harmful to the dignity and rights of the affected party. In other words, "this power of disposal over one's own personal data is worthless if the affected party does not know what data is held by third parties, who holds it, and for what purpose".

On the basis of the above, the EC has concluded that the duty to inform forms part of the "essential content" of the right to data protection. Furthermore, there is scientific doctrine that points out that prior information forms an indispensable part of the content of the right to data protection, which is why it seems that it is not possible to dispense completely with the duty of information without infringing this fundamental right.


In López Ribalda II, the Grand Chamber has rectified its criteria regarding the use of temporary hidden video-surveillance cameras by companies.

The case began with the Ruling of the Social Court No. 1 of Granollers of 20 January 2010, which was confirmed by the Ruling of the High Court of Justice of Catalonia of 24 February 2011 (Rec. 4294/2010 (LAW 45909/2011)). The Catalan Chamber considered the video-surveillance evidence obtained by the company to be lawful and, consequently, declared that the right to data protection of the employees had not been infringed by dismissing the dismissal complaint filed by one of the dismissed workers.

The dismissed workers in question were serving as cashiers in a supermarket, and the director of the centre had detected certain irregularities between stock levels and sales figures. In order to find out the origin of these irregularities, video-surveillance cameras were installed; some were visible - focusing on the doors - to record possible customer robberies, and others were hidden - recording the cash registers.

The company informed the workers about the installation of the visible cameras, but not of the hidden cameras; which caught several workers appropriating products without paying them, and whose thefts represented a plundering of more than 80,000 euros for the employer.

When all the instances were exhausted, the employees appealed to the ECtHR, whose Third Section considered that their right to data protection had been violated, since the test of proportionality had not been passed, since the suspicion of theft was of a general nature, and all the workers had been monitored for several weeks covering the entire working day.

Later, on 17 October 2019 (LAW 141924/2019), in the same case, the Grand Chamber of the ECtHR rectified its criterion, considering that there had not been a breach of the right in solfa and that the Spanish courts had carried out an adequate weighting between the right of the appellants to the protection of their data and the interest of the employer in protecting his assets. The Court reached this conclusion, questioning whether the measure was proportionate to the aims pursued by transferring the test set out in the judgment Bărbulescu II to the proceedings before the courts, and, after recommending that the measures implemented by the employer exceeded that constitutional requirement, declared the dismissal appropriate on the basis of the images obtained with hidden cameras.

More importantly, the ECtHR postulated that the lack of prior information about the existence of the hidden cameras was justified by reasonable suspicions of serious irregularities. At the same time, it concluded that the Spanish labour courts had not exceeded their margin of appreciation and that there had been no breach of the right to privacy or data protection.


The LOPD, through the thirteenth final provision (LA Ley 19303/2018), introduced in the Royal Legislative Decree 2/2015, of 23 October, which approves the Revised Text of the Workers' Statute Law ("ET"), Article 20 bis (LA Ley 16117/2015), which reads as follows:

"Workers have the right to privacy in the use of the digital devices made available by the employer, to digital disconnection and to privacy against the use of video-surveillance and geo-location devices under the terms established in the legislation in force on personal data protection and guarantee of digital rights".

In this way, the ET establishes a rule that makes a block reference to all the regulation in matters of data protection ("RDP") and not only the specific aspects that are included in Title X of the LOPD relating to the labour scope -Arts. 87 (LA Ley 19303/2018), 88 (LA Ley 19303/2018), 90 (LA Ley 19303/2018) and 91 (LA Ley 19303/2018)-. This is a remission in totum that causes an increase in the regulation of various precepts in employment matters. Thus, for example, it generates a broad aggregate of the employment rights of every worker -beyond what is provided for in art. 4.2 of the ET (LA LEY 16117/2015)-, to the point that the possibilities for an employer to be sanctioned are expanded. Failure to comply with the duties required by the DPO could lead the Inspectorate of Labour and Social Security ("ITSS") to impose the sanctions laid down in Royal Legislative Decree 5/2000 of 4 August, approving the Revised Text of the Law on Offences and Sanctions in the Social Order, which establishes as a serious offence in Article 8.11 (LAW 2611/2000): "Acts by the employer which are contrary to respect for privacy and due regard for the dignity of workers".

The media repercussion of López Ribalda II, has put the specific regulation of the LOPD in matters of video surveillance in the spotlight.


The LOPD contains two precepts that regulate video surveillance and which are applicable to the field of labour relations; these are:

a.- Article 22 of the LOPD (LA Ley 19303/2018), entitled "Processing for the purposes of video surveillance", is included in Title IV on "Provisions applicable to specific processing operations".

b.- Article 89 - paragraph 1 - of the LOPD (LAW 19303/2018), which states the "Right to privacy in the use of video-surveillance and sound recording devices in the workplace" and which is included in Title X called "Guarantee of digital rights".

