Ireland, J.
After being videotaped by a hidden camera during the summer and fall of 1995 as she changed clothes and applied sunburn medication to her upper chest area and neck in an open area of her workplace, the plaintiff, Gail Nelson, filed a complaint averring that the defendants, Salem State College (college) and several employees of the college, violated her right to privacy. In her amended complaint, the plaintiff alleged that the defendants’ making, use, possession, or viewing of the videotapes of the plaintiff violated her right to privacy under G. L. c. 214, § IB; she asserted a claim under 42 U.S.C. § 1983 (2000), pursuant to the Fourth Amendment to the United States Constitution, alleging that the defendants’ video surveillance of her workplace without a warrant violated her right to privacy; [527]*527and she alleged that the college and the Commonwealth were negligent in training and supervising the individual defendants and by permitting the installation and operation of the video camera in her workplace.2 A judge in the Superior Court granted summary judgment for the defendants on all counts, and the plaintiff appealed. We transferred the case to this court on our own motion. Because we conclude that all material facts have been established; that the plaintiff had no objectively reasonable expectation of privacy; that the defendants, public employees, are entitled to common-law immunity; that the law governing videotaping was not clearly established in 1995 and, thus, that there was no negligent supervision or training of the defendants’ employees; and that the defendants are entitled to judgment as a matter of law, we affirm.3
Facts. Because this is a fact-driven case, we present the relevant facts in detail, viewed in the light most favorable to the plaintiff.
In 1995, the plaintiff worked in the small business development center (SBDC), a program of the college. The plaintiff worked as a receptionist and an administrative assistant to the SBDC’s director, the defendant Frederick Young. The SBDC offered counselling to persons interested in developing small businesses. The SBDC was open to the general public weekdays from 9 a.m. to 5 p.m., and it served approximately 250 to 300 clients during the summer of 1995.
The SBDC shared the office space with two other programs run by the college, the Downtown Center and the Salem State [528]*528College Institute for Learning and Retirement (ILR). The three programs employed six full-time employees, including the plaintiff; three part-time employees; and a number of volunteers. In addition, an ILR-sponsored program brought approximately fifty to sixty persons, and sometimes up to one hundred persons, to the office for weekly meetings.
All of the employees and some of the volunteers had keys to the office and were permitted to enter the office after regular business hours, as needed. While the plaintiff was employed by the SBDC in 1995, she did not know all of the people who were authorized to enter the office after regular business hours. Visitors were not required to stop at the reception desk before proceeding to the rear of the office.
The SBDC was located in downtown Salem on two floors at 197 Essex Street, a street that contains small shops and is closed to most vehicular traffic. The upstairs level of the office, a long, narrow rectangle, opened directly onto Essex Street. Its front wall was comprised of a large plate glass window and door. From the window on Essex Street or on entering the office, one could see three or four desks, including an unobstructed view of the plaintiffs desk.4
Three-quarters of the way into the office, toward the rear along the left side, was another work area (the rear work area) where there was a desk and chair used by the ILR staff, including volunteers. No one could see into the rear work area from the street or from the left front portion of the office because it was separated from the front of the office by one of two six-foot high partitions.
Beyond the rear work area, at the far end of the office, there was a storage closet. However, due to the layout of the office and a five- to six-foot space between the office partitions, the rear work area was visible to employees, SBDC clients, ILR participants, and members of the general public who approached the partition from the front of the office or passed through the rear of the office to the storage closet or to the stairs leading to the office’s only bathroom, a large meeting room, four locked [529]*529private counselling offices, and an open work area where the computers and a photocopier were located.
Although the plaintiff’s duties for the SBDC did not require her to be on the premises before 8:30 a.m. or after 5 p.m., Young was aware that, on occasion, the plaintiff arrived early or was in the office after hours, in part because she also did some volunteer work for the DLR. At times during the day, the plaintiff was alone in the office.
