The AEPD sets rules for data processing in employment disputes

The recent decision to close proceedings in case number 202404179 of the AEPD regarding video surveillance and the transfer of images between companies reinforces a clear message: in certain cases, employers may rely on images captured by third parties to investigate possible employment infringements or fraud, provided that the principles and bases of legitimacy of the GDPR and the LOPDGDD are observed. This is not a relaxation of compliance, but rather a confirmation that legitimate interest, properly weighed and documented, can justify such processing without the need to obtain the employee’s consent.

The case analysed by the AEPD revolves around the use of security cameras at a petrol station to prove alleged misuse of a corporate card, linking the images to possible employment fraud. The authority considers that, when the purpose is to prevent or prove potentially unlawful behaviour and there are no equally effective alternative means, the processing can be covered by Article 6.1.f) of the GDPR, provided that the principles of proportionality, data minimisation and time limitation are observed.

In practice, this has a direct impact on very common scenarios: use of fuel cards for personal purposes, unauthorised access to facilities, theft of goods or irregular use of company vehicles. In all these cases, video surveillance images, whether owned by the company or by third parties with whom it has a contractual relationship, can become valid evidence to support disciplinary dismissal or legal action, provided that the company can demonstrate that it has acted with due diligence.

The ruling, in line with the AEPD’s updated video surveillance guidelines, emphasises the importance of having robust compliance systems and protocols in place: appropriate signage, clear identification of the person responsible, channels for exercising rights, appropriate retention periods and prior analysis of legitimate interest. For organisations, the lesson is clear: investing in a video surveillance framework that complies with the GDPR and LOPDGDD not only reduces the risk of penalties, but also allows them to respond with legal certainty to real conflicts with employees and third parties.