These two articles are complementary to each other. It is for this reason that it is not possible to carry out an isolated reading of both precepts, since they are cumulative. Thus, it could be said that the general regime on the processing of data obtained through the cameras is regulated in art. 22 LOPD, (LA Ley 19303/2018) comes to be complemented with the peculiarities of the special regulation that operates in the field of labour relations; that is, the regulation contained in art. 89 -paragraphs 1 (LA Ley 19303/2018) and 2- of the LOPD (LA Ley 19303/2018).

Once a distinction has been made between the general and specific framework, it is appropriate to analyse paragraphs 1 and 2 of the aforementioned Article 89, which include the specific features of audio-visual control. This specific regime established by the legislator clearly reflects the criteria set out in the case law of the ECjHR and the ECJ up to the date of its publication.

In the first place, Article 89(2) of the LOPD prohibits the installation of video surveillance cameras in certain impassable areas, where the worker's privacy reaches its highest level, such as rest or leisure areas - changing rooms, toilets, dining rooms and similar. That is to say, according to its literal diction, in no case may audio-visual control be carried out in employees' leisure areas.

Secondly, Article 89(1) of the LOPD establishes two clearly differentiated cases, where the requirement of the duty of information that requires the implementation of work control measures for disciplinary purposes varies according to the concurrent circumstances. Thus we distinguish between:

1. Preventive control for any kind of non-compliance: the duty of express and precise information.

This is the case referred to in the first paragraph of article 89 - paragraph 1 - of the LOPD (LA Ley 19303/2018) which reads as follows:

"Employers may process the images obtained through camera systems for the exercise of the functions of control of workers or public employees provided for in Article 20.3 of the Workers' Statute (LAW 16117/2015) and in management, provided that these functions are exercised within their legal framework and with the limits inherent therein. Employers must inform workers or public employees and, where appropriate, their representatives, expressly, clearly and concisely in advance".

The precept includes a scenario in which, based on the freedom of the company and article 20 - paragraph 3 - of the ET (LAW 16117/2015), an employer is allowed to carry out an exhaustive labour control provided that he has previously informed the employees, in an express, clear and concise manner, that the images obtained by the cameras may be used for disciplinary purposes.

In principle, it could be concluded from a reading of these cameras that they could be used to sanction all kinds of labour violations; however, the installation of these systems would require the concurrence of a legitimate interest of the employer - for example, the good development of the productive activity and to guarantee the security of the work centre. It would not be acceptable, therefore, to implement video surveillance systems simply for the purpose of controlling workers' behaviour.

Furthermore, the first paragraph establishes a double obligation in relation to the recipient of the duty of information. The implementation of this type of preventive control system for labour purposes must be communicated:

i) To the individual worker, so that the omission of this duty of information determines the illegality of the processing of the images obtained with the cameras.

ii) To the workers' representatives. An obligation that already existed previously in the TE - specifically section 5.f) of article 64 (LAW 16117/2015) -, and which is now also included in article 89 of the LOPD (LAW 19303/2018) - perhaps in a reiterative manner. In this case, non-compliance with the duty to inform the representatives; although it would not determine the illegality of the images obtained by infringing the right to data protection of the workers, it could nevertheless determine the corresponding administrative sanctions.

2. Preventive control by means of security cameras: the generic duty of information.

The second paragraph of the first paragraph of Article 89 (LAW 19303/2018) establishes the following literal wording:

"In the event that the flagrant commission of an illicit act by workers or public employees has been detected, the duty to inform shall be understood to have been fulfilled when at least the device referred to in article 22.4 (LA Ley 19303/2018) of this organic law exists".

Thus, in the event of well-founded indications that a worker may be committing a breach of his or her employment contract, the employer would be allowed to use the security recordings for disciplinary purposes. In other words, the precept has been taken up by the doctrine of the STC 39/2019 (LA Ley 41091/2019), which was subsequently applied to the Social Chamber of the Supreme Court ("SC") in numerous rulings.

In these cases, the LOPD would require "prior, clear and precise, clear and unequivocal information", with more generic information -and not so precise- being sufficient, which it understands to be completed with the placement of the information mark regulated in art. 22 -paragraph 4- of the LOPD (LA Ley 19303/2018).

However, doubts arise as to what should be understood by "illicit act". In principle, this definition could include any kind of labour non-compliance, but the SC, in the sentences that apparently gave rise to the drafting of this precept, ruled that this type of camera could only be used to sanction non-compliance that threatens the safety of the workplace. Thus, the SC would understand security as "a broad expression that includes the surveillance of illegal acts by employees and third parties, and, in short, the security of the workplace; but which a priori would exclude other types of work control that are not related to security, that is, the effectiveness of work, absences from work, conversations with colleagues, etc.".

