Covert Surveillance by Private Investigators in Ireland
- Martin Ryan
- 4 hours ago
- 9 min read
EXECUTIVE SUMMARY
Irish courts accept such evidence where it is gathered lawfully, proportionately, and in response to genuine concerns - such as suspected exaggeration or dishonesty. However, any intrusion into a claimant's privacy must be justified, and covert surveillance without cause is likely to backfire.
“The Role of Private Investigators in Personal Injury Litigation: A Vital Tool for Insurance Defence”
A Blog by Damian McGeady (Partner) - Lacey Solicitors
Link:
When used appropriately and ethically, surveillance can provide crucial clarity in contested personal injury cases—helping insurers, employers, and self-insured entities to challenge fraudulent or exaggerated claims while preserving fairness and legality. AND
Private investigators are not used to entrap or harass claimants. Their purpose is to objectively observe and document claimants’ day-to-day activities in public places, ensuring consistency with alleged injuries.
While most personal injury claims are legitimate, a small percentage involve inconsistencies between the reported symptoms and a claimant’s actual physical capabilities. This is where private investigators can play a key role—documenting evidence that may influence liability, quantum, or settlement negotiations.
In fact, many surveillance reports support the claimant’s version of events, confirming limitations in movement or pain behaviour. But in cases of exaggeration or fraud, this evidence can be game-changing.
Where appropriate, surveillance operatives can be called to give evidence in court. It is important to note that PI witnesses, are lay witnesses and not considered expert witnesses by the courts in Ireland. The role of the witness is simply to report on the basis of what was observed. It would be inappropriate for an investigator to proffer a view on an individual’s injuries in the context of their observations.
Video Surveillance
Video remains the gold standard. PIs may discreetly observe individuals in public settings - walking dogs, lifting bags, entering gyms, or playing sports. If such activities contradict the claimant’s injury reports, this can raise serious credibility issues.
Social Media Monitoring
Platforms like Facebook, TikTok, and Instagram offer a treasure trove of publicly available information. Our office has previously commented on “How Social Media Evidence Impacts Personal Injury Cases in Northern Ireland and the Republic of Ireland.”
A claimant posting holiday selfies or gym check-ins while claiming to be housebound may unknowingly undermine their own case.
It’s essential that investigators only access content that is publicly visible and refrain from unethical tactics like using false profiles or deceptive friend requests.
Legal and Ethical Framework in Ireland
Surveillance is not a free-for-all. Solicitors and insurers must ensure that investigations comply with:
GDPR and Data Protection Act 2018
Irish common law privacy rights
The Law Society of Ireland’s professional conduct rules
Some key legal limitations include:
Surveillance may only take place in public areas; entering or filming private property is strictly prohibited.
Pretexting—posing as a delivery driver or service provider—is unlawful and unethical.
Social media access must be limited to public content. Fake accounts or deception is never acceptable.
All investigators are licensed and insured;
Surveillance is conducted strictly within the legal and ethical parameters;
Instructions are documented, specific, and proportional to the claim;
All evidence is reviewed for admissibility and probative value;
Investigations are immediately suspended if there is any sign of misconduct.
Surveillance must be used strategically, never as a fishing expedition. The goal is fairness and factual clarity—not harassment or intimidation.
Surveillance evidence can be a useful tool in defending personal injury claims, but it must be approached with caution. Irish courts accept such evidence where it is gathered lawfully, proportionately, and in response to genuine concerns—such as suspected exaggeration or dishonesty. However, any intrusion into a claimant’s privacy must be justified, and covert surveillance without cause is likely to backfire. Defence solicitors must balance the right to investigate with the claimant’s right to privacy.
Private investigators must operate within strict legal and ethical parameters. Filming must take place only in public settings, and investigators should not use deceitful tactics like false identities or hidden tracking devices. If these boundaries are crossed, the evidence may be ruled inadmissible, and the instructing party—whether solicitor or insurer—could face consequences.
Overall, while surveillance can assist in exposing fraudulent or exaggerated claims, it must be used strategically, sparingly, and with full regard for privacy rights and data protection law. Solicitors play a key role in supervising investigators and ensuring compliance throughout the process.
DPC GUIDANCE
The preponderance of DPC Guidance available relates to CCTV systems, but the following extracts from the website are of general application to (covert) video surveillance evidence.
Video Recording / CCTV, Dash Cams, Action Cams, Drones and Other Video Recording Equipment
EU data protection legislation, such as the GDPR, may apply to people or organisations (as ‘data controllers’ or ‘data processors’) who record (‘process’) video and/or audio information about identifiable persons (‘personal data’).
Video recording equipment can include CCTV, dash cams, action cams, camera-enabled drones, and other technologies. Where these types of equipment are used, users (as well as those recorded) should be aware of the potential application of the various rights and duties under data protection law to that recording. Guidance on the duties of data controllers can be found on the ‘For Organisations’ section of this website.
As a starting point, any person or organisation using recording equipment should remember that simply recording and/or storing video and audio data could be considered ‘processing’, even if no further use is made of that data. Further, that data may be considered ‘personal data’ where some individual can be identified from it. Thus both the context and quality of the recording can be highly relevant.
One thing which should be kept in mind, particularly by individuals who use or intend to use video recording equipment in either a commercial context or in a public place, is whether or not the recording falls under the ‘personal’ or ‘household exemption’ from the GDPR (under Article 2(2)(c) and Recital 18 GDPR). This exemption states that the GDPR does not apply to processing of data (such as recording video) by an individual “in the course of a purely personal or household activity”. If the recording does not fall within this category, then it is possible that the person making the recording has a number of obligations as a ‘data controller’ under the GDPR.
