DPA/GDPR exemptions for covert recordings in order to detect crime?
Location - England.
I own a pub and have discovered a lot of high value stock has been taken from my cellar which only staff have access to.
Rare, high end whiskey, cognac and champagne have all disappeared over the last year. It has been a slow process and at first I thought the sign out procedure I had in place just wasn’t being followed, but I now know after an independent stocktake that someone who works for me is stealing. I just don’t know who.
I have CCTV on the door to the cellar but not inside the cellar itself. I could install CCTV in the cellar with clear signage and the thefts would probably stop immediately, but I have lost thousands over this.
I believe and hope that I treat my staff incredibly well. They all get paid well over the norm for hospitality so I would very much like to know which one is stealing from me, but I can’t accuse without evidence.
I have purchased a covert camera that's inside a smoke alarm that I am thinking of installing on the ceiling of area where the thefts are taking place in order to catch the thief in action, but I don’t know if that's legal under DPA/GDPR rules.
If I install this camera and I find the thief, can I fairly dismiss them? Could I end up in more trouble than it would be worth? Is there an exemption within GDPR/DPA legislation that allows you to do what I’m thinking of doing as long as I don’t share the footage to anyone other than the relevant authorities? If there is, could someone let me know what it is and where I can find it because I’ve had a look and can’t find anything concrete.