The COVID-19 pandemic, and the consequential increase in working from home, has driven demand for workplace surveillance tools. Organisations look for solutions that monitor and aid productivity of their remote workforce. New technologies offer opportunities for unprecedented surveillance of employees – these not only include tracking of websites visited during work hours but also tracking of keystrokes and mouse movements. Other concerning examples include software, which, having been covertly installed on employees’ devices, takes photos and uploads them for management to see. Spot checks, such as randomly searching inboxes for keywords or phrases, are becoming more popular too.
Whilst enhancing productivity, or at least seeking to maintain pre-pandemic productivity levels, is an important consideration, there are several risks employers must consider before deciding to monitor their workforce. The risks will be even higher, and monitoring likely illegal, if the employer is considering doing so covertly. Employers must ask themselves – what will workplace surveillance provide management and HR with, that cannot otherwise be obtained through effective line management?
Article 8 of the European Convention of Human Rights
The Article 8 right to private and family life includes employees’ personal privacy in the workplace. Whilst the right is balanced against the legitimate business interests, it can be infringed by disproportionate surveillance introduced by employers. Employees’ expectation of privacy will be higher in the home than the workplace. Article 8 will therefore be certainly engaged if an employer covertly records their employees working remotely and it will be very difficult for the employer to justify such conduct.
GDPR and the Data Protection Act 2018
Monitoring of employees will inevitably involve processing of ‘personal data’ within the meaning of Article 4(1) of the GDPR. Such processing will only be lawful if the employer complies with the data protection legislation.
The data protection legislation imposes various constrains on the processing of personal data. Employers are under an obligation to inform their workforce of any processing of their personal data which takes place. This makes it virtually impossible for an employer to be able to monitor their workforce covertly.
High risk? DPIA is the answer!
Employee monitoring is likely to constitute ‘high risk’ processing which will require a Data Protection Impact Assessment (DPIA), especially if its outcome is likely to have an impact on employees’ interests and, for example, result in a punitive action. A DPIA should carefully document the specific need for monitoring and explain why the form of monitoring proposed is proportionate to meeting this need.
Lawful basis – consent?
Processing of personal data will only be lawful if it has a lawful basis under Article 6. ‘Consent’ is often thought to be an easy solution – if the employee has consented to being monitored at the workplace, then surely it must be permissible for the employer to proceed. It must be remembered, however, that in accordance with Article 4(11), consent must be freely given, specific, informed and unambiguous. The ICO noted that given the inherent power imbalance in the employer-employee relationship, it is unlikely that employee’s consent will meet the requirements of Article 4(11) and therefore will not constitute sufficient lawful basis for processing.
It is difficult to determine whether alternative lawful basis will be of assistance to employers. It is unlikely that covert monitoring of employees would be required for the performance of a contract with the data subject. Some organisations may rely on the ‘proper performance of their legal obligations’ or ‘protection of the vital interests of a data subject’ as lawful basis for such processing. Another option is to rely on pursuing of ‘legitimate interests’ (as long as those interests are not overridden by fundamental rights and freedoms of the data subject) – such interests include, for example, improving employee productivity, fraud prevention or security. All lawful bases apart from ‘consent’ require the processing to be ‘necessary’. It follows that if the employer can achieve its purpose without monitoring employees, then it does not have lawful basis for doing so. Importantly, however, monitoring does not have to be essential to achieve employer’s purpose, but it must be a proportionate way of achieving it.
What are the risks?
Workplace surveillance can damage trust between workers and their employers. It can also have an adverse impact on employee motivation and commitment as well as their sense of control and autonomy. It can lead to increased stress and consequent absenteeism.
Employment tribunal claims that are most likely to arise where covert monitoring has taken place include constructive dismissal, unfair dismissal and victimisation for asserting or defending employment rights.
