GRAND CHAMBER
 
CASE OF LÓPEZ RIBALDA AND OTHERS v. SPAIN
(Applications nos. 1874/13 and 8567/13)
 
 
 
 
 
 
JUDGMENT
 
STRASBOURG
17 October 2019
 
 
This judgment is final but it may be subject to editorial revision. In the case of López Ribalda and Others v. Spain,
The European Court of Human Rights, sitting as a Grand Chamber composed of:
 Linos-Alexandre Sicilianos, President,
 Guido Raimondi,
 Angelika Nußberger,
 Robert Spano,
 Vincent A. De Gaetano,
 Jon Fridrik Kjølbro,
 Ksenija Turković,
 Işıl Karakaş,
 Ganna Yudkivska,
 André Potocki,
 Aleš Pejchal,
 Faris Vehabović,
 Yonko Grozev,
 Mārtiņš Mits,
 Gabriele Kucsko-Stadlmayer,
 Lәtif Hüseynov,
 María Elósegui, judges,
and Søren Prebensen, Deputy Grand Chamber Registrar,
Having deliberated in private on 20 June 2019,
Delivers the following judgment, which was adopted on that date:
PROCEDURE
1. The case originated in two applications (nos. 1874/13 and 8567/13) against the Kingdom of Spain lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by five Spanish nationals, whose details are set out in the Annex (“the applicants”), on 28 December 2012 and 23 January 2013 respectively. 2. They were represented before the Court by Mr J.A. González Espada, a lawyer practising in Barcelona. The Spanish Government (“the Government”) were represented by their Agent, Mr R.A. León Cavero, State Attorney. 3. The applicants submitted that the decision by which their employer had dismissed them had been based on video-surveillance implemented in breach of their right to respect for their private life, as guaranteed by Article 8 of the Convention, and that the domestic courts had failed in their obligation to ensure the effective protection of that right. Under Article 6 of the Convention, they complained about the admission in evidence during the proceedings of the recordings obtained by means of the video-surveillance. Under the same provision, the third, fourth and fifth applicants further complained of the acceptance by the domestic courts of the settlement agreements that they had signed with their employer. 4. The applications were allocated to the Third Section of the Court (Rule 52 § 1 of the Rules of Court). By a judgment of 9 January 2018 a Chamber of that Section, composed of Helena Jäderblom, President, Luis López Guerra, Dmitry Dedov, Pere Pastor Vilanova, Alena Poláčková, Georgios A. Serghides, Jolien Schukking, judges, and Stephen Phillips, Section Registrar, decided to join the applications, declared them partly admissible and found a violation of Article 8 of the Convention and no violation of Article 6. The dissenting opinion of Judge Dedov was appended to the Chamber judgment. 5. On 27 March 2018, under Article 43 of the Convention, the Government requested the referral of the case to the Grand Chamber. On 28 May 2018 the panel of the Grand Chamber granted that request. 6. The composition of the Grand Chamber was determined in accordance with Article 26 §§ 4 and 5 of the Convention and Rule 24. 7. The applicants and the Government each filed further written observations (Rule 59 § 1). The European Trade Union Confederation (ETUC), which had been granted leave to submit written comments in the Chamber proceedings (Article 36 § 2 of the Convention and Rule 44 § 3), had submitted such comments before the Chamber but did not make any additional comments before the Grand Chamber. 8. A hearing took place in public in the Human Rights Building, Strasbourg, on 28 November 2018 (Rule 59 § 3). There appeared before the Court:
(a)  for the Government
Mr R.A. León Cavero, Agent,
Mr A. Brezmes Martínez de Villarreal, Co-Agent,
Mr A. Ramos de Molins Sainz de Baranda,
Mr M. Montobbio, Ambassador, Permanent 
 Representative of the Kingdom of Spain to 
 the Council of Europe,
Mr A. Antón, Adviser, Permanent Representation 
 of the Kingdom of Spain to the Council of Europe,  Advisers;
(b)  for the applicants
Mr J.A. González Espada, Counsel,
Ms À. Ortiz López, Adviser. The Court heard addresses by Mr González Espada, Mr León Cavero and Mr Brezmes Martínez de Villarreal and their replies to questions from judges. 9. On 23 January 2019 the Court was made aware of the death of the second applicant. Her husband expressed the wish to continue the proceedings before the Court in her stead and gave authority to Mr J.A. González Espada to represent him. THE FACTS
THE CIRCUMSTANCES OF THE CASEThe applicants’ dismissal

10. At the time of the relevant events, the applicants were all working in a supermarket of the M. chain situated in Sant Celoni (Barcelona province). The first three applicants were cashiers, while the fourth and fifth applicants were sales assistants behind a counter. 11. From March 2009 onwards the supermarket’s manager noticed some inconsistencies between the stock level and the sales figures. In the following months he identified losses of 7,780 euros (EUR) in February, EUR 17,971 in March, EUR 13,936 in April, EUR 18,009 in May and EUR 24,614 in June. 12. In the context of an internal investigation to shed light on the losses, on 15 June 2009 the manager installed CCTV cameras, some visible and others hidden. The visible cameras were directed towards the entrances and exits of the supermarket. The hidden cameras were placed at a certain height and directed towards the checkout counters. Three tills were covered by the range of each camera, including the areas in front of and behind the counters. The exact number of tills being monitored was not stated by the parties; the documents in the file show that at least four tills were filmed. 13. During a meeting the supermarket’s staff were informed of the installation of the visible cameras on account of the management’s suspicions about thefts. Neither the staff nor the staff committee were informed of the hidden cameras. Beforehand, in 2007, the company had notified the Spanish Data Protection Agency that it intended to install CCTV cameras in its shops. The Agency had pointed out the obligations to provide information under the legislation on personal data protection. A sign indicating the presence of CCTV cameras had been installed in the shop where the applicants worked but the parties did not indicate its location or precise content. 14. On 25 June 2009 the management of the supermarket informed the union representative that the footage recorded by the hidden cameras had revealed thefts of goods at the tills by a number of employees. The representative watched the recordings. 15. On 25 and 29 June 2009 all the workers suspected of theft were called to individual interviews. Fourteen employees were dismissed, including the five applicants. Prior to each interview, the applicants and other employees concerned had a meeting with the union representative, who told them she had watched the video recordings. During the meeting a number of employees admitted that they had been involved in the thefts with other colleagues. 16. During the individual interviews, which were attended by the manager, the legal representative of the company M. and the union representative, the employees concerned were notified of their dismissal on disciplinary grounds with immediate effect. The dismissal letters given to the applicants indicated that the hidden CCTV cameras had filmed them, on several occasions between 15 and 18 June 2009, helping customers or other supermarket employees to steal goods and stealing goods themselves. Among the facts, the letters stated that the first three applicants, who worked at the tills, had allowed customers and colleagues to go to the cash till and leave the shop with goods they had not paid for. They added that those applicants had scanned items presented at the checkout by customers or colleagues and had then cancelled the purchases, with the result that the goods had not been paid for. They explained that a comparison between the goods actually taken away by customers and the sales receipts had made it possible to prove this. As to the fourth and fifth applicants, the cameras had reportedly caught them stealing goods with the help of their colleagues at the tills. According to the employer, these acts constituted a serious breach of the obligations of good faith and loyalty required in the employment relationship and justified the termination of the contract with immediate effect. 17. In addition, the third, fourth and fifth applicants signed an agreement entitled “settlement agreement” (acuerdo transaccional) with the company’s legal representative. These agreements were co-signed by the union representative. Under the agreements, the two parties confirmed the termination of the employment contract by the employer and declared that they had reached an agreement in order to avoid uncertainty as to any future legal dispute. The applicants acknowledged the thefts of the goods, as set out in the dismissal letters, and endorsed the employer’s decision to terminate their employment contracts. The company undertook not to bring criminal proceedings against the employees. A final settlement of outstanding accounts was attached to the agreement and the parties declared that they waived any claims against each other under the employment contract. 18. At no time before their dismissal, either during the meeting with the union representative or during their individual interviews, were the applicants able to view the recordings from the CCTV cameras. Judicial proceedings brought by the applicantsThe proceedings before the Employment Tribunal

