Is it ok to video record disciplinary meetings?
With many employees still working from home, it may be necessary to carry out disciplinaries, grievances, performance and absence meetings, consultations and even dismissals remotely, via video call.
Many employers will feel that it would be easy to record these calls, but is this lawful?
These recordings will comprise personal data of all participants and others identified in discussions and may include sensitive personal data, including political opinions, health or disability information, ethnic origin, trade union membership, religious belief, sexual orientation or criminal convictions.
Video is more intrusive than audio recording, which in turn is more intrusive than written notes. Video captures tone of voice, body language and facial expressions. It captures individuals’ images,
which are likely to disclose their age and gender and potentially race, religion and some disabilities. If footage is shared inappropriately, there is greater risk of misuse.
To comply with GDPR, data collected must be limited to ‘what is necessary’: if there is a less intrusive alternative that meets business needs, that option should be used.
But there may be exceptions. For example, recording might be justified if:
· there is a particular need for a verbatim account;
· an employee’s first language is not English; or
· it is a reasonable adjustment in light of an employee’s disability.
But what if an employee agrees to the recording? Employees’ consent is likely to be ‘invalid’ for data protection purposes, due to the imbalance of power between employers and employees. This means it cannot be used to justify recording, and there must be another legal basis, such as the possible exceptions above. If there is a justification for recording, participants’ agreement is not necessary, but they must be informed in advance.
If a meeting is being video recorded:
· carry out a data protection impact assessment first, to identify the legal basis for recording, and assess and mitigate risks;
· ensure data protection privacy notices include sufficient information and have been communicated;
· give all participants advance notice of the recording;
· store the recording securely, maintaining the integrity of the information;
· limit access to those with a ‘need to know’;
· the retention period will depend on the reason for making the recording: if this is to create a verbatim note, delete the recording once this is done, unless there is another reason to keep it;
· technology sometimes fails, so consider written notes as a back-up.
Policies should make clear, and everyone should be reminded, that participants must not make their own recordings unless this has been agreed in advance, due to particular circumstances.