When assessing whether or not recording is purely of a personal or household nature, a number of factors should be taken into consideration, such as:
whether it has any connection to a professional or commercial activity;
who were the people involved in or captured by the recording – where they known to the person making the recording; and
what area the recording covered – did it cover public or only private spaces.
A case from the Court of Justice of the European Union (CJEU) assists in understanding the extent of this exemption, making it clear that this exemption must be construed narrowly. In its judgment in the case of Rynes vs Urad (2014), the Court considered that;
To the extent that video surveillance… covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity ...
Although this case related to a fixed CCTV system, it is still helpful in deciding whether the exemption applies in cases where individuals are using other types of video recording equipment, such as ‘dash cams’ or ‘action cams’.
Ultimately, whether or not a recording was of a purely personal or household nature will depend on the facts of each case.
Dash Cams
Due to the increased trend in the use by road users of ‘dash cams’, the DPC has produced specific ‘Guidance for Drivers on the use of "Dash Cams"’. Similarly, to the guidance on CCTV, this guidance paper contains both specific information on the use of dash cams, but also general principles which may be applicable to many instances of video recording, such as dash cams.
Some of the issues that data subjects and users of dash cams should be aware of include:
whether the cameras are outward- or inward-facing, or both;
whether they record audio as well as video;
whether they record video of the road ahead and/or other public spaces;
the quality of any recording, and whether people are identifiable from it;
how the recordings are stored and used; and
whether any recording is done purely in a personal context.
Where users of dash cams consider they may be data controllers under the GDPR, they should consider the material found under the ‘For Organisations’ section of this website.
(CCTV section in full excluded)
Action Cams and Drones
The DPC does not currently have specific guidance on the use of ‘action cams’ (such as GoPros) or drones capable of recording video, but, as you can imagine, many of the considerations relevant to CCTV and dash cams apply equally to the use of these types of video recording equipment.
In particular, users should consider the location in which they use these devices and the possibility of identifying any individuals recorded, and whether or not they are required to comply with certain obligations under data protection law, outlined under the ‘For Organisations’ section of this website.
Body-Worn Cameras
Utilisation of Cameras Must Be Lawful and Fair
All processing of personal data which does fall under the remit of the GDPR must be lawful and fair. This essentially means that you must have an appropriate ‘legal basis’, or justification, for using body-worn cameras (or similar technologies, such as ‘action cameras’) as required by Article 6 GDPR (see also our detailed guidance on legal bases).
Further, any video footage recorded must only be processed for purposes that are otherwise lawful and fair towards affected data subjects.
The use of such cameras should avoid being unduly detrimental, unexpected, misleading, or deceptive to individuals who are recorded. Data controllers should also note that it is not enough that the use of body-worn cameras and action cameras would be helpful towards achieving a desired goal, but it must actually be necessary for achieving the purpose which provides a legal basis.
Consent is unlikely to be the appropriate legal basis where these sorts of cameras are used, where gathering the consent of each person recorded may not be possible or practical. In most situations in which body-worn cameras or action cameras are routinely used, it would be very difficult to obtain the valid, informed and freely given consent of all affected individuals.
The most appropriate legal basis for the use of body worn cameras or action cameras in many cases may be where you can show that they are necessary to pursue a ‘legitimate interest’, either your own or that of a third party (for example, where an organisation proposes using them for a safety or security purpose, it may be the interests of clients or others which are pursued, not just those of the organisations).
If controllers wish to rely on legitimate interest as a legal basis for using body-worn cameras or action cameras, they must assess whether they are necessary for pursuing this interest (‘necessity test’) and whether that interest is overridden by the interests or fundamental rights or freedoms of the individuals concerned (‘balancing test’). In other words, they must demonstrate that they have a genuine legitimate interest in undertaking this processing, that body-worn cameras are necessary and proportionate for achieving the purposes of the processing, and that they will not have a disproportionate impact on the individuals concerned. The GDPR makes clear that public authorities cannot rely on the legal basis of ‘legitimate interests’ to justify the processing of personal data which is carried out in performance of their tasks. However, public authorities may have a legal basis where “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Where processing is based on this legal basis, it should be grounded in EU or national law, which meets an objective or public interest and is proportionate and legitimate to the aim pursued. A data controller may rely on this lawful basis if it is necessary for them to process personal data either in the exercise of official authority (covering public functions and powers as set out in law) or to perform a specific task in the public interest (as set out in law). It is important to note that the fairness requirement does not mean that all processing that negatively affects the individual concerned is in breach of this principle.
For example, video footage from a body-worn camera or action camera could be used as proof of wrongdoing by an individual, as long as the data controller had a valid legal basis for using a body-worn camera or action camera and complied with their other obligations under data protection law. The fact that this will have negative consequences for the individual concerned does not make the use of the camera unfair or unlawful per se.
You must ensure that any personal data recorded by your body-worn cameras is adequate, relevant and limited to what is necessary to achieve the stated purposes of the processing. In other words, they should only record the bare minimum of data needed for the stated aims of having the cameras. The DPC recommends that data controllers considering the use of body-worn cameras undertake detailed assessments as to how the use of such equipment meets with these requirements. This could include a risk assessment, necessity and balancing test (particularly where relying on legitimate interests as a legal basis), and/or a Data Protection Impact Assessment (DPIA).
Comments