19. On 22 July 2009 the first applicant brought proceedings for unfair dismissal before the Granollers Employment Tribunal no. 1 (“the Employment Tribunal”). The same day the other four applicants brought similar proceedings before the Employment Tribunal. 20. The applicants objected in particular to the use of the covert video-surveillance, arguing that it had breached their right to protection of their privacy. They thus requested that any recordings obtained by such means should not be admitted in evidence in the proceedings. 21. As regards the proceedings brought by the third, fourth and fifth applicants, the employer opposed them, relying on the settlement agreements signed by them. Those applicants sought the annulment of the agreements, arguing that they had signed them under the threat of criminal proceedings and that their consent had been vitiated by duress and by the deceitful manipulation of the employer with the complicity of the union representative. 22. A hearing was held in each of the two sets of proceedings, on 3 December 2009 and 23 November 2009 respectively. The CCTV recordings were produced in evidence by the employer. 23. On 20 January 2010 the Employment Tribunal issued two judgments dismissing the applicants’ actions, declaring their dismissals fair. 24. As regards the first and second applicants, who had not signed any settlement agreements, the tribunal took the view that it first had to ascertain whether the recordings obtained by the hidden cameras could constitute lawful evidence, given that, pursuant to section 11 of the Law on the Judiciary and Article 287 of the Code of Civil Procedure, any evidence obtained in breach of a fundamental right had to be excluded. 25. In this connection, the Employment Tribunal found that in accordance with Article 20 § 3 of the Labour Regulations (see paragraph 42 below), any employer was entitled to use monitoring and surveillance measures to verify that employees were fulfilling their employment duties, provided those measures were compatible with their “human dignity” and thus respected their fundamental rights. It referred in this connection to the case-law of the Constitutional Court, in particular judgment no. 186/2000 of 10 July 2000, which concerned a similar case of video-surveillance, using hidden cameras, of employees suspected of serious misconduct. In that judgment, the Constitutional Court had found that an employer’s right to adopt monitoring measures in the exercise of its management power and for the purpose of ensuring the smooth running of the company was limited by the respect due to the employees’ right to their privacy and to the protection of their image. It had explained that the lower court was supposed to strike a balance between the various interests of constitutional value by applying a proportionality test to the employer’s measures. In the case at issue, it had found that the covert video-surveillance measure had been proportionate and had not breached the employee’s fundamental right to privacy guaranteed by Article 18 of the Constitution given that, first, it was justified by reasonable suspicions of serious misconduct; that, secondly, it was appropriate to the aim pursued, namely to verify whether the employee was actually committing misconduct and to adopt sanctions if necessary; that, thirdly, it was necessary, because the recordings would provide evidence of the misconduct in question; and that, fourthly, it was proportionate, because the monitoring was limited in space and in time to what was sufficient to fulfil its aim. The court had, moreover, considered it not to be constitutionally pertinent to examine the question whether the employees or the staff committee had been informed beforehand of the installation of the video-surveillance. It had further taken the view that the right to effective judicial protection under Article 24 of the Constitution had not been breached by the admission in evidence of the recordings thus obtained, especially as the decision had also been based on other evidence. 26. Transposing the principles thus developed by the Constitutional Court in a similar case, the Employment Tribunal found that there had been no breach of the applicants’ right to respect for their private life and that the recordings thus constituted valid evidence. 27. On the merits, the court took the view that the facts set out in the dismissal letters had been established by the evidence in the file and examined as a whole, namely: the video recordings, the witness statements of the supermarket manager, the union representative and other employees dismissed for their involvement in the thefts, and an expert’s report drafted in the context of the criminal proceedings concerning the offences (see paragraph 40 below), which had compared the footage filmed by the cameras with the purchases registered at the tills. 28. In the tribunal’s view, the applicants’ conduct amounted to a breach of the principle of good faith and entailed the employer’s loss of trust, thus rendering their dismissals lawful. 29. As regards the third, fourth and fifth applicants, the Employment Tribunal examined their arguments relating to the invalidity of the settlement agreements with their employer. It took the view that there was no evidence of any form of coercion or fraudulent intent on the part of the employer. It concluded from the union representative’s testimony that the applicants had confessed to the facts during a meeting with her, thus rendering it plausible that they had signed the agreements in order to avoid criminal proceedings. It added that the failure of some employees in the same situation as the applicants (for example, the first and second applicants) to sign such an agreement confirmed the absence of any threat or duress. It also noted that the settlement agreements had no unlawful basis and could be seen as a means of settling a dispute by means of reciprocal concessions. 30. Having accepted the settlement agreements, the tribunal upheld the employer’s objection to the proceedings and, finding that the three applicants in question had no locus standi, dismissed their actions without examining them on the merits. The proceedings before the High Court of Justice
31. The applicants appealed before the High Court of Justice of Catalonia (“the High Court”) on 16 and 22 March 2010 respectively. In her appeal, the first applicant expressly complained of a breach of the obligation of prior notification, as provided for in section 5 of the Personal Data Protection Act. In her view this should have been taken into account in the examination of the proportionality of the video-surveillance measure. 32. In judgments of 28 January and 24 February 2011 the High Court upheld both first-instance judgments. 33. Relying on its own case-law, on that of other courts and on that of the Constitutional Court already cited by the Employment Tribunal, the High Court took the view that the video-surveillance measures taken by the employer on the basis of Article 20 § 3 of the Labour Regulations did not require, in the light of section 6(2) of the Personal Data Protection Act, the prior consent of the employees concerned but had to be subjected to a proportionality test according to the criteria laid down by the Constitutional Court. It took the view that the measure at issue in the present case satisfied those criteria because it was justified by the existence of suspicions of misconduct, appropriate to the aim pursued, necessary for the fulfilment of that aim because a more moderate measure would not have been capable of fulfilling it, and proportionate because the recordings were limited, in time and space, to what was necessary for the purpose of verifying the suspicions. Referring to previous judgments, the High Court found as follows in its judgment of 28 January 2011 in the proceedings concerning the first applicant:
“... the monitoring carried out by the employer by means of CCTV cameras (installed on the site where the [first applicant] was working and directed towards the cashiers’ work-stations after the detection of missing goods ...) ‘may be generally regarded as an appropriate and even a necessary means of monitoring the activity and it must therefore be considered that, despite the fact that it may give rise to sanctions ... because of the failure to inform staff representatives about the installation of the camera ..., the monitoring was not carried out in an excessive manner contrary to the test of appropriateness, necessity or proportionality, which would have resulted in an unjustified breach of the right to the protection of the person’s image or in undermining the person’s dignity, since it was an appropriate means and one that would have been difficult to replace for the purpose of proving possible thefts ...’”
The High Court further held that the failure to notify employees and staff representatives could probably be explained by the fact that “the company rightly feared that knowledge of the monitoring system would defeat its purpose”. 34. Without expressly mentioning section 5 of the Personal Data Protection Act, the High Court noted that the question of the employer’s compliance with the obligation of prior notification was one of ordinary legality and that the failure to inform employees exposed the employer to an administrative sanction but had no impact on the admissibility of the evidence where, as in the present case, the video-surveillance measure was justified and proportionate:
“... The alleged failure to inform the employees could, if appropriate, entail an administrative sanction but will not fall foul of the conditions regarding the lawfulness of evidence laid down by the Constitutional Court, for it is indeed a justified measure (there were reasonable suspicions that the appellant had committed serious misconduct in the workplace), which was appropriate to the aim pursued by the company (to verify whether the employee had actually committed the acts and if so to take relevant disciplinary measures), and was necessary (since the recordings would be used as evidence of the wrongdoing) and proportionate (the cameras were only zoomed in on the checkout counters and solely for a limited period of time, sufficient to verify that it was not a one-off act or a misunderstanding but indeed repeated unlawful conduct).”
Using a similar line of reasoning, the High Court arrived at the same conclusion in its judgment of 24 February 2011, in the proceedings concerning the second, third, fourth and fifth applicants. 35. With regard to the third, fourth and fifth applicants, the High Court upheld the Employment Tribunal’s conclusion that the settlement agreements were valid and that no defects in consent could be found, noting in particular that the agreements had been signed in the presence of the union representative and that their wording left no doubt as to the employees’ knowledge of the facts or their willingness to accept the termination of their employment contracts. 36. The High Court noted, however, that it was not procedurally correct to consider, as the Employment Tribunal had done, that the signing of the agreements had deprived the applicants of their right to take legal action. It took the view that it nevertheless appeared from these agreements that they had expressly acknowledged the facts of which they were accused, that they had accepted the employer’s decision to discontinue their employment and that they had thus given their consent to the termination of their contracts. It therefore reached the conclusion, with reference to case-law of the Supreme Court relating to similar agreements entered into by the same employer with other employees, that the employment contracts had been terminated by mutual agreement. In its view, this was sufficient to consider the facts to be established and the termination of the employment contracts to be lawful, regardless of whether the video recordings were lawful and could be admitted in evidence, a question to which the court had in fact responded in the affirmative. 37. Moreover, in response to the ground of appeal raised by all the applicants to the effect that the evidence was insufficient to establish the facts, the High Court noted that the facts were proven by the video recordings, by the testimony of the union representative to whom several employees had admitted the thefts, and by the acknowledgment of the facts in the settlement agreements, in the cases of the three applicants who had signed them. As regards more specifically the first applicant, whose face did not appear in the video footage, the court found that an analysis of the recordings of the cameras directed towards the till at which she worked and the sales receipts sufficiently demonstrated her involvement in the acts of which she was accused. 38. After examining the other grounds of appeal put forward by the applicants in support of their claims, the High Court concluded that the dismissals were lawful and upheld the judgments handed down at first instance. The proceedings before the Supreme Court and the Constitutional Court
39. The applicants brought appeals on points of law, which were declared inadmissible on 5 October 2011 and 7 February 2012 respectively. Ultimately the applicants lodged amparo appeals with the Constitutional Court, which were declared inadmissible on 27 June and 18 July 2012 respectively, owing to the “non-existence of a violation of a fundamental right”. The criminal proceedings against the applicants
40. On 31 July 2009, after the applicants and other employees had appealed against their dismissals before the Employment Tribunal, the employer filed a criminal complaint against fourteen employees, including the five applicants. Criminal proceedings were opened against them. On 15 July 2001, finding that the investigation had not established that there had been any concerted action between the defendants in committing the offences, and that the value of the goods stolen by each defendant had not exceeded EUR 400, the investigating judge decided to reclassify the charges as a minor offence (falta). In a decision of 27 September 2011 the judge declared that the prosecution was time-barred on account of the statutory limitation of proceedings for that type of offence. RELEVANT DOMESTIC LAW AND PRACTICEThe Spanish Constitution

