The institution should not take disciplinary actions against the employee based on the evidence derived from the surveillance system, because the purpose of the surveillance system – for security - must be indicated in the personal data collection statement. If surveillance data were to be used in assessing the employee's job performance, then this instance of personal data processing would be a deviation from the stated purposes of surveillance, so the institution might risk breaching the Personal Data Protection Act, or committing a crime or an administrative offence.