Can I electronically monitor my employees?

The rise of homeworking over the past couple of years has caused some employers to consider using electronic monitoring to keep track of their employees’ activities during working hours. Methods of electronic monitoring include:

• CCTV;
• laptop cameras;
• keystroke recording;
• Internet use monitoring;
• email monitoring; and
• call recording

While these methods may help employers assess performance, ensure quality control and ensure compliance with company policies (for example, regarding bullying and harassment), there are also several privacy and data protection considerations employers should be aware of.

Privacy at work Article 8 of the European Convention on Human Rights (ECHR)

Article 8 of the ECHR gives individuals the right to respect for their private and family life. Excessive electronic monitoring of your employees risks breaching this right.

For an employee to claim that your electronic monitoring breaches their Article 8 right to privacy, they must be able to establish that they had a reasonable expectation of privacy, and that the monitoring was a disproportionate interference with their privacy. For example, in the case of Copland v United Kingdom [2007] the European Court of Human Rights ruled that the monitoring of an employee’s telephone, email, and internet usage infringed the employee’s Article 8 right to privacy because there was no workplace IT policy and the employee was not told they were being monitored.

Therefore whenever possible, you should inform your employees that they may be monitored as this might reduce their expectation of privacy and prevent their Article 8 right from being engaged. You should also ensure that any monitoring you do is proportionate as a matter of best practice. 

UK GDPR

When you electronically monitor employees, you are processing their data. This brings the monitoring under the remit of the UK GDPR. As with other forms of data processing, to lawfully monitor employees you must have a lawful basis for the electronic monitoring. The UK GDPR sets out six lawful basis for processing data. The ones most likely to apply to remote monitoring are:

• the processing is necessary for the performance of a contract with the data subject; and
• legitimate interests.

Consent is another lawful basis listed in the UK GDPR, but you should be careful about relying on consent as the imbalance of power between employer and employee may mean that the employee’s consent is not freely given.

Before initiating electronic monitoring, you should carry out a data protection impact assessment (DPIA). In completing the DPIA you should consider:

• the purpose of the monitoring;
• potential adverse impacts;
• less intrusive monitoring methods; and
• whether the monitoring is justified.

When considering adverse impacts of the monitoring, you should consider the extent of the intrusion into the employees’ private life, who will have access to the data, whether the monitoring will be oppressive or demeaning, and what impact the monitoring will have on the employer/employee relationship. If your purpose can be achieved via less intrusive methods, the monitoring will not be proportionate and will therefore not be lawful.

Informing Employees

You must inform employees that you will be electronically monitoring them, save in the exceptional circumstances where covert monitoring may be permitted. Employees should be told in plain language:

• the purpose of the monitoring;
• when monitoring will occur;
• how the data will be kept; and
• who the data will be shared with.

You should be proactive in providing your employees with this information. It is not sufficient to include this information in a policy  assuming your employees will have read it.

Once the monitoring has begun, you should keep the data processing under review. If you identify a new purpose for monitoring, use a new technique, or collect different data, you must carry out a new DPIA and inform your employees. This is to ensure data is not misused or not used for purposes your employees don’t know about. If your new purpose is compatible with the original purpose, your continued processing will be lawful and you won’t need to identify a new lawful basis.

If you are considering implementing electronic monitoring at your business, it may be helpful for you to take legal advice first. For advice on how to introduce electronic monitoring and your data protection obligations, contact the Employment Team by calling 023 8071 7717 or emailing employment@warnegoodman.co.uk.