41. The relevant provisions of the Spanish Constitution read as follows:
Article 18
“1. The right to respect for honour, for private and family life and for one’s own image shall be guaranteed.
... 4. The law shall restrict the use of data processing in order to guarantee respect for the honour and private and family life of citizens and the full exercise of their rights.”
Article 24
“1. Everyone has the right to effective protection by judges and the courts in the exercise of his or her legitimate rights and interests, and in no case may defence rights be curtailed. 2. Likewise, everyone has the right to ... a public trial without undue delay and with full guarantees ...”
Article 33
“1. The right to private ownership ... shall be recognised.”
Article 38
“Free enterprise shall be recognised within the framework of a market economy. ...”
Relevant provisions of labour law
42. The Labour Regulations (Estatuto de los Trabajadores), approved by Royal Legislative Decree no. 1/1995 of 24 March 1995, as in force at the relevant time, provided in particular as follows:
Article 5 – Workers’ duties
“Workers have the following basic duties:
(a)  To fulfil the obligations inherent in their post, in keeping with the principles of good faith and diligence.
...”
Article 20
“2.  ... In all cases, the worker and the employer shall be bound by the requirement of good faith in the fulfilment of their reciprocal obligations. 3. An employer may use monitoring and surveillance measures which it deems most appropriate to verify that an employee is fulfilling his or her employment duties, taking into account, in their adoption and application, of the consideration due to his or her human dignity ...”
43. The relevant provisions of the Employment Proceedings Act, approved by Royal Legislative Decree no. 2/1995 of 7 April 1995, as in force at the relevant time, read as follows:
Article 90
“1. The parties may rely on all the evidence prescribed by law ... save where it has been gathered directly or indirectly in breach of fundamental rights and freedoms.
...”
Article 108
“... 2. A dismissal based on any of the grounds of discrimination provided for by the Constitution or the law, or implemented in breach of fundamental rights and freedoms, shall be regarded as null and void.”
Relevant procedural provisions
44. Section 11 of Organic Law no. 6/85 of 1 July 1985 on the Judiciary provides as follows:
“1. The principle of good faith must be complied with in all proceedings. Evidence obtained, directly or indirectly in violation of fundamental rights or freedoms will be excluded ...”
Legislation regarding the protection of personal dataOrganic Law no. 15/1999