On learning that a former client of the SBDC who was under investigation for alleged criminal activity had gained unauthorized access to SBDC after normal business hours, the defendants became concerned about security. They decided to install a hidden video camera in an emergency light fixture located on the rear wall of the office.5 Although the defendants were concerned about unauthorized entries into the office after regular business hours, and although defendants Vincent O’Connell and Janice Fuller, the public safety officers employed by the college who were responsible for installing the video camera, could have set the camera to operate only after business hours, they programmed the camera to run twenty-four hours a day, seven days a week. Pointed at the front door, the camera recorded the length of the office, the large plate glass window, and the door. It also recorded part of the rear work area farthest from the storage closet. The camera could not record that part of the rear work area directly below it. There was no audio recording. The videotaping continued until at least the middle of August, 1995.6
For three weeks in July and August of 1995, the plaintiff had [530]*530a severe sunburn on her chest and neck. Several times a day, including times when the front door was unlocked, she left the area of her own desk and went to the rear work area where she unbuttoned her blouse and applied a prescribed ointment. She did this when no one else was on the street-level floor or when no clients or visitors were expected, but while others may have been downstairs. On several occasions that summer, the plaintiff also changed clothes in the rear work area before and after regular business hours when no one else was in the office and the front door was locked. The plaintiffs activities were in the area under surveillance by the defendants, but the tape recordings that were preserved do not show any images of these activities. On the plaintiff’s learning of the secret videotaping, this litigation commenced.
Analysis. 1. Standard of review. “The standard of review of a grant of summary judgment is whether, viewing the evidence in the light most favorable to the nonmoving party, all material facts have been established and the moving party is entitled to a judgment as a matter of law.” Augat, Inc. v. Liberty Mut. Ins. Co., 410 Mass. 117, 120 (1991), citing Mass. R. Civ. P. 56 (c), 365 Mass. 824 (1974). “An order granting or denying summary judgment will be upheld if the trial judge ruled on undisputed material facts and his ruling was correct as a matter of law.” Commonwealth v. One 1987 Mercury Cougar Auto., 413 Mass. 534, 536 (1992), citing Community Nat’l Bank v. Dawes, 369 Mass. 550, 556 (1976).
2. Section 1983 claim.7 The plaintiff alleged that the defendants violated her Fourth Amendment right to privacy and [531]*531asserted a claim under 42 U.S.C. § 1983 (2000). The defendants raised a qualified immunity defense with respect to this claim. In the United States Court of Appeals for the First Circuit, qualified immunity claims have been evaluated under a three-part test:
“First, we ask whether, ‘[tjaken in the light most favorable to the party asserting the injury, ... the facts . . . show the officer’s conduct violated a constitutional right.’ [Riverdale Mills Corp. v. Pimpare, 392 F.3d 55, 61 (1st Cir. 2004)] .... If so, the second question is ‘whether that constitutional right was clearly established at the time of the . . . violation.’ [Whitfield v. Melendez-Rivera, 431 F.3d 1, 7 (1st Cir. 2005)] .... The third question is ‘whether a reasonable officer, similarly situated, would understand that the challenged conduct violated the clearly established right at issue.’ Riverdale Mills [Corp., supra] at 61.” (Citations omitted.)
Borges Colon v. Roman-Abreu, 438 F.3d 1, 18-19 (1st Cir. 2006).
Rather than grapple with the Fourth Amendment issue first, the judge, noting that “the constitutional issue ... is difficult and unresolved,” first addressed the second prong of the qualified immunity test: whether the right was clearly established at the time of the alleged constitutional violation. The plaintiff argues that the judge was required first to consider whether a violation of a constitutional right had been established before addressing the remaining aspects of the qualified immunity test. There was no error.
As the motion judge noted, the requirement that courts analyze whether a violation of a constitutional right has occurred before discussing the second two elements of the qualified immunity defense has been the subject of debate in the United States Courts of Appeals. See, e.g., Abreu-Guzman v. Ford, 241 F.3d 69, 73 (1st Cir. 2001); Kalka v. Hawk, 215 F.3d 90, 94-98 (D.C. Cir. 2000); Wilkinson v. Russell, 182 F.3d 89, 102 n.7 (2d Cir. 1999), cert. denied, 528 U.S. 1155 (2000). [532]*532The Supreme Court recently reaffirmed the appropriate inquiry regarding lower courts’ determinations of qualified immunity in Brosseau v. Haugen, 543 U.S. 194, 197 (2004), quoting Saucier v. Katz, 533 U.S. 194, 201 (2001): “When confronted with a claim of qualified immunity, a court must ask first the following question: ‘Taken in the light most favorable to the party asserting the injury, do the facts alleged show the officer’s conduct violated a constitutional right?’ ” It did so despite concerns by the concurring Justices that the Saucier rule might unnecessarily create constitutional law that is insulated from Supreme Court review. See Brosseau v. Haugen, supra at 202 (Breyer, J., concurring). The rule requiring that courts examining qualified immunity address the constitutional issue first therefore remains in effect. See Borges Colon v. Roman-Abreu, supra at 19 (“The Supreme Court has instructed us, generally, to analyze the first prong first, even if the outcome of one of the other prongs might end the inquiry”); Bellville v. Northboro, 375 F.3d 25, 30 (1st Cir. 2004) (same). See also Littles v. Commissioner of Correction, 444 Mass. 871, 878 (2005) (“threshold question is whether a constitutional right has been violated; if so, the inquiry shifts to whether the right was . . . clearly established”); Gutierrez v. Massachusetts Bay Transp. Auth., 437 Mass. 396, 403-404 (2002) (discussing two-part inquiry established in the Saucier case).
