Are you considering installing cameras in the workplace? Before mounting the first device, you should be familiar with the exact rules. Employee monitoring is not merely a technical matter, but above all a legal one, where every mistake can result in a fine of up to CZK 1 million.
In this article, we clearly explain the conditions under which cameras may be installed, where they are strictly prohibited, and how to set up the entire system correctly so that it complies with both Czech legislation and the GDPR.
When Can Cameras Be Used in the Workplace?
Whether the reason for installing cameras is the protection of property, theft prevention, or operational safety, it is essential that everything is carried out in accordance with the law.
With regard to workplace cameras, the Czech Labour Code clearly states that an employer may monitor employees only if two basic conditions are met:
- There must be a serious reason arising from the specific nature of the employer’s activities.
- Employees must be informed in advance about the scope and manner of the monitoring.
The vast majority of ordinary companies do not meet the first condition. Typical examples where workplace cameras may be justified include banks, nuclear power plants, chemical facilities, or pharmaceutical companies—in other words, environments where there are serious safety risks or the potential for exceptionally large-scale damage. In such cases, cameras can often even save lives.
By contrast, suspicion of low employee productivity is not a sufficient reason.
Serious reasons for installing cameras therefore include:
- protecting employees’ lives and health, for example in chemical plants or other hazardous operations,
- protecting property, for example in banks, currency exchange offices, or warehouses storing valuable goods,
- preventing unlawful conduct, such as theft or vandalism.
Balancing Test for Employee Monitoring in the Workplace
Under Section 316(2) of the Czech Labour Code, the employer must also consider whether a less intrusive solution is available, such as timekeeping systems, security doors, or supervision by managers.
This is assessed through a so-called balancing test. The purpose of this test is to carefully determine whether your interest in achieving a specific objective, such as protecting property or ensuring safety, outweighs the employee’s right to privacy.
This Assessment Requires Answering Several Key Questions:
- Is a CCTV system genuinely the most effective way to achieve your objective?
- Are there any alternative, less intrusive measures available?
- Is the scope of the monitoring proportionate to the intended purpose?
For example, if your goal is to prevent theft in a warehouse, you should first consider other solutions, such as securing the premises with an alarm system, implementing access control using key cards, or increasing managerial supervision. CCTV should always be considered a measure of last resort.
Workplace Cameras and GDPR: Legal Basis and Required Documentation
Under the GDPR, any monitoring of individuals using cameras constitutes the processing of personal data. Employers must therefore:
- clearly define the purpose of the monitoring (e.g. protection of property),
- carry out the balancing test described above to determine whether their legitimate interest outweighs the employee’s right to privacy,
- inform employees in advance—preferably in writing; displaying only a CCTV warning sign is not sufficient,
- ensure the security of recordings through restricted access, encryption, and clear retention policies,
- where applicable, conduct a Data Protection Impact Assessment (DPIA) if the monitoring is extensive or poses a high risk to individuals’ rights and freedoms.
Failure to comply with these requirements may result in the Czech Data Protection Authority imposing fines of up to 4% of the company’s annual global turnover or €20 million, although fines issued in the Czech Republic have so far generally remained in the hundreds of thousands of Czech crowns.
Where Workplace CCTV Must Never Be Installed
There are certain areas where employee monitoring is prohibited under all circumstances. These include:
- toilets and washrooms,
- changing rooms and locker rooms,
- break areas and staff canteens,
- kitchenettes and relaxation areas.
These areas are closely related to employees’ private lives, and employers must respect their privacy within them. Even the protection of company property is not considered a sufficient reason to justify surveillance in these spaces.
Employer Obligations When Using Workplace CCTV
Even if you meet all the legal requirements for installing a CCTV system in the workplace, there are still a number of additional obligations you must fulfil.
Information Requirements
It is not enough for cameras to be clearly visible or for a CCTV warning sign to be displayed. Employees must be properly informed about:
- the number and location of the cameras,
- the purpose of the monitoring,
- the retention period for recordings,
- how the recordings are secured,
- who has access to the recordings,
- the options available to employees to their rights regarding the monitoring.
This information must be communicated directly to employees, either verbally during training sessions or in writing through an internal policy or an amendment to the employment contract.
Security and Retention of CCTV Recordings
Workplace CCTV recordings contain personal data and therefore require appropriate security measures:
- Access to recordings must be restricted to a limited number of authorised individuals.
- Every access to the recordings should be logged.
- As a general rule, recordings should be retained for no longer than 72 hours, in line with the recommendation of the Czech Data Protection Authority.
- Longer retention periods must be justified by specific circumstances.
Failure to comply with these requirements may result not only in fines imposed by the Czech Data Protection Authority, but also in a loss of trust among your employees.
Expert Insight: How Can Employers Better Protect CCTV Recordings?
“Employers should treat CCTV recordings with the same level of care as any other sensitive data. From a physical security perspective, recording devices such as NVRs, DVRs, and servers should be located in locked rooms with restricted access, ideally with entry logs. The recordings themselves should not be accessible to ordinary employees, but only to a limited number of authorised and trained personnel, preferably with named user accounts and comprehensive activity logging.”
What About Dummy Cameras?
At first glance, installing dummy cameras may seem like a harmless solution, but this is not the case. Although dummy cameras do not process personal data and therefore do not fall under the GDPR, the Labour Inspectorate may still consider their use a breach of an employer’s obligation to provide a safe and healthy working environment.
This is because fake cameras create the same feeling of being monitored as real ones, placing employees under psychological pressure. Moreover, if employees are led to believe that the dummy cameras are operational, the employer may also be in breach of the GDPR information obligations.
Penalties for Non-Compliance
Failure to comply with the legal requirements governing workplace CCTV may result in significant penalties, including:
- fines of up to CZK 1 million imposed by the Labour Inspectorate for unlawful employee monitoring,
- fines of up to CZK 100,000 for failing to properly inform employees,
- fines imposed by the Czech Data Protection Authority of up to €20 million or 4% of the company’s annual global turnover, whichever is higher.
How Can We Help?
At M2C, we provide comprehensive security solutions that fully comply with applicable legislation. Our experts can help you:
- assess whether CCTV installation is legally justified in your specific case,
- design a surveillance system that respects employees’ rights,
- prepare all required documentation, including employee information materials,
- establish secure processes for managing and protecting CCTV recordings,
- regularly review and update your system to ensure continued compliance with changing legislation.
We also provide a 24/7 24/7 Remote Monitoring Centre (ARC) service, where our operators continuously monitor and protect your premises. Whenever necessary, they immediately dispatch a rapid response team and coordinate further actions to ensure the security of your property.
Contact us today to arrange a consultation.
FAQ – Frequently Asked Questions
How long can CCTV recordings be retained?
As a general rule, recordings should be retained for no more than 72 hours. Longer retention periods are only permissible where there is a legitimate reason, such as when recordings are required as evidence in criminal proceedings.
What can an employer monitor?
Only activities that are necessary to achieve a legitimate objective, such as monitoring entrances, cash registers, or warehouses. Monitoring toilets, changing rooms, or employee break areas is never permitted.
Where must cameras never be installed?
Workplace cameras must not be installed in areas intended for personal hygiene, changing clothes, rest, or other private activities, including toilets, locker rooms, kitchenettes, staff break rooms, and relaxation areas.