Employers are bound by the implied duty of mutual trust and confidence – which is likely to be damaged by disproportionate (and certainly by covert) monitoring of employees. Without a lawful basis for monitoring, an employer may well be committing a breach of the implied duty, entitling the employee to resign in response and claim constructive dismissal. When assessing the claim, an employment tribunal would also take into account the employee’s Article 8 rights as against the employer’s reason for surveiling the employee. In Kilday v MJM International Ltd ET Case No.4102298/13, the employee was successful in claiming constructive dismissal after resigning, following a discovery of a recording device in his office. The tribunal said that installing a recording device was not a legitimate step for the employer to take and that it had breached the implied duty of trust and confidence.
In unfair dismissal claims, where the circumstances concern the Article 8 privacy rights, the tribunal will consider, when assessing the range of reasonable responses test under section 98(4) of the Employment Rights Act 1996, whether the employer’s interference with the employee’s right to privacy was justifiable in the circumstances. For example, in McGowan v Scottish Water 2005 IRLR 167, the employer covertly recorded its employee working remotely at home, in order to prove that he was falsifying his timesheets. Even thought the tribunal concluded that Article 8 rights were engaged, it rejected the employee’s claim and held that the employer’s interference with the employee’s rights was justified because the employer was investigating a criminal activity.
Covert recording of employees may also give rise to victimisation claims, where an employee feels they are unfairly targeted for asserting or defending employment rights. In Sadiq v HBOS plc ET Case No.1805844/13, the employee’s victimisation claim contrary to section 27 of the Equality Act 2010 was successful. In this case, the claimant worked in a call centre and gave evidence in another employee’s race discrimination claim which constituted a protected act. The tribunal noted that the claimant was covertly recorded by their employer a few weeks after performing a protected act.
Apart from employment tribunal claims, employers, as data controllers, can face liability if they fail to comply with their obligations under the data protection legislation. Under section 169 of the Data Protection Act 2018, individuals may bring a claim for compensation for breaches of the GDPR and the Data Protection Act 2018 in either the High Court of the County Court. Alongside civil claims, employers may face ICO enforcement action which may result in considerable revenue-based fines.
What would a reasonable employer do?
Employers should consider whether workplace surveillance is appropriate and whether exploring various ways of supporting their employees may be a better way of addressing any drops in productivity.
If a decision is made to introduce a form of workplace surveillance, employers must strike a careful balance between their legitimate business need in increasing and maintaining adequate levels of productivity against their employees’ right to privacy. It must be remembered that employees’ expectations of privacy will be higher when working from home. Any workplace surveillance must be proportionate and cannot be excessive – the ICO advises to carry out a proportionality test.
Open and transparent communication is key – employees must be consulted and informed of any monitoring before it is undertaken. Employers should clearly set out what information is likely to be obtained via workplace surveillance, why it is being obtained, who it is disclosed to and what it will be used for – the purpose and benefits for both the organisation and the workers should be explained.
Once employees have been consulted, the employer should produce and make accessible a clear policy addressing monitoring practices. There must also be clear guidance for managers and safeguards in place to prevent misuse or over-monitoring.
Any personal data obtained through monitoring must only be used in a manner originally declared to the employee and must only be accessed by employees bound by confidentiality obligations. The risks of conducting workplace surveillance should be assessed and mapped – monitoring should only commence once a formal DPIA has been completed.
Employers must remember that it is not just the employees who have the relevant rights – monitoring of workers, self-employed contractors, volunteers or other individuals engaged in executing business will be covered by data protection legislation.
In terms of covert surveillance, the ICO confirmed that it should only be deployed in exceptional circumstances such as prevention or detection of criminal activity or equivalent malpractice and should be authorised by senior management. Covert monitoring must be strictly targeted at obtaining evidence within a defined timeframe and must not continue for longer than necessary. Any information obtained though covert monitoring must only be used for a prescribed purpose. This means that any forms of covert surveillance in the workplace concerned only with improving productivity will very likely be illegal.
This article is for general awareness only and does not constitute legal or professional advice. The law may have changed since this page was first published. If you would like further advice and assistance in relation to any of the issues raised in this article, please contact us today by telephone or email firstname.lastname@example.org.