However, before the United States Supreme Court made clear its requirement for Federal courts, the United States Court of Appeals for the First Circuit noted that “the rule stating that the first prong must be performed before the rest of the qualified immunity analysis is not completely inflexible. The purpose of starting with the first prong is to aid in law elaboration . . . [and] where the claim depends on a ‘kaleidoscope of facts not yet fully developed,’ the law elaboration function is not well served . . . .” Riverdale Mills Corp. v. Pimpare, supra at 62, quoting Dirrane v. Brookline Police Dep’t, 315 F.3d 65, 69-70 (1st Cir. 2002). Particularly, in cases where, as here, a State court judge is presented with a difficult and unresolved issue of Federal constitutional law and the defendant raises a qualified immunity defense, the judge may exercise discretion and determine that fully resolving the constitutional issue is un[533]*533necessary to decide the underlying qualified immunity defense. See, e.g., Rosenberger v. Kootenai County Sheriff’s Dep’t, 140 Idaho 853, 858 (2004) (assuming constitutional violation, rather than resolving constitutional issue). Indeed, an “unresolved” constitutional right, like the one presented in this case, cannot be “clearly established,” as required under the second prong of the qualified immunity test. See, e.g., Wilson v. Layne, 526 U.S. 603, 614-615 (1999) (“clearly established” means contours of right sufficiently clear in light of preexisting law). In this case, we conclude that the judge appropriately exercised her discretion by first deciding that, at the time of the defendants’ conduct, any constitutional right the plaintiff could claim had been violated was not clearly established.
That said, we recognize that there is, in fact, considerable uncertainty concerning any constitutionally-based protection from secret surveillance by public officials in the workplace. We therefore address the issue to provide public officials with clarity as to the bounds of permissible official conduct. See Wilson v. Layne, supra at 609.
3. The constitutional right to privacy.
“Intrusions upon personal privacy do not invariably implicate the Fourth Amendment. Rather, such intrusions cross the constitutional line only if the challenged conduct infringes upon some reasonable expectation of privacy. See Smith v. Maryland, [442 U.S. 735, 740 (1979)]. To qualify[,] ... a privacy expectation must meet both subjective and objective criteria: the complainant must have an actual expectation of privacy, and that expectation must be one which society recognizes as reasonable” (citations omitted).
Vega-Rodriguez v. Puerto Rico Tel. Co., 110 F.3d 174, 178 (1st Cir. 1997). We assume, based on the plaintiff’s actions to protect her privacy in the office and her privacy claim itself, that she had an actual expectation of privacy. We turn, then, to the objective reasonableness of her asserted expectation.
This inquiry is fact-specific, and although the United States Supreme Court “has not developed a routinized checklist that is capable of being applied across the board,” id., several factors, [534]*534such as “the Framers’ intent, the uses to which an individual has put a location, and society’s understanding that certain areas (say, a person’s home) deserve heightened protection from government intrusions,” aid in our analysis. Id. “Generally speaking, business premises invite lesser privacy expectations than do residences.” Id. However, “deeply rooted societal expectations foster some cognizable privacy interests in business premises.” Id. at 178-179. These deeply rooted societal expectations notwithstanding, “persons cannot reasonably maintain an expectation of privacy in that which they display openly.” Id. at 181. In light of the facts of this case, there was no objectively reasonable expectation of privacy in the plaintiff’s workplace.
We substantially agree with the judge’s summary of the record, which is consistent with the facts of the over-all summary judgment record viewed in the light most favorable to the plaintiff. The plaintiff, however, challenges the judge’s characterization of the location of the videotaping as an “open work area,” arguing that the judge impermissibly relied on facts contested by the plaintiff. The record belies this claim.
It was undisputed by the plaintiff that the office where she worked was open to the public throughout the day; that patrons were not required to check in; and that even when the door was locked, the numerous volunteers and employees could access the office with keys in their possession. Many people, including nonemployees whom the plaintiff did not know, had access to the office. Moreover, although there was no physical evidence of the recording of the private acts of the plaintiff, the judge assumed that the plaintiff engaged in the acts, and that she did so both when no one else was in the building and when people were. However, even if the plaintiff thought she was alone, there was no absolute guarantee, including when she locked the door to apply her medication or change her clothes for the evening. The office was public.