45. Organic Law no. 15/1999 on the protection of personal data (Ley Orgánica de protección de datos de carácter personal – the “Personal Data Protection Act”), as in force at the material time, was enacted on 13 December 1999 by transposing Directive 95/46/EC (see paragraph 63 below) and entered into force on 14 January 2000. Its aim was to safeguard the fundamental rights of individuals in connection with the processing of personal data, and more specifically their right to respect for their honour and their personal and family privacy (section 1 of the Act). It applied to the collection of personal data, defined as any information concerning identified or identifiable individuals recorded on a physical medium which may be subject to processing, and also covered the future usage of such data for public or private purposes (sections 2 and 3 of the Act). 46. The Spanish Data Protection Agency, created by the Act, is the authority responsible for the supervision of its application. In that capacity it is entitled to carry out inspections, examine complaints and impose penalties for contraventions of the Act, namely fines of up to EUR 600,000 (sections 35 et seq.). 47. The provisions of the Act concerning information and the consent of those concerned by the collection of their personal data, as applicable in the present case, read as follows:
Section 5 – Right to information on the collection of data
“1. Data subjects whose personal data are requested must be previously, explicitly, precisely and unambiguously informed of the following:
(a)  the existence of a personal data file or the fact that the data will be processed, the purpose thereof and the recipients of the information;
(b)  the obligatory or optional nature of their response to the questions asked;
(c)  the consequences of providing or refusing to provide the data;
(d)  the existence of rights of access, rectification, erasure and objection;
(e)  the identity and address of the controller or, as appropriate, his representative.
... 4. Where personal data have been collected without the data subject being approached, the person must be informed thereof in an express, precise and unequivocal manner by the file manager or his or her representative, within three months from the recording of the data, except where the data subject has already been informed of the content of the processing, the origin of the data, and the information referred to in letters (a), (d) and (e) of subsection 1 of the present section. 5. The provisions of the preceding subsection shall not apply in cases where the law expressly provides otherwise, where the data-processing has historical, statistical or scientific purposes, or where it is impossible to inform the data subject, or where this would involve a disproportionate effort in the opinion of the Data Protection Agency or the corresponding regional body, in view of the number of data subjects, the age of the data and the possible compensation measures. Furthermore, the provisions of the preceding subsection shall also not apply where the data are obtained from sources accessible to the public and are intended for advertising or market research, in which case each communication sent to the data subject shall inform him or her of the origin of the data, the identity of the person/entity responsible for processing the data and the rights of the data subject.”
Section 6 – Consent of data subjects
“1. Processing of personal data shall require the unambiguous consent of the data subject, unless laid down otherwise by law. 2. Consent shall not be required where the personal data are collected for the exercise of the functions proper to public authorities within the scope of their duties; where they relate to the parties to a contract or preliminary contract for a business, employment or administrative relationship, and are necessary for its maintenance or fulfilment; where the purpose of processing the data is to protect a vital interest of the data subject under the terms of section 7(6) of this Act or where the data are contained in sources accessible to the public and their processing is necessary to satisfy the legitimate interest pursued by the controller or that of the third party to whom the data are communicated, unless the fundamental rights and freedoms of the data subject are jeopardised.”
48. Under sections 13 to 18 of the Act, data subjects had, in particular, a right of access, rectification and deletion in respect of their personal data. Section 19 of the Act provided for a right to compensation as follows:
Section 19 – Right to compensation
“1. Persons who, as a result of any failure by the data-processing manager or controller, have sustained any damage to their property or to their rights, shall be entitled to compensation. ... 3. If the files are held by private-law entities, any proceedings shall be brought in the ordinary courts.”
49. On that basis a judgment of the Supreme Court ordered an employer to pay compensation to one of its former employees, who had been dismissed two years earlier, for providing potential employers with personal information concerning the employee’s dismissal and thus apparently reducing the employee’s chances of finding a new job (judgment no. 609/2015 of 12 November 2015). Instruction no. 1/2006
50. Instruction no. 1/2006 of 8 November 2006 on the processing of personal data for monitoring purposes using video-surveillance devices, issued by the Spanish Data Protection Agency, contains the following provisions:
Article 3 - Information
“Everyone who uses video-surveillance devices must fulfil all the obligations prescribed in section 5 of Organic Law no. 15/1999 of 13 December. For that purpose they must:
(a)  place at least a sufficiently visible information board in the areas monitored ... and
(b)  make available to the data subjects a document containing the information provided for in section 5.1 of Organic Law no. 15/1999 ...”
Article 4 – Principles of quality, proportionality and purpose of data processing
“1. In accordance with section 4 of Organic Law no. 15/1999 ..., images may only be processed if they are appropriate, relevant and not excessive in relation to the scope and to the legitimate and explicit aims justifying the installation of video-surveillance. 2. The installation of cameras ... is permitted only where the aim of the monitoring cannot be fulfilled, without disproportionate effort, by other means that would be less intrusive for the privacy of individuals and their right to the protection of personal data.
3.  ... In all situations, any data processing should be avoided if it is not necessary for the aim pursued.”
51. The website of the Data Protection Agency, moreover, provides a factsheet on video-surveillance and a model board indicating the information required by law. Law no. 3/2018
52. Law no. 15/1999 was repealed by a new Organic Law, no. 3/2018, on the protection of personal data and the safeguarding of digital rights, enacted on 5 December 2018, which entered into force on 7 December 2018. Section 22 of the new Law expressly governs the processing of personal data collected by means of video-surveillance. It provides in particular as follows:
“4. The obligation to provide information under Article 12 of Regulation (EU) 2016/679 is deemed to be fulfilled by the placing of an information board in a sufficiently visible place, indicating at least the existence of the processing, the identity of the person responsible and the possibility of exercising the rights provided for by Articles 15 to 22 of Regulation (EU) 2016/679. ...”
53. As regards video-surveillance in the workplace, section 89(1) of the Law provides as follows:
“1. Employers are entitled to process images obtained by means of video-surveillance devices in the exercise of their authority to monitor employees or officials, as laid down in Article 20 § 3 of the Labour Regulations ... provided that this possibility is used in the statutory framework and within its inherent limits. Employers must inform employees or officials of the introduction of such a measure beforehand and in an explicit, clear and concise manner. In the event that CCTV cameras film employees or officials clearly committing an illegal act, the obligation to provide information shall be deemed fulfilled when at least the mechanism provided for in section 22(4) hereof has been put in place.”
Case-law of the Constitutional Court
54. On 10 July 2000 the Constitutional Court delivered a leading judgment on the lawfulness of video-surveillance in the workplace in the light of the protection provided by Article 18 § 1 of the Spanish Constitution (judgment no. 186/2000). In that case the employer had set up a system of hidden CCTV cameras in the ceiling of the clothing and footwear department of a shop, directed towards three tills and the reception desk. The Constitutional Court held that the measure at stake had to pass a threefold test to be considered acceptable: there had to be a legitimate aim (“appropriateness test”), and the measure had to be necessary (“necessity test”) and proportionate (“strict proportionality test”). In other words, the courts had to ascertain whether a fair balance had been struck between the interference with a fundamental right and the importance of the legitimate aim pursued. On the subject of the video-surveillance at issue in that case, it found as follows:
