Can I Get Covert Surveillance for Corporate Investigations in the UK?

Understanding when covert surveillance may be lawful, what it can achieve, and the considerations businesses should address before commissioning an investigation.

When a business suspects fraud, theft, serious misconduct, a breach of contractual obligations or other wrongdoing, it may need to establish what is actually happening before deciding how to respond.

In some circumstances, covert surveillance may help establish facts that cannot readily be determined through conventional enquiries. However, the decision to conduct covert surveillance should never be based solely on suspicion, curiosity or the availability of surveillance technology.

So, can you commission covert surveillance for a corporate investigation in the UK?

Yes, covert surveillance can be undertaken for certain corporate investigations, provided the proposed activity is lawful, justified and proportionate to the circumstances. Whether it is appropriate depends on the nature of the suspected wrongdoing, the individuals involved, the location, the methods proposed and the information being sought.

Understanding these considerations is essential for any organisation contemplating surveillance as part of an investigation.

What is covert surveillance?

Covert surveillance involves observing or monitoring a person, activity or situation in a manner intended to ensure that those being observed are unaware that surveillance is taking place.

In a corporate investigation, this might involve gathering information about suspected misconduct, activities inconsistent with contractual obligations, theft, fraud or the misuse of company resources.

The term covers a range of investigative activities. These may include discreet observation of activities in public places, surveillance of relevant movements and activities, or the use of appropriately authorised surveillance equipment in circumstances where its use is lawful.

Covert surveillance should not be confused with routine security monitoring, such as overt CCTV in a commercial building. Nor should it be confused with technical surveillance countermeasures (TSCM), which are concerned with identifying and mitigating technical surveillance threats.

The appropriate investigative method depends on the question that needs to be answered. Surveillance is one possible means of gathering evidence; it is not automatically the right solution to every corporate concern.

What types of corporate investigation might involve covert surveillance?

There is no single category of corporate investigation for which covert surveillance is automatically appropriate. Each case requires an assessment of its particular circumstances.

Examples of situations in which an organisation might consider whether surveillance is justified include:

1. Suspected employee misconduct

An employer may have reasonable grounds to suspect serious misconduct but lack sufficient information to establish what is happening.

Depending on the circumstances, an investigation might concern suspected theft, deliberate damage, fraud or other serious wrongdoing.

However, employers must take particular care when considering covert monitoring of employees. The Information Commissioner's Office (ICO) states that covert worker monitoring is unlikely to be justified in most usual circumstances and should be considered only in exceptional situations where there are appropriate grounds.

A legitimate concern does not, by itself, justify unrestricted monitoring of an employee's activities.

2. Suspected fraud or financial wrongdoing

Businesses may encounter circumstances in which information suggests that assets, funds or commercial resources are being misused.

An investigation may need to establish a reliable account of relevant activities, identify inconsistencies or corroborate information obtained through other enquiries.

Surveillance may form one part of a wider investigation, but it should not replace financial analysis, document examination, interviews or other appropriate investigative methods.

3. Breaches of contractual obligations

Organisations sometimes need to investigate suspected breaches of contractual or commercial arrangements.

Whether surveillance is suitable will depend on the nature of the obligation, the information already available and whether the proposed activity can lawfully establish relevant facts.

It is important to distinguish between a genuine investigative need and an attempt to monitor someone's private life simply because a commercial relationship has deteriorated.

4. Misuse of business premises or assets

A business may suspect that its premises, equipment, stock or other assets are being used improperly.

Before considering covert surveillance, the organisation should assess what information is already available through access records, stock audits, existing security systems and other less intrusive methods.

Where a specific concern remains unresolved, a properly scoped investigation may help establish what has occurred.

These examples are illustrative, not a list of circumstances in which surveillance is automatically lawful.

Is covert surveillance legal in the UK?

There is no blanket prohibition on covert surveillance by private organisations. Equally, there is no general permission to conduct surveillance simply because it relates to a business investigation.

The legal position depends on the proposed activity and the circumstances in which it will take place.

Several areas of law and regulation may be relevant.

Data protection and privacy

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 may apply when an investigation involves collecting, recording, storing or sharing personal information.

Organisations must identify an appropriate lawful basis for processing personal data and comply with the relevant data protection principles. Depending on the circumstances, this includes considering necessity, proportionality, fairness, transparency, data minimisation, security and retention.

The fact that information could help an employer or business does not automatically make its collection lawful.

The ICO's guidance on data protection and monitoring workers explains that covert worker monitoring should generally be considered only in exceptional circumstances. It identifies factors including reasonable grounds to suspect criminal activity or equivalent serious misconduct, the risk that informing workers would prejudice detection, senior management authorisation and a data protection impact assessment (DPIA).

Where an employer commissions a private investigator, it must also consider the respective data protection responsibilities of the organisation and the investigator, including appropriate contractual arrangements.

Human rights and reasonable expectations of privacy

The right to respect for private and family life under Article 8 of the European Convention on Human Rights, given effect in UK law through the Human Rights Act 1998, is particularly relevant to public authorities and may also be relevant in other legal contexts.

Private organisations must consider applicable privacy and data protection obligations, alongside any relevant contractual and employment-law duties.

An individual's reasonable expectation of privacy is an important consideration. Surveillance relating to activities in a public place may raise different issues from surveillance that intrudes into a person's home or other private setting.

The location, duration, intensity and nature of the surveillance all matter.

The Regulation of Investigatory Powers Act 2000 (RIPA)

RIPA is often mentioned in discussions about covert surveillance, but it is important to understand its scope.