The testimony and photographic depictions of the office’s physical layout also are consistent with the judge’s description. The office was located on a busy commercial street, which was open to pedestrian traffic only. The front window of the office was large, and encompassed the entire front wall. It provided [535]*535passersby a full view of the interior of the office, including the plaintiff’s desk and other individuals in the office.
The space behind the two partitions where the plaintiff changed was no more private; it lacked a door and had an opening in the left rear quadrant that was the approximate width of a desk. It was located near the stairs, which visitors and employees often used to go to the restroom or to access various services provided by the SBDC. The space was not enclosed, and could be entered at any time by any one in the center, without prior notice. This description of the office, by any reasonable interpretation, constitutes an “open work area.”
Despite all of the plaintiff’s efforts discreetly to conduct acts of a very personal and private nature in the office, in this case, there was no objectively reasonable expectation of privacy. Because we find that the facts, both as alleged by the plaintiff and, where disputed, viewed in the light most favorable to her, fail to state a violation of a constitutional right, we affirm summary judgment for the defendants.
We pause here to add that there is no question the defendants’ twenty-four hour video surveillance of the entire office was unnecessarily broad for the limited investigation of alleged criminal activity occurring in the office after hours. However, contrary to the plaintiffs assertions, this case does not give rise to the kind of privacy concerns noted in dicta in Vega-Rodriguez v. Puerto Rico Tel. Co., supra at 180 n.5 (cautioning that “cases involving the covert use of clandestine cameras, or cases involving electronically-assisted eavesdropping,” may implicate the Fourth Amendment). As we have discussed, the office, including the space behind which the plaintiff sought refuge to change her clothes and apply sunburn ointment, was open to the public. The office was not limited to the plaintiffs exclusive use, and the over-all public exposure of the physical layout abrogated any expectation that her actions, while in the office, would be private. See generally id. at 179-180, and cases cited (noting that where the work area in question is not given over to an employee’s exclusive use, this factor militates against an objectively reasonable expectation of privacy). Cf. United States v. Taketa, 923 F.2d 665, 673 (9th Cir. 1991) (finding reasonable expectation of privacy in locked, private office). [536]*536Although, unlike the plaintiffs in the Vega-Rodriguez case, the plaintiff lacked notice of the defendants’ surveillance of the office, the facts of this case, including the explicitly public nature of the work conducted by the SBDC and the ready visual and physical access that was afforded the public, all employees (including management) and volunteers by the SBDC, abrogated any objectively reasonable expectation of privacy. See, e.g., Vega-Rodriguez v. Puerto Rico Tel. Co., supra at 180 (Fourth Amendment does not preclude “management from observing electronically what it lawfully can see with the naked eye”). We now turn to the remaining issues of the case.
4. General Laws c. 214, § IB. The plaintiff asserts that the defendants, in their individual capacities, violated her statutory right to privacy found in G. L. c. 214, § IB, which provides that “[a] person shall have a right against unreasonable, substantial or serious interference with his privacy.” To sustain a claim for invasion of privacy, the invasion must be both unreasonable and substantial or serious. See Schlesinger v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 409 Mass. 514, 517-519 (1991). The plaintiff must show that there was a “gathering and dissemination of information which [she contends] was private.” Dasey v. Anderson, 304 F.3d 148, 154 (1st Cir. 2002). For the purposes of this appeal, we assume that there was a gathering and dissemination of private information, and we conclude, as did the judge, that the defendants are entitled to common-law immunity.
The plaintiff, relying on Breault v. Chairman of the Bd. of Fire Comm’rs of Springfield, 401 Mass. 26 (1987), cert. denied sub nom. Forastiere v. Breault, 485 U.S. 906 (1988), and Spring v. Geriatric Auth. of Holyoke, 394 Mass. 274 (1985), argues that the defendant public employees cannot be immune from tort liability because public employees are liable for intentional torts; the Massachusetts Tort Claims Act (Act), G. L. c. 258, abrogates common-law immunity; and the Act provides for an exemption from liability only in narrow circumstances, which are not applicable here. These arguments are based on a misunderstanding of the relevant authority and improperly conflate common-law immunity and the discretionary function exemption found in G. L. c. 258, § 10 (b).