“In the present case, the covert video-surveillance ... was a justified measure (since there was a reasonable suspicion that the person investigated had committed some wrongdoing at work); it was suited to the purpose pursued by the company (to verify that the worker was in fact committing the suspected wrongdoing, in which case he would be subjected to an appropriate disciplinary sanction); it was necessary (the recordings were to be used as evidence of the wrongdoing); and it was proportionate (since the cameras were only zoomed in on the checkout counters and solely for a limited period of time) ... ; it follows that there has been no interference with the right to [respect for] privacy as enshrined in Article 18.1 of the Spanish Constitution.”
55. As to the alleged failure to inform the employees and the staff committee, the Constitutional Court found that it was a question of ordinary legality that was not pertinent in terms of the constitutional protection of fundamental rights. The facts of the case nevertheless predated the entry into force of the Personal Data Protection Act in January 2000 and, at that time, the applicable law did not lay down any obligation to provide information that was comparable to the obligation subsequently enshrined in section 5(1) of that Act. 56. In a previous judgment of 10 April 2000 (no. 98/2000), applying a similar proportionality test, the Constitutional Court had taken the view that video and audio recording devices placed at the checkout and on a gaming table in a casino, complementing the existing security system, had been a disproportionate measure in view of the resulting major interference with the right of employees and customers to respect for their private life. The court noted that the employer had failed to show how the sound recording, which was particularly intrusive for the right to privacy of those concerned, had been necessary for the protection of its legitimate rights and interests. 57. Subsequently, in judgment no. 29/2013 of 11 February 2013, which concerned events after the Personal Data Protection Act had entered into force, the Constitutional Court held that the permanent installation of a video-surveillance system, initially as a security measure for the purpose of monitoring employees’ activity, required that the workers’ representatives and employees be given prior notification and that a failure to do so would be in breach of Article 18 § 4 of the Constitution. In that case, an employee of Seville University had been suspended from his duties without pay for unjustified late arrivals and absences that had been established by means of video-surveillance installed with the approval of the administration. The Constitutional Court found as follows:
“7. ... In conclusion, it must not be overlooked that the [Constitutional Court has] established, in an invariable and continuing manner, that an employer’s power is limited by fundamental rights (among many other [authorities], STC no. 98/2000, of 10 April, legal ground no. 7, or STC no. 308/2000, of 18 December, legal ground no. 4). Consequently, in the same way that the ‘public interest’ behind the punishment linked to an administrative offence is not enough to allow the State to deprive the citizen concerned of his or her rights derived from [sections 5(1) and (2) of the Personal Data Protection Act] (STC 292/2000, of 30 November, legal ground no. 18), the ‘private interest’ of an employer cannot justify using the worker’s personal data to his or her detriment without previously informing him or her of the monitoring measures that have been implemented. There is no reason in the employment sphere ... to restrict the right to be informed, a fundamental right that is protected by Article 18.4 of the Constitution. Accordingly, it is not enough that the data processing itself is lawful, being prescribed by law (section 6(2) of the Personal Data Protection Act), or proves, in a given case, to be proportionate to the aim pursued; monitoring by the employer, while certainly possible, must also guarantee the requisite prior information. 8. In the instant case, the CCTV cameras installed on the campus recorded the appellant’s image and allowed [the employer] to verify the appellant’s compliance with the working time [regulations] ... The owner of the cameras was Seville University and it was this entity that used the recordings, thus becoming the entity responsible for processing the appellant’s data without previously informing him of the use of cameras to monitor his work. This infringed Article 18.4 of the Constitution. The fact that signs were put up indicating the existence of a video-surveillance system on the campus, or that the Data Protection Agency had been informed of the installation of the system, does not detract from this conclusion. The employees, moreover, should have been informed, beforehand and in an express, precise and unambiguous manner, that the system could be used to monitor their work. The information should specify the characteristics and scope of the data processing, indicating the situations in which the images could be examined, together with the time-frame and purpose, specifically stating that the images could be used to impose disciplinary sanctions on the workers for non-compliance with the contract of employment.”
58. In a judgment of 3 March 2016 (no. 39/2016) the Constitutional Court consolidated its case-law concerning the use of hidden surveillance cameras. In this case the manager of a clothing shop had detected some thefts from the till and suspected one of its employees. He had temporarily installed hidden cameras zoomed in on the area where the till was located. The employer had placed a sign indicating in a general manner the presence of CCTV cameras, including the information provided for by section 5 of the Personal Data Protection Act, as required by Article 3 of Instruction no. 1/2006 issued by the Spanish Data Protection Agency. The Constitutional Court explained in the following terms the relevance of the fulfilment of the obligation to provide information under section 5 of that Act:
“4.  ... as has been emphasised, even though the express consent of the employee is not required to implement a monitoring measure which involves the processing of [personal data], the obligation to provide information under section 5 of the Personal Data Protection Act remains. Without prejudice to any legal sanctions which may be entailed by an employer’s failure to comply with the obligation, for it to constitute a violation of Article 18.4 of the Constitution it is necessary to ascertain whether the proportionality principle has been upheld. The right to data protection should be weighed in the balance against any limitations that may be justified by the employee’s work obligations and the corresponding power of monitoring and supervision granted to the employer by Article 20.3 of the Labour Regulations, in relation to Articles 33 and 38 of the Constitution. The assessment of the constitutional relevance of a total or partial lack of information in cases of video-surveillance in the workplace requires the balancing in each case of the competing constitutional rights and values: on the one hand the employees’ right to the protection of personal data and, on the other, the employer’s management power, which, essential as it is to the proper running of a productive organisation, reflects the constitutional rights recognised in Articles 33 and 38 of the Constitution and ... is enshrined in Article 20.3 of the Labour Regulations, which expressly empower the employer to adopt monitoring and supervision measures in order to verify that the workers comply with their employment duties ... This general monitoring power provided for by law legitimises the supervision carried out by the employer of the employees’ performance of their professional tasks (see ... the judgment of the European Court of Human Rights Bărbulescu v. Romania of 6 [sic] January 2016), without prejudging the particular circumstances of each case, which will determine whether or not the monitoring implemented by the employer has entailed a violation of the fundamental right at stake. It is clear that, in order to ascertain whether the proportionality test is satisfied where the provision of information is insufficient or absent, it will be necessary first to determine, in each case, whether there has actually been a failure in the duty to provide information.”
59. In that case the Constitutional Court found that there had been no violation of Article 18 § 4 of the Constitution, in particular on the ground that the employer had placed a board indicating that video-surveillance was in place, in accordance with the regulations. It considered that the board contained sufficient information as to the existence of monitoring and the purpose of the data processing. After examining the proportionality of the interference with the employee’s private life, using the criteria laid down in the case-law (see paragraph 54 above), it further found that there had not been any breach of the right to personal privacy protected by Article 18 § 1 of the Constitution. RELEVANT EUROPEAN AND INTERNATIONAL LAWCouncil of EuropeConvention for the Protection of Individuals with regard to Automatic Processing of Personal Data

