Does an employer have to notify an employee who has been covertly recorded by a colleague of the existence of the recording?

One thing we often get asked is if a meeting can be recorded and if so do we need to tell the employee. Assuming what you describe amounts to personal data processing, the employee who raised the grievance created the data, but the employer will become a processor of that data when it receives it from the employee and controller of the data when it uses it during the grievance process (in so far as it has to determine "how" and "why" it will process the employee's recording). In doing so, the employer will need to comply with its data protection obligations in relation to the data.

There are competing employment law and data protection rights in the situation you describe (between the employee bringing the grievance and the employees who were recorded). The employer will need to consider those rights on the facts when deciding how to proceed, in particular its obligations to the recorder as well as the employees who were recorded. If it's sensitive personal data belonging to any of the employees, there will be additional obligations. For a similar situation of competing rights, albeit in relation to a data subject access request.

The employer will also need to take into account whether the employee who recorded the conversations is happy for the recordings to be disclosed to the supervisors or not. If the recorder wants to rely on the information, meaning the employer has to process it during the grievance, then the employer would have some obligation to disclose it to the other managers. Setting aside GDPR, from an employment law perspective it would be hard to conduct a proper grievance investigation if they didn't disclose the recordings.

Furthermore, if the grievance results in disciplinary action being taken against the supervisors, the question arises as to what extent the supervisors should be entitled to see the documentation relating to the grievance. However, if the employee says that they do not want the recordings disclosed (bearing in mind they are their personal data too), then the employer may be in the position of needing to disclose the recording to the supervisors even though it cannot rely on consent under Article 6 to disclose them. It would therefore need another ground for processing the data (that is, disclosing it to the supervisors) under the GDPR and may wish to consider if there is an exemption that would apply.

It may be that exemptions to having to fully comply with the GDPR are available to the employer. As personal data in the recording needs to be processed in connection with the grievance proceedings and potentially, a tribunal claim, it could consider whether paragraph 5(2) or (3) of Part 1 of Schedule 2 to the Data Protection Act 2018 applies to exempt them complying with the GDPR provisions listed in paragraph 1 of Part 1 of Schedule 2 (the "listed provisions"). These include Articles 13 and 14 of the GDPR and the requirement to provide the supervisors with information about the processing of any personal data concerning them, in the employee's recording.

The controllers will still be obliged to comply with the lawful processing requirement under Article 5(1)(a) of the GDPR and they will require a legal basis under Article 6(1) of the GDPR, to legitimise the processing of the personal data. Legal bases to consider are:

• Article 6(1)(c), the processing is necessary for compliance with a legal obligation to which the controller is subject. This could apply where the controller's overall purpose must be to comply with a legal obligation which has a sufficiently clear basis in either common law or statute.
• Article 6(1)(f), the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. This could include processing associated with an employment, but the interest pursued by the controller must be balanced against the rights and freedoms of the supervisors. If they would not reasonably expect the controller to use their personal data in that way, or it would cause them unwarranted harm, their interests are likely to override the controller's interest and the controller would be unable to rely on Article 6(1)(f).

There is also the issue of whether having made the recordings is a breach by the employee of their data protection obligations and whether by disclosing them the employer could be exposing them to problems, although we flag this purely for completeness and doubt that will be a good reason for the employer not to comply with its own GDPR obligations.