To what extent does an employee’s consent hold weight in an employment relationship, particularly when the employer infringes upon fundamental personal rights? This pressing issue lies at the heart of decision No337/2025 that was recently issued by the Piraeus Single Member Court of First Instance. According to the facts of the case, the employer had installed a video surveillance system, without the employee’s consent, which was recording his workspace with the purpose of monitoring his activity throughout his working hours. Notwithstanding his objections against this, the employer refused to remove the cameras, which, according to the plaintiff, constituted an infringement of his personality rights.
The court held that:
The installation of cameras must comply with the principle of transparency, meaning that it must be undertaken with the full knowledge, prior provision of information and consent of employees. The information must be clear, comprehensible, thorough and accessible. Based on this, the court made reference to the opinions issued by the Article 29 Working Party and the EDPB. More specifically, in Opinion 06/2014, the Article 29 Working Party noted that where the processing of personal data is necessary due to the nature of the employment relationship itself, the consent of the employee cannot be considered valid. The validity of consent is limited to cases where the employee has a genuine, free choice and is thereafter able to withdraw consent without consequences, which is due to the imbalance of power between employers and employees. This imbalance is readily apparent, as it is the employer who largely determines the terms of the employment contract, while the employee, having limited bargaining leverage in this case, may give consent with the motivation of having a contract put in place, and not because he or she genuinely wishes to have his or her personal data processed.
Concerning video surveillance of employees, it is important that the three-step test of the stricto sensu proportionality principle be applied. In particular, in accordance with the European Data Protection Board's Guidelines 3/2019, video surveillance should not be used if there are less intrusive means available for achieving the same purpose. The employer must consider whether the measure is appropriate, necessary and proportionate to achieve the desired objectives.
Video recording can only be legal in exceptional circumstances, such as for the protection of employee health and safety or in critical workplaces, such as banks or military facilities. Nevertheless, the use of video surveillance must not be generalised and arbitrary. In this case, the Article 29 Working Party stresses that the processing of data, such as video surveillance, is only allowed if it is necessary for the performance of employment contracts, as provided for in Article 7(b) of Directive 95/46/EC. The court, reiterating the provisions of Article 1/2011 of Directive 1/2011 of the Hellenic Data Protection Authority, concluded that premises with electromechanical installations, where the shift supervisor or safety officer can monitor the machine operators in real time, fall into this “exceptional circumstances” category.
The final finding of the court was that in, the case in question, there had been an infringement of the employee's personality rights, given that he had been video recorded at work and within his workplace. Therefore, it found that his claim for non-pecuniary damage was well-founded, insofar as it was not statute-barred. In its ruling, the court ordered the company to pay the plaintiff damages of EUR 500 instead of the sum of EUR 3000 that had been claimed, partially upholding the action. Obviously, the notably low amount of damages awarded raises concerns as to the effectiveness of the protection of the human rights of privacy and the protection of private life, as specified by the GDPR and Law 4624/2019.
In conclusion, this decision addresses the crucial issue of the processing of personal data in the workplace, shedding light on the legal framework on the basis of which such processing by the employer could be classified as an unlawful act (Articles 5 and 6 GDPR, Article 8 ECHR, Articles 7 and 8 CFREU, Article 27 of Law 4624/2019, Articles 9 and 9A of the Greek Constitution, and so on). Moreover, there is a need to protect the employee as the weaker party to the contract, who obviously has less bargaining power both in the process of concluding and during the execution of employment contracts. This manifest and undeniable imbalance is what brings to light the wide gap between genuine employee consent—which can only exist when the company ensures full transparency and provides complete information—and notional consent, which is given under employer pressure or may not be given at all, as in this case, where the employee’s data was processed without consent.
The Hellenic Data Protection Authority (DPA) has issued detailed Guidelines (Directive 1/2011) on the use of video surveillance systems (CCTV), while recent opinions (e.g. DPA Recommendations 2/2020) provide practical advice. These guidelines confirm that the legal basis for the use of CCTV is exclusively related to security, i.e. the protection of persons and property from unlawful acts or risks. They also specify that video surveillance should be limited to appropriate areas, such as entrances, cash desks and high-risk areas, and should not extend to normal work areas or employee rest areas.
The present case, however, is a reminder that, although the Greek regulators have provided clear guidance and have taken enforcement measures on surveillance in the workplace, this issue continues to be of concern to many employees and employers alike.
Hence, it remains to be seen not only how the competent courts will position themselves in the future, but also how employers themselves will proceed, especially in rapidly evolving sectors, such as heavy industry and services with increased safety requirements. Will they opt for solutions that combine privacy protection with their operational needs for security, or will they test the limits of the law, leading to new interpretations and possibly stricter regulation in the future? Finally, it will be interesting to see whether the competent courts will issue more courageous decisions, or whether privacy rights will be sidelined as second-class human rights.
