Privacy in the workplace-Part 2

Monitoring Employees

The second part of our “Privacy in the Workplace” series considers surveillance and monitoring of employees.

There are many ways in which employers are capable of monitoring their employees, including through emails, internet usage, keystrokes, telephone use and CCTV. It’s now commonplace in the UK for organisations to use technology and artificial intelligence to monitor productivity and evaluate workplace performance, for example.

Particularly with the development of wearable technology and biotechnology, a growing number of employers are utilising such advancements in ways which allow employees to be more closely monitored. As result, this topic has become increasingly contentious, due to the potential level of intrusion that technology can now result in.

Many monitoring systems are introduced to combat wrongdoing, such as workplace harassment, data leaks and fraudulent activity, or to promote workplace wellbeing. However, these systems have implications for workers’ privacy and raise questions about the potential misuse of information which those systems create.

The Law

Monitoring typically engages an individual’s right to respect for private and family life and correspondence, which is protected by Article 8 of the European Convention on Human Rights.

As many forms of surveillance also involve the processing of personal data, many monitoring activities are also regulated by the General Data Protection Regulations (‘GDPR’) and the Data Protection Act 2018.

General Principles

Article 5 of the GDPR requires that personal data must be:

• processed lawfully, fairly and transparently
• collected only for specified, explicit and legitimate purposes
• adequate, relevant and limited to only what is necessary for the purpose for which it is processed
• processed in a manner which is secure and protects against unauthorised or unlawful use, accidental loss, destruction or damage.

The GDPR requires employers to undertake data protection impact assessments (‘DPIAs’) to assess the proportionality and necessity of data processing activities.

Employee monitoring is likely to amount to a "high risk" activity which will require a DPIA. That assessment should document the specific need for the monitoring and why the form of monitoring proposed is proportionate to meeting this need.

Covert Surveillance

Data protection compliance generally requires the provision of full information to workers about any surveillance undertaken. This is required so as to comply with the data protection principle under the GDPR that personal data be processed in a fair, lawful and transparent manner.

If an employer is considering covert surveillance, they will need to conduct a DPIA before monitoring systems are put in place. The Information Commissioner’s Office guidance states that covert monitoring will only be justified if openness would prejudice the prevention or detection of crime or equivalent malpractice, or prevent the apprehension or prosecution of offenders. The recommended test for whether covert monitoring is justified is to consider whether the activity being monitored is of sufficient seriousness that it would be reasonable for the police to be involved.

The recent European Court of Human Rights (ECHR) case of Lopez Ribalda and others v Spain concerned workers’ privacy rights where a supermarket manager covertly filmed staff stealing. The employees claimed that the covert recording violated their Article 8 right under the European Convention on Human Rights to respect for private life, arguing that they should have been informed of the surveillance. Nevertheless, the court said that the surveillance measures put in place had been proportionate to the level of theft that was occurring and the reasonable suspicion of misconduct.

Not all of the ECHR judges agreed, however. The dissenting judges in this case were concerned that because the surveillance was not targeted at specific individuals and was not limited to a particular duration, then by not finding that there had been a violation of Article 8, the ECHR was in effect allowing the unlimited use of covert video-surveillance without sufficient legal safeguards. Although in this ECHR case the method of surveillance was found to be proportionate, these are still important factors for employers to consider when undertaking their impact assessment.

Given the complexity of the law in this area, employers should consider obtaining legal advice if they are contemplating the use of worker surveillance. Covert surveillance should only be carried out in exceptional circumstances, for the shortest period possible, affecting as few people as possible and where there is no less intrusive way of tackling the problem.

As a general rule, if Big Brother or Big Sister is watching, they should tell you!