Legislative procedures sometimes reveal a lack of harmony that could be avoided. This is true in relation to video surveillance at the workplace, which already gives rise to differing opinions on the subject.
Some doctrine has argued that video-surveillance in the workplace still requires prior authorization from the CNPD, regardless of sound capture, maintaining the regime prior to the GDPR, i.e. the provisions of the Labour Code.
We strongly disagree with such interpretation for the reasons set out briefly below.
The issue of video-surveillance in an employment context was regulated in articles 20 and 21 of the Labour Code, imposing, in the relevant part, the need for authorization from the National Data Protection Commission under the terms of article 21(1) of the aforementioned Code.
This principle has not changed since its approval by Law No. 7/2009 of 12 February.
Meanwhile, the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) was published, which changed the paradigm of intervention of the supervisory authorities from a pre-treatment authorisation scheme to a self-discipline and auditing solution, admitting prior checking situations in its Article 36.
With the applicability of the GDPR on 25 May 2018 and taking into account the nature of an act of secondary European law with direct effect in the Member States, the national provisions which provided for authorisations from the supervisory authority, in Portugal, the National Commission for Data Protection, should be considered repealed on the grounds of incompatibility of the regime. The provisions of Articles 18(1) and 21(1) of the Labour Code are in this situation. This was confirmed by article 62, no. 2 of the National Law implementing the GDPR by stating that “all rules that provide for authorizations or notifications of processing of personal data to the CNPD, outside the cases provided for in the GDPR and in this Law, shall cease to be in force on the date of entry into force of the GDPR “. The Labour Code in Articles 18, no. 1 and 21, no. 1 do not constitute an exception that can fulfil the provision of no. 5 of Article 36, simply because there has been an amendment to the Labour Code that has not pronounced on these rules after the entry into force of the National Implementing Law. In fact, the change of paradigm obliges the national legislator to make a consideration in the light of our regime.
This interpretation, which is not adhered to, seems to be intended to reverse the rules of the Labour Code with three arguments which we do not believe should be accepted. Firstly, because the GDPR admits the possibility of prior authorisation in some cases and, secondly, because the legislator of the National Implementing Law of the GDPR has provided that video-surveillance that includes audio capture when the monitored installations are not closed requires authorisation from the CNPD (cf. Article 19(4) of Law 58/2019 of 8 August). Finally, the express understanding is based on the fact that the legislator of the Labour Code did not expressly revoke the rules on video-surveillance when amending the Labour Code operated by Law no. 93/2019, of September 4.
We believe that none of these arguments holds, because, as we have seen, the rules of the Labour Code that provided for authorizations and notifications from the CNPD have been repealed and Law 58/2019 of 8 August did not reverse them as is clear from Article 62(2), which only admits that the authorizations and notifications provided for in the GDPR Implementing Law remain in effect, which is clear from the expression used in this provision “outside the cases provided for in the GDPR and this Law”. And one should not argue that the national legislator implemented the GDPR through the Labour Code in the wording of 2009, as this would simply be contrary to any rule of interpretation. In fact, if the Labour Code were in force it would also be repealed by the provision of the GDPR Implementing Law, which establishes a different authorization regime.
Similarly, Article 88 of the GDPR, which allows for more specific rules to guarantee the defence of the rights of workers with regard to the processing of their personal data in an employment context, has been strengthened with the provision of Article 19(4) of Law 58/2019 of 8 August.
At the moment, only the CNPD’s authorization for video-surveillance with audio capture in installations that collect image and sound when they are not closed is in force and under the terms of paragraph 4 of Article 19 of Law 58/2019, of 8 August, also applicable in a labour context. What the GDPR revoked in the Labour Code its implementing law did not reverse.