60. This Convention (ETS No. 108) entered into force on 1 October 1985, having been ratified by Spain on 31 January 1984. Under Article 1, its purpose is to secure in the territory of each State Party, for every individual, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him. It provides, inter alia, as follows:
Article 5 – Quality of data
“Personal data undergoing automatic processing shall be:
a.  obtained and processed fairly and lawfully;
b.  stored for specified and legitimate purposes and not used in a way incompatible with those purposes;
c.  adequate, relevant and not excessive in relation to the purposes for which they are stored;
d.  accurate and, where necessary, kept up to date;
e.  preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored. ...”
Article 8 – Additional safeguards for the data subject
“Any person shall be enabled:
a.  to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
b.  to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
c.  to obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this Convention;
d.  to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.”
The Venice Commission
61. In 2007 the Venice Commission, the Council of Europe’s advisory body on constitutional matters, adopted an Opinion on “video surveillance by private operators in the public and private spheres and by public authorities in the private sphere and human rights protection” at its 71st plenary session (Venice, 1-2 June 2007, CDL-AD(2007)027). The relevant parts read as follows:
“18. For the purposes of this study, the private sphere will also include workplaces and the use of video surveillance in workplace premises, which raises legal issues concerning the employees’ privacy rights.
... 52. As regards workplaces, the introduction of video monitoring requires respecting the privacy rights of the employees. 53. Here, video surveillance would, in general, be allowed to prevent or detect fraud or theft by employees in case of a well-founded suspicion. However, except in very specific circumstances, videotaping would not be allowed at places such as toilets, showers, restrooms, changing rooms, or smoking areas and employee lounges where a person may trust to have full privacy. 54. Moreover, secret surveillance should only be allowed, and then only on a temporary basis, if proven necessary because of lack of adequate alternatives.
... 57. As regards shops, camera surveillance may be justified to protect the property, if such a measure has proven to be necessary and proportional. It may also be justified at certain locations in the shop to prevent and prosecute robberies under threat but, again, only if proven necessary, and no longer than necessary. 58. National legislation will have to clearly define the legal basis of the surveillance and the necessity of the infringement in view of the interests protected.
... ”
IV. Conclusions and recommendations
“ ... 99. The Venice Commission would hence reiterate the Recommendations made in its previous study:
- Video surveillance [performed on grounds of security or safety requirements, or for the prevention and control of criminal offences], shall respect the requirements laid down by Article 8 of the ECHR.
- With regard to the protection of individuals concerning the collection and processing of personal data, the regulations shall at least follow the requirements laid down by Directive 95/46/EC, especially its Articles 6 and 7 which are based on Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data in its Article 5. 100. Furthermore the Commission recommends, in view of the specificities of video surveillance, that the following measures should also be taken on a systematic basis:
- People should be notified of their being surveyed, unless the surveillance system is obvious. This means that the situation has to be such that the person observed may be assumed to be aware of the surveillance, or has unambiguously given his /her consent.”
The Committee of Ministers
62. On 1 April 2015, at the 1224th meeting of the Ministers’ Deputies, the Committee of Ministers of the Council of Europe adopted Recommendation CM/Rec(2015)5 on the processing of personal data in the context of employment. The relevant extracts provide as follows:
10. Transparency of processing
“10.1. Information concerning personal data held by employers should be made available either to the employee concerned directly or through the intermediary of his or her representatives, or brought to his or her notice through other appropriate means.
10.2. Employers should provide employees with the following information:
– the categories of personal data to be processed and a description of the purposes of the processing;
– the recipients, or categories of recipients of the personal data;
– the means employees have of exercising the rights set out in principle 11 of the present recommendation, without prejudice to more favourable ones provided by domestic law or in their legal system;
– any other information necessary to ensure fair and lawful processing. ...”
15. Information systems and technologies for the monitoring of employees, including video surveillance
“15.1. The introduction and use of information systems and technologies for the direct and principal purpose of monitoring employees’ activity and behaviour should not be permitted. Where their introduction and use for other legitimate purposes, such as to protect production, health and safety or to ensure the efficient running of an organisation has for indirect consequence the possibility of monitoring employees’ activity, it should be subject to the additional safeguards set out in principle 21, in particular the consultation of employees’ representatives.
15.2. Information systems and technologies that indirectly monitor employees’ activities and behaviour should be specifically designed and located so as not to undermine their fundamental rights. The use of video surveillance for monitoring locations that are part of the most personal area of life of employees is not permitted in any situation.”
21. Additional safeguards
“For all particular forms of processing, set out in Part II of the present recommendation, employers should ensure the respect of the following safeguards in particular:
a.  inform employees before the introduction of information systems and technologies enabling the monitoring of their activities. The information provided should be kept up to date and should take into account principle 10 of the present recommendation. The information should include the purpose of the operation, the preservation or back-up period, as well as the existence or not of the rights of access and rectification and how those rights may be exercised;
b.  take appropriate internal measures relating to the processing of that data and notify employees in advance;
c.  consult employees’ representatives in accordance with domestic law or practice, before any monitoring system can be introduced or in circumstances where such monitoring may change. Where the consultation procedure reveals a possibility of infringement of employees’ right to respect for privacy and human dignity, the agreement of employees’ representatives should be obtained;
d.  consult, in accordance with domestic law, the national supervisory authority on the processing of personal data.”
European Union materialDirective 95/46/EC

63. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in its relevant parts, provides:
Article 6
“1. Member States shall provide that personal data must be:
(a)  processed fairly and lawfully;
(b)  collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
(c)  adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e)  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. ...”
Article 7
“Member States shall provide that personal data may be processed only if:
(a)  the data subject has unambiguously given his consent; or
(b)  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
(c)  processing is necessary for compliance with a legal obligation to which the controller is subject; or
(d)  processing is necessary in order to protect the vital interests of the data subject; or
(e)  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
(f)  processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject ...”
Article 10 – Information in cases of collection of data from the data subject
“Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:
(a)  the identity of the controller and of his representative, if any;
(b)  the purposes of the processing for which the data are intended;
(c)  any further information such as
- the recipients or categories of recipients of the data, ...
- the existence of the right of access to and the right to rectify the data concerning him ...”
Article 11 – Information where the data have not been obtained from the data subject
“1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:
(a)  the identity of the controller and of his representative, if any;
(b)  the purposes of the processing;
(c)  any further information such as
- the categories of data concerned,
- the recipients or categories of recipients,
- the existence of the right of access to and the right to rectify the data concerning him
in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject. ...”
Article 13 – Exemptions and restrictions
“1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6 (1), 10, 11 (1), 12 and 21 when such a restriction constitutes a necessary measures to safeguard:
(a)  national security;
(b)  defence;
(c)  public security;
(d)  the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
(e)  an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
(f)  a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);
(g)  the protection of the data subject or of the rights and freedoms of others.”
Article 22 – Remedies
“Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.”
Article 23 – Liability
“1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered. ...”
The Data Protection Working Party
64. A Data Protection Working Party was established under Article 29 of Directive 95/46/EC in order to contribute to the uniform implementation of its provisions. It is an independent EU advisory body. In September 2001 it issued Opinion 8/2001 on the processing of personal data in an employment context, which summarises the fundamental principles of data protection: purpose, transparency, legitimacy, proportionality, accuracy, security and staff awareness. With regard to the monitoring of employees, it recommended as follows:
“Any monitoring, especially if it is conducted on the basis of Article 7(f) of Directive 95/46/EC and, in any case, to satisfy Article 6 must be a proportionate response by an employer to the risks it faces taking into account the legitimate privacy and other interests of workers. Any personal data held or used in the course of monitoring must be adequate, relevant and not excessive for the purpose for which the monitoring is justified. Any monitoring must be carried out in the least intrusive way possible. It must be targeted on the area of risk, taking into account that data protection rules and, where applicable, the principle of secrecy of correspondence. Monitoring, including surveillance by camera, must comply with the transparency requirements of Article 10. Workers must be informed of the existence of the surveillance, the purposes for which personal data are to be processed and other information necessary to guarantee fair processing. The Directive does not treat less strictly monitoring of a worker’s use of an Internet and email system if the monitoring takes place by means of a camera located in the office.”
65. Another opinion, issued on 11 February 2004, “on the Processing of Personal Data by means of Video Surveillance” (opinion no. 4/2004), pointed out that Directive 95/46/EC applied to such means and that the proportionality principle had to be upheld both in the decision to use it and for the processing of the personal data thus obtained. As regards video-surveillance in the workplace, it explained as follows:
“In addition to the considerations made in the above documents, to the extent that they are actually applicable to video surveillance, it is appropriate to point out that video surveillance systems aimed directly at controlling, from a remote location, quality and amount of working activities, therefore entailing the processing of personal data in this context, should not be permitted as a rule. The case is different as regards video surveillance systems that are deployed, subject to appropriate safeguards, to meet production and/or occupational safety requirements and also entail distance monitoring – albeit indirectly. The implementing experience has shown additionally that surveillance should not include premises that either are reserved for employees’ private use or are not intended for the discharge of employment tasks – such as toilets, shower rooms, lockers and recreation areas; that the images collected exclusively to safeguard property and/or detect, prevent and control serious offences should not be used to charge an employee with minor disciplinary breaches; and that employees should always be allowed to lodge their counterclaims by using the contents of the images collected. Information must be given to employees and every other person working on the premises. This should include the identity of the controller and the purpose of the surveillance and other information necessary to guarantee fair processing in respect of the data subject, for instance in which cases the recordings would be examined by the management of the company, the recording period and when the recording would be disclosed to the law enforcement authorities. The provision of information for instance through a symbol can not be considered as sufficient in the employment context.”
The General Data Protection Regulation
66. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, has been applicable since 25 May 2018. It incorporates most of the provisions of Directive 95/46/EC and reinforces some of the safeguards contained therein. COMPARATIVE-LAW MATERIAL
67. The following information was gleaned from the Court’s research into the legislation of the member States of the Council of Europe, and in particular a study covering forty-two States. 68. The twenty-eight member States of the European Union have legislation transposing Directive 95/46/EC. Among them, twenty-one States have adopted instruments specifically regulating video-surveillance in the workplace. The majority of States which have such rules prohibit covert video-surveillance. Some of them (Germany, United Kingdom) allow it, however, in the event of suspicion of a criminal offence or serious misconduct. 69. As regards the States which are not members of the EU, seven of them have specific rules on video-surveillance in the workplace, three States have regulations on video-surveillance in general and five States have only general legislation on the collection and processing of personal data. The States which have specific rules require that such monitoring should have a legitimate purpose and that the employees should be informed. In one State (Switzerland) covert video-surveillance may be used in the case of suspicion of an offence. 70. Almost all States enable any person who has been the subject of video-surveillance to go before the courts to seek compensation for any damage sustained and/or an order to terminate the monitoring or delete the data obtained by that means. In some countries, criminal liability may also be engaged. In all member States of the European Union and in ten of the other States, it is possible to complain to an independent authority for the protection of personal data, which has powers to investigate and impose sanctions. THE LAW
PRELIMINARY ISSUESLocus standi