[537]*537The Act, enacted in 1978, created a cause of action against public employers for the negligent or wrongful acts or omissions of their employees acting within the scope of their employment, thus abrogating the doctrine of governmental immunity.8 See G. L. c. 258, § 2. See generally Glannon, The Massachusetts Tort Claims Act: Analysis and Update, 75 Mass. L. Rev. 52 (1990). Intentional torts are expressly exempted from the Act, and therefore a public employer cannot be sued for its employee’s intentionally tortious conduct. See G. L. c. 258, § 10 (c). Thus, public employees may be personally liable for their intentionally tortious conduct under G. L. c. 214, § 1B. See Spring v. Geriatric Auth. of Holyoke, supra at 286 n.9. At common law, however, a public official, exercising judgment and discretion, is not liable for negligence or other error in the making of an official decision if the official acted in good faith, without malice, and without corruption. See Duarte v. Healy, 405 Mass. 43, 50 n.5 (1989); Breault v. Chairman of the Bd. of Fire Comm’rs of Springfield, supra at 34; Gildea v. Ellershaw, 363 Mass. 800, 820 (1973).
In this case, the individuals named in the G. L. c. 214, § IB, claim are being sued only in their individual capacities, and therefore, the Act, and its relevant discretionary function exemption as to public employers, does not apply.9 See South Boston Betterment Trust Corp. v. Boston Redevelopment Auth., 438 Mass. 57, 69 (2002) (citing G. L. c. 258, § 10 [c], Act does not apply where mayor sued in individual capacity for individual tort). Thus, we apply the doctrine of common-law immunity to the plaintiff’s claim.
The Duarte case provides a useful analogy. There, the city manager and fire chief, who subjected new fire fighter probationary recruits to random urinalysis tests, were shielded [538]*538from G. L. c. 214, § IB, liability under the doctrine of common-law immunity because their conduct was within their discretion as public officials, and they were acting in good faith. Similarly, here, the defendants, as public employees responsible for investigating criminal activity on the college campus, acted within their discretion by implementing an investigatory policy to use a surveillance camera where suspected criminal activity was taking place. Further, as the judge concluded, there is no evidence in the record from which a jury could infer that the defendants acted in bad faith or with malice. The record illustrates that at all times, the defendants believed they were videotaping in a public space,10 and they were mindful of the Fourth Amendment implications of their actions. Because they acted in good faith, engaging in activity that was within their discretion, they are shielded from liability by the doctrine of common-law immunity. Cf. Breault v. Chairman of the Bd. of Fire Comm’rs of Springfield, supra at 33 n.7 (common-law immunity not applicable to intentional ministerial acts of defendants).
5. Negligent supervision. The plaintiffs final argument is that the defendants negligently failed to supervise and train their employees such that they committed gross violations of her privacy. To prevail on her negligent training claim, it is not enough for the plaintiff to show deficiencies in the training program. A causal relationship between any breach of duty and the harm suffered by the plaintiff is an essential element of her claim. See Jean W. v. Commonwealth, 414 Mass. 496, 511 (1993) (Liacos, C.J., concurring). The judge concluded that because the law of privacy governing the videotaping conducted by the defendants was not clearly established when the videotaping occurred, the plaintiff will be unable to establish any causal relationship between deficiencies in the training program and any violations of her rights. We agree.
The judge discussed and distinguished all of the case law available at the time of the defendants’ conduct, including the cases relied on by the plaintiff in this appeal. Compare O’Connor [539]*539v. Ortega, 480 U.S. 709 (1987) (reasonable expectation of privacy in unshared desk and file cabinets where personal items stored); United States v. Taketa, 923 F.2d 665 (9th Cir. 1991) (reasonable expectation of privacy against surreptitious video surveillance by drug enforcement agents in office reserved for defendant’s exclusive use); State v. Bonnell, 75 Haw. 124 (1993) (reasonable expectation of privacy against covert video surveillance of employee break room); State v. Thomas, 642 N.E.2d 240 (Ind. Ct. App. 1994) (prolonged video surveillance conducted from nonpublic vantage point violated camp store operator’s reasonable expectation of privacy), with the facts of this case.11 The judge concluded, and we agree, that the dearth of analogous case law on the subject at the time, the conflicting conclusions reached by various courts, and the plaintiff’s inability to cite controlling authority before (or after) 1995 illustrates that the issue was unresolved.
Based on this lack of notice and the status of the law at the time of the conduct in question, the plaintiff will be unable to show that had the officers been properly trained they would not have made the decision to install the video camera in the office. Therefore, as to the plaintiff’s negligence claim, the grant of summary judgment is also affirmed.
Conclusion. For the foregoing reasons, we affirm the grant of summary judgment in favor of the defendants on all claims.
So ordered.