Article 3 and No. 1 (1) of Article 4 of Law 8/2005 (Personal Data Protection Act) provide that photos are personal data of identifiable persons, and as such their collection, storage etc. are processing of personal data which is subject to the provisions of the Act. Article 6 of the same Act provides that, processing such data can be appropriate only where it is provided for in law or with the consent of the data subject. Therefore, it is not appropriate for the employer to have taken video shots of the employee without the latter's knowledge. Unless the employer has made it clear in his statement that he would take pictures of the staff when they are suspected of breaching the work code, the employer may not do so for collecting evidences. Apart from that, it would be advisable to use cameras that are the property of the institution; otherwise, the image data derived should be processed as soon as possible, to prevent illicit access to the data by other people.