This interpretation would be accommodated by two legal limits that operate in the area of security cameras and that would prevent this type of device from being used for purposes other than security:

- Article 22 - paragraph 1 - of the LOPD (LAW 19303/2018) establishes that natural or legal persons may only carry out data processing through video-surveillance systems with the aim of preserving the security of persons and goods, as well as their installations.

- Article 42 - paragraph 4 - of the Private Security Law 5/2014 (LAW 5140/2014), which states that the recordings obtained by video-surveillance "cannot be used for any other purpose".

Consequently, the security cameras whose presence is warned by means of the informative sign provided for in article 22 - paragraph 4 - of the LOPD (LAW 19303/2018), could be used for labour disciplinary purposes when there are suspicions, which can be accredited, that the employees may be carrying out "illegal acts" that threaten the security of the work centre.

Once the assumptions contemplated in art. 89 of the LOPD (LA Ley 19303/2018) have been analysed, and following the ruling of López Ribalda II, the question remains as to whether the use of hidden cameras is possible.


The problem with concealed recording is that it would lead to a total failure to comply with the duty of information. Respect for this duty in absolute terms - especially in cases in which the occurrence of illicit acts has been established, or even where there are well-founded suspicions of their authorship - would mean that mechanisms such as hidden cameras would be eliminated from all their effectiveness and the problems of which have arisen in other jurisdictions.

It is for this reason that López Ribalda II implies a radical change of criteria, since he would be allowing the use of temporary hidden cameras - omitting the duty of information - as long as reasonable suspicions exist.

However, in spite of this statement, according to our internal legal system it seems that the use of hidden cameras would not be allowed. This would be so, for the following reasons:

a.- The TC has repeatedly pointed out that the duty of information would form part of the essential content of the fundamental right to data protection. And to dispense with the duty of information would mean emptying this fundamental right of its content, making it useless.

b.- The national legislator would have wanted that, at least, the duty of information be fulfilled with the information sign provided in section 22 - paragraph 4 - of the LOPD (LA Ley 19303/2018).

Moreover, it would seem clear that the legislator would not have wanted to allow the use of hidden cameras in the labour field when initially the Draft Organic Law on the Protection of Personal Data (LA LEY 16062/2018) (the "Draft LOPD"), opened the door to the use of hidden cameras in art. 22 -paragraph 5 (LAW 16062/2018)- established that: "In the event that the images have captured the flagrant commission of a criminal act, the absence of the information referred to in the previous paragraph shall not deprive the images of evidential value, without prejudice to the responsibilities that may arise from such absence".

However, as stated above, the wording of the new Article 89 would establish the need for, at least, the existence of the information mark in order for the recordings to be lawful.

c.- The López Ribalda II case interprets - since it is the rule in force at the time of the events - Organic Law 15/1999, of 13 December, on the Protection of Personal Data (LAW 4633/1999) - and not the current one.

Moreover, one of the first interpretative rulings of the current LOPD concluded that "In effect, given that there is a duty to previously inform the worker of the installation of the surveillance cameras, covert or hidden recordings are no longer possible and are absolutely prohibited, which is as much as saying not informed. Suspicions of serious irregularities in the performance of work activities do not legitimise an exception to the duty to inform of the recording that affects the position under suspicion, nor does it exonerate from the requirements of the RGPD. The company always has a means of defending its interests, such as the announcement of the recording of the images and the purpose, which already offers protection to its assets because of the dissuasive function that it must reasonably produce".

Consequently, legal operators would again be in a situation of legal uncertainty because while TC and the LOPD would be clear about the impossibility of dispensing with the duty of information, for his part, López Ribalda II would advocate the legality of hidden cameras in certain exceptional cases.

The situation of legal insecurity would be evident, so it would not be ruled out that the legislator would evaluate the revision of the LOPD; for example, adopting the wording of article 22 of the original LOPD act.

In short, and in this context, the particular vote formulated by three judges of the ECtHR in López Ribalda II is of special interest, which points out that in order to omit the duty of information it would be necessary for a third party -for example, a judicial body- to verify the real existence of these "indications of a serious breach" to avoid: (i) arbitrary investigations; and (ii) that the employer has to justify the investigative measure implemented, after having carried out an act that may lead to the violation of a fundamental right.

This option could be presented as the most reliable for all parties since it would potentially provide greater legal security given the enormous caseload. This is without prejudice to the possible difficulties that could be encountered in their practical or material implementation, when the installation of hidden cameras - prior to their installation - is subject to judicial authorization in response to reasonable suspicions that should be able to be proven or accredited.

You can read the article in el Diario la ley.

End of main content