Part II of RIPA provides a framework for the authorisation of certain covert surveillance activities by designated public authorities. It addresses, among other matters, directed and intrusive surveillance.

A private company commissioning an investigation does not acquire public-authority surveillance powers simply by hiring an investigator. The public-authority authorisation framework should not be confused with the separate legal obligations that apply to private investigators and their clients.

Other laws may also be relevant depending on the conduct involved, including legislation concerning unlawful interception, computer misuse, trespass and the handling of personal information.

Where a proposed investigation raises difficult legal questions, appropriate legal advice should be obtained before activity begins.

Does covert surveillance produce court-admissible evidence?

This is an important question, but it requires a distinction between gathering evidence and establishing whether that evidence can be used in legal proceedings.

Evidence obtained through surveillance is not automatically admissible simply because an investigation was commissioned professionally. Equally, the fact that information was obtained covertly does not, by itself, mean that it can never be used in proceedings.

Admissibility depends on the relevant legal proceedings, the nature of the evidence, the way it was obtained and any applicable legal rules. The weight given to the evidence is a separate question.

For evidence to be useful, investigators and their clients should consider matters such as:

• Relevance: Does the material address a specific issue that needs to be established?

• Authenticity: Can the origin and integrity of recordings, photographs or other material be demonstrated?

• Accuracy and context: Does the evidence provide a fair and sufficiently complete account of the relevant events?

• Record keeping: Are dates, times, observations and the circumstances of collection properly documented?

• Continuity and handling: Can the history of the evidence, including its transfer, storage and any relevant changes, be accounted for?

• Lawfulness: Were the investigative activities and subsequent processing or disclosure of the information lawful?

• Disclosure: Can the material be provided and explained appropriately if proceedings require it?

A recording or photograph may appear compelling in isolation but become less persuasive when its context, provenance or reliability cannot be established.

For organisations contemplating enforcement action, disciplinary proceedings or litigation, the objective should not simply be to obtain a recording. It should be to establish relevant facts through a defensible investigative process.

Where court proceedings are anticipated, legal advisers should be consulted about the applicable evidential requirements.

Should a business conduct covert surveillance itself or commission a specialist?

The answer depends on the organisation's capabilities, the complexity of the investigation and the nature of the proposed activity.

Businesses may already have legitimate security systems, access records, audit processes and internal investigation procedures. These should be considered before introducing a more intrusive investigative measure.

However, a specialist investigation may be appropriate where the facts remain unclear, the matter is particularly sensitive or the organisation lacks the expertise to plan and conduct the proposed enquiries.

An external investigator should understand the legal and ethical considerations relevant to the assignment, the limitations of the methods being used, and the importance of accurate records and evidence handling.

Commissioning an investigator does not transfer all responsibility away from the client. The organisation must still be able to justify its decision to commission the investigation and should ensure that the proposed work is appropriately scoped, authorised and documented.

Before proceeding, the client and investigator should agree the purpose of the investigation, the questions to be answered, the limits of the activity, the reporting arrangements and the handling of any personal information collected.

Five questions to ask before commissioning covert surveillance

Before authorising covert surveillance as part of a corporate investigation, an organisation should be able to address five fundamental questions.

1. What exactly are we trying to establish?

The investigation should have a clearly defined purpose. General suspicion or a desire to discover whether someone is doing something wrong is not a sufficiently precise investigative objective.

2. What information supports our concerns?

Identify the facts, reports or other information that give rise to the concern. Consider whether there are reasonable grounds for the proposed investigation and whether alternative explanations need to be explored.

3. Is surveillance necessary and proportionate?

Consider whether the same objective could reasonably be achieved through less intrusive means. The proposed scope, duration and methods should be justified by the circumstances.

4. Have we addressed the relevant legal and privacy obligations?

Consider data protection, employment law, privacy, contractual obligations and any other legal requirements relevant to the proposed activity. Where appropriate, involve senior management, the data protection officer and legal advisers.

5. How will the information be handled and used?

Establish how records will be secured, who may access them, how long they will be retained, how irrelevant information will be treated and how the findings may be used in any subsequent proceedings.

If these questions cannot be answered satisfactorily, the proposed investigation may require further consideration before it proceeds.

Covert surveillance is a means of establishing facts, not an end in itself

The decision to commission covert surveillance should be driven by the investigative objective, not by the availability of equipment or the assumption that hidden observation will provide a definitive answer.

Sometimes the appropriate response will be surveillance. In other cases, documentary analysis, interviews, financial enquiries, existing security records or a combination of investigative methods may be more suitable.

The most effective corporate investigations begin by identifying the issue, assessing the available information and determining what evidence is actually required. They then select methods that are appropriate to the circumstances and capable of being justified.

For organisations considering covert surveillance, the central question is therefore not simply, “Can we do this?”

It is: “Can we justify this investigation, conduct it lawfully and proportionately, and establish the facts in a way that will withstand appropriate scrutiny?”

That is the standard against which a proposed investigation should be assessed.

About SIASS

SIASS provides specialist investigative services, including covert surveillance, corporate investigations and commercial technical surveillance countermeasures training (TSCM). Our approach places importance on understanding the investigative objective, working within appropriate legal and ethical boundaries, and gathering information to help clients establish the facts.

To learn more about our services, visit www.siass.org.uk.

This article provides general information about UK law and investigative practice. It is not legal advice. The law and its application depend on the circumstances of each case; organisations should obtain appropriate professional advice before commissioning surveillance.