Israel has set a baseline for ‘secret’ video surveillance in the workspace and has codified it. The unlawful use of surveillance cameras to monitor employees in the workplace exposes the employer to civilian (including employment related and tortious), administrative and criminal action.

The Registrar of Databases acting for the Authority for the Protection of Privacy (“the Registrar”) operating under the Protection of Privacy Law of 1981 (the “Law”) has recently published a new directive, number 5/2017, on the use of surveillance cameras installed in the workplace for the purpose of monitoring employees (the “Directive”).

In deciding related cases, the courts have recognized the Registrar’s authority to publish directives to guide the public and the Registrar itself in taking decisions in concrete cases.

The following main points are worth noting:

The monitoring of employees in the workplace, as well as by camera surveillance, prima facie raises issues of privacy.

Unlike in the United States, the right of privacy in Israel is a constitutional right. Israel has adopted the OECD’s approach, which recognizes an employee’s right to privacy in the workplace and also in the use of their employer’s equipment and systems. Thus, an employer’s right of ownership of the premises, equipment and workplace systems does not preclude an employee’s right to privacy.

Surveillance cameras are fundamentally different from other known means of monitoring employees in the workplace (which also raise issues of privacy), in that they record, on a continuous and all-inclusive basis, all of an employee’s activities including those of a private nature. Surveillance cameras enable an employer to review its employee’s past conduct and crosscheck the data with information received from other sources. Therefore, surveillance cameras in the workplace are severely invasive of an employee’s right to privacy.

The videos or photos taken by surveillance cameras can be considered “data” and the collection or storage of these can be considered a “database” (of private and sensitive information as may be “captured” by video or photos), as defined in the Law with respect to which there are additional specific compliance requirements.

An individual may consent to waive their right to privacy, in which case no violation of the right to privacy occurs. In general, in order for consent to be valid it must be informed and freely given.

In other words, the lawfulness of the invasion revolves on the validity of the consent. The legal discourse on the monitoring of employees in the workplace revolves largely on the issue of an employee’s consent, and the Directive is mostly concerned with this issue.

Due to the power gap between employer and employee, the courts have imposed a significant burden on an employer to establish that it has received an employee’s informed and free consent to waive their right to privacy in the workplace, the content of which is laden with public policy considerations.

The employer must ascertain that the measures taken duly comply with the tests of reasonableness, proportionality, good faith and fairness, as adopted and applied by the courts, and it cannot rely, in this regard, on sweeping contractual provisions waiving the right of privacy and permitting the use of surveillance cameras.

All of the above-mentioned tests are measured against the concrete legitimate purpose defined by the employer and may vary accordingly. Legitimate purposes in this regard are generally defined as those necessary to forward the employer’s business interests and or to fulfill its obligations under law.

Legitimate purposes include the security of employees and visitors in the workplace, the security of the workplace as a whole, including stored data, quality control, and the monitoring of employees’ performance for disciplinary purposes.

The use of surveillance cameras for a purpose that deviates from the purpose originally defined is unlawful, even if the new purpose had been originally defined lawfully, since the requirement of informed consent cannot be regarded as having been complied with.

Thus, videos taken for the purpose of client surveillance cannot lawfully be used for disciplinary purposes such as monitoring the length of an employee’s lunch break.

An employer must establish a specific and detailed policy with respect to the use of surveillance cameras and it must notify its employees of this policy. Such a policy is necessary for establishing that the employer has obtained the employees’ informed consent.

To the extent possible, an employer is required to consult with its employees, or with its employees’ representatives, in establishing the policy.

The policy should be reviewed and updated from time to time in order to adapt to developments and to ensure the employees’ continuous awareness of the policy.

The Directive offers some useful criteria for measuring the lawfulness of surveillance cameras, one of which relates to the area in which the camera is installed. The Directive establishes some general rules in this regard, as follows:

• An employer is prohibited from installing secret surveillance cameras in areas which an employee has a reasonable expectation of privacy, even for legitimate purposes.
• In public areas, where surveillance cameras are installed in order to monitor clients (for the prevention of theft, for example), and in respect of which general notice is given to the public by a sign on the door, for example (without specifying the precise location of the cameras), employees must be notified of the installation of cameras.
• In inner areas of the workplace, which are not open to the public, the secret camera surveillance of an employee is permissible only in the exceptional and limited circumstances of substantial and concrete suspicions of criminal activity or other misconduct on part of an employee which is likely to cause an employer severe damage, and as such, may afford the employer a protection under the Law. In order to ascertain the lawfulness of such a measure, the employer is advised that the decision to conduct surveillance in such a case be taken by the highest-level management and only after receiving a detailed and specific legal opinion as to the lawfulness of the measure and the applicability of a protection.

The Directive supplies some concrete examples of various areas in the workplace and details what it considers as an employee’s reasonable “expectation of privacy” with respect to each of them:

• It is self-evident that there is there is the highest expectation of privacy with respect to restrooms and locker rooms and it is difficult to fathom any legitimate organizational interest that could justify installing cameras in such areas.
• Recreation areas (common room, kitchen, dining hall) are regarded as areas with respect to which there is a high-degree of expectation of privacy and the employer is prohibited from installing secret surveillance cameras even for legitimate purposes.
• Working areas that are not open to the public are to be regarded as “private” areas, with respect to which an employee has a reasonable expectation of privacy, and surveillance can only be justified in cases in which the benefit to an employer is significantly greater than the grave injury to an employee’s privacy, and in any case the employee must be notified. Surveillance cameras which photograph an employee while performing their regular office duties in their working space (such as working on the computer or speaking on the telephone), even if it is a shared working space, in order to monitor the employee’s breaks, are considered to be disproportionate (both from the perspective of efficacy of measures to attain the purpose and from the perspective of the availability of less injurious measures). In comparison, camera surveillance of an employee in a production site for quality control purposes or for data protection purposes may be considered lawful if essential for the purpose, and if the purpose cannot be achieved by the use of less injurious measures.
• Entrance halls, corridors and areas open to the public are not regarded as private and employees reasonably have a low expectation of privacy there, and thus, the use of surveillance cameras for lawful purposes is more reasonable, provided that it is proportional and that the employee is notified.

Additional criteria in measuring the lawfulness of an employer’s actions are the availability of effective alternative measures which are less invasive of an employee’s privacy and also, whether in the planning and use of surveillance cameras, the employer has carefully considered and defined the scope of the area to be covered, the number of cameras to be used, the times of surveillance, the quality and resolution of the photos and the period for which the photos are to be kept.