Distribution Hub Bag Searches and Break-Room Cameras
A logistics company's in-house security team screens 1,200 employees and visitors per shift at a distribution center. A new client contract requires 100% exit bag searches and 14 additional cameras covering break rooms and locker corridors. The union has filed a grievance. Last week a male guard searched a female employee's bag in a storage room without a witness; she complained. The data protection officer notes that footage is retained for 180 days, but there is no privacy impact assessment. The search procedure is a one-page memo dated 2019, and 22 of 35 guards have not been trained on it. The security manager says, 'The client pays for the contract; the client sets the rules.' The company's security policy mentions legal compliance but not privacy or employee dignity.
1. Identify the SOMS weaknesses and explain why this is not simply a client-requirement problem.
Read the worked answer
The weaknesses sit in several connected areas. Operational control is weak because a 2019 memo is not a controlled, current procedure for 100% searches. Competence is weak because 22 of 35 guards have not been trained. Legal and other requirements are not properly planned: the DPO has flagged retention and the absence of a privacy impact assessment. Communication and awareness are weak for employees and guards. The policy mentions legal compliance but gives no direction on privacy or dignity.
It is not simply a client-requirement problem because the client's contract does not decide the company's legal obligations or human-rights responsibilities. ISO 18788 expects the organization to assess requirements and choose proportionate controls. A client can require bag searches, but the provider must still use a lawful, dignified procedure, consider privacy, and train guards. The security manager's statement reverses accountability: the client is an interested party, not the owner of the SOMS.
The search of a female employee in a storage room without a witness shows the gap between a commercial requirement and an operational control. The organization needs a procedure, training, supervision, and a complaint route.
2. What should the security manager do about the search procedure and the cameras?
Read the worked answer
For searches, the manager should replace the memo with a documented procedure that states the legal basis, who may be searched, where, by whom, and with what witness. Same-sex search should be the default where intimate items may be involved, and searches should occur in a private but witnessed area, not a storage room. Employees should be told the purpose, given a receipt or record, and offered a complaint route. Guards need training and supervision.
For cameras, the manager should consult legal counsel and the DPO before installation. A privacy impact assessment should test necessity and proportionality: break rooms are private areas, and cameras there may be hard to justify if the aim is exit theft. If cameras are installed, access should be restricted, retention should be justified, and notices should explain purpose and contact points. The 180-day retention needs a documented rationale; it should not be a default.
The manager should also review the client contract. If the client requires measures that are unlawful or disproportionate, the organization should negotiate alternatives and record the decision. The judgment is not 'refuse all client requirements'; it is 'translate them into lawful, proportionate controls'.
3. How should the organization handle the union grievance to demonstrate accountability?
Read the worked answer
The organization should acknowledge the grievance promptly, interview the employee and the guard, preserve any video or search records, and avoid retaliation. It should separate the individual complaint from the wider policy question: the employee needs a response and remedy, while the union needs a route to discuss search and camera practices.
The investigation should ask whether the search was conducted according to a valid procedure, whether the guard was trained, whether a witness was required, and whether privacy or dignity was breached. Findings should be recorded, and corrective actions should include procedure revision, training, and communication. The union should receive a reasoned response and a timetable for changes.
Accountability also means reporting the grievance and actions to top management and including them in management review. A complaint mechanism is not a public-relations channel; it is a control that surfaces problems before they become disputes. The security manager should not promise that the client requirement will be dropped, but should explain what the organization can lawfully and proportionately do.