71. The Court observes that the second applicant, Ms A. Gancedo Giménez, died on 25 October 2018, while the case was pending before the Grand Chamber. Her husband and legal heir, Mr J. López Martínez, expressed his wish to continue the proceedings before the Court. 72. The Court would point out that, in a number of cases where an applicant died during the proceedings, it has taken account of the wish expressed by heirs or close relatives to continue them (see, among other authorities, Malhous v. the Czech Republic (dec.) [GC], no. 33071/96, ECHR 2000‑XII; Angelov v. Bulgaria, no. 44076/98, § 28, 22 April 2004; and Nicola v. Turkey, no. 18404/91, § 15, 27 January 2009). 73. In the present case, the Court finds that the heir of the second applicant may have a sufficient interest in the continued examination of the application and thus recognises his capacity to act in her stead. Subject matter of the case before the Grand Chamber
74. In their oral observations before the Grand Chamber, the Government requested that the Court should only re-examine the complaint under Article 8 of the Convention, in respect of which the Chamber had found a violation in its judgment of 9 January 2018 and which was the subject of the Government’s request for referral, as accepted by the panel of the Grand Chamber. They added that the applicants had not submitted any referral request concerning the complaints under Article 6, in respect of which the Chamber had found no violation. 75. The applicants did not comment on the Government’s request but nevertheless asked the Court to review the Chamber’s finding of no violation. 76. The Court reiterates that the content and scope of the “case” referred to the Grand Chamber are delimited by the Chamber’s decision on admissibility (see K. and T. v. Finland [GC], no. 25702/94, §§ 140-41, ECHR 2001‑VII, and Ilnseher v. Germany [GC], nos. 10211/12 and 27505/14, § 100, 4 December 2018). The “case” referred to the Grand Chamber thus necessarily encompasses all the aspects of the application that the Chamber found admissible and is not confined to the “serious issue” of general importance or affecting the interpretation or application of the Convention or the Protocols thereto, under Article 43 of the Convention, in respect of which the referral request has been accepted by the panel (see K. and T. v. Finland, cited above, §§ 140-41). Accordingly, in the present case, the Grand Chamber’s examination will concern all the complaints under Articles 6 and 8 of the Convention that were declared admissible by the Chamber. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
77. The applicants argued that their employer’s decision to dismiss them had been based on recordings obtained by means of video-surveillance in their workplace, in breach of their right to respect for their private life, and that, by refusing to declare their dismissal null and void, the domestic courts had failed in their duty to protect that right. They relied on Article 8 of the Convention, which reads as follows:
“1. Everyone has the right to respect for his private ... life ... 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
The Chamber judgment
78. In its judgment of 9 January 2018 the Chamber found that Article 8 of the Convention was applicable in the present case. As the disputed video-surveillance measure had been implemented by a private party, it examined the complaint in terms of the State’s positive obligations and sought to ascertain whether the national authorities had struck a fair balance between the applicants’ right to respect for their private life, on the one hand, and their employer’s interest in protecting its rights in connection with the organisation and management of its property, on the other. 79. The Chamber noted that, while the video-surveillance had been set up on account of legitimate suspicions of theft, it had been broad in scope – not being limited in time, affecting all the employees working at the tills and covering all working hours – and had breached the obligation under domestic law to give prior information, to those persons who were concerned by the collection and processing of their personal data, of the existence, purpose and implementation of the measures. Having regard to those factors, the Chamber did not share the opinion of the domestic courts as to the proportionality of the video-surveillance measure taken by the employer. It was of the view, in particular, that the employer’s rights could have been secured by informing the applicants, even in a general manner, of the installation of a video-surveillance system. 80. Consequently, the Chamber found that the domestic courts had failed to strike a fair balance between the applicants’ right to respect for their private life and the other interests at stake, and that there had thus been a violation of Article 8 of the Convention. The Government’s preliminary objection
81. The Government argued that the applicants could have complained to the Data Protection Agency, alleging an infringement by the employer of the Personal Data Protection Act, or could have brought criminal proceedings to complain of a breach of their right to respect for their private life. In their view, those remedies could have resulted in the imposition of an administrative or criminal sanction on the employer. They concluded that the applicants had failed to exhaust the domestic remedies available under domestic law. 82. The applicants submitted that the Data Protection Agency was merely an administrative organ whose authority was confined to imposing pecuniary sanctions in the event of a breach of the data-protection legislation. They took the view that such a sanction, if it were to be imposed on their employer, would not bring them redress for the damage caused to them by the breach of their right to respect for their private life and by their dismissal based on that breach. They added that it was not mandatory to complain to the Agency before the ordinary courts, which had full jurisdiction to interpret and apply the Personal Data Protection Act. 83. The Court notes that the Government only raised the issue of non-exhaustion of domestic remedies for the first time in their written pleadings before the Grand Chamber. It discerns no exceptional circumstances in this case which could have released them from their obligation pursuant to Rule 55 to raise their preliminary objection prior to the adoption of the Chamber’s decision on admissibility. It thus takes the view that the Government are estopped from raising that objection at this stage of the proceedings and that it must be dismissed (see Navalnyy v. Russia [GC], nos. 29580/12 and 4 others, § 61, 15 November 2018). 84. However, in so far as the parties’ arguments on the objection of non-exhaustion raised by the Government have a bearing on the merits of the applicants’ complaint under Article 8 of the Convention, the Court will examine them below. Applicability of Article 8 of the ConventionThe parties’ submissions

(a)   The applicants
85. The applicants submitted that the fact they had been continuously filmed in their workplace throughout their entire working day, without their knowledge and without being able to evade the monitoring, resulted in Article 8 of the Convention being applicable. (b)   The Government
86. The Government argued that the applicants had been working in a public place, in direct contact with the public. They took the view that, in the absence of a consensus among the member States as to whether such a situation was comprised within the notion of “private life”, the Court should not extend that concept accordingly. They added that the protection of Article 8 could not extend to criminal conduct.

Outcome for Article 6: no_violation