Employee monitoring and surveillance – has your organisation got it right?
August 26, 2015
Organisations regularly ask if they may monitor their staff and on occasions, they ask if they can do so covertly. This is a complicated area and organisations should tread carefully. Employees have a reasonable expectation of privacy at work and their right to privacy should not be interfered with lightly.
Staff monitoring can be loosely put into two categories: (i) where the employees are aware of the monitoring; and (ii) where they are not. For example, most employers will check the quality of their employees work and in hazardous environments, they may monitor employees to make sure they are not put at risk. In such circumstances, the employees are likely to be aware of the monitoring which will be incorporated into employee conditions of service and consequently transparent. Where staff are not aware they are being monitored, infringements of privacy may trigger data protection laws.
Covert employee monitoring can never be justified because someone thinks it's a good idea. The view that some member of staff is likely to be abusing emails or visiting prohibited websites or reporting sick and going on holiday or helping themselves to stationary or company goods, cannot justify mass covert monitoring of all or some staff. Subjecting employees to covert surveillance which is not justified is considered a breach of the first data protection principle (fair and lawful processing) by the Information Commissioner. If such monitoring was to cause distress to individuals it is likely that enforcement action would follow.
Any monitoring of staff has to be intelligence led. That is there has to be more than just a suspicion that a staff member is behaving in an inappropriate or even criminal manner. Where there is evidence that a member of staff is behaving in such a way that the behaviour could be construed as serious misconduct, it is still not really appropriate for the employer to commence to monitor the staff member without further consideration.
At this stage senior members of the organisation should be involved and there should be a discussion about the staff member's behaviour and the best way to deal with it. Ideally there should be a privacy impact assessment which should address, amongst other things, the proportionality and necessity of the proposed monitoring. For example:
- Could the information which is sought (evidence of malpractice or criminality) be obtained by other means?
- Is the means of collection of the information (for example covert video recording) proportionate to the alleged malpractice?
- Will the proposed monitoring have an impact upon individuals who are not thought to be involved?
The reasons for the covert monitoring and the method of the monitoring should be recorded along with the privacy impact assessment. If possible a senior independent person should be asked to review the proposed monitoring before commencement.
Covert monitoring should always be a last resort. Occasionally it may be the only course of action open to an organisation and if planned carefully it will be fair and lawful and of course will help to stop the offending behaviour.
Mick Gorrill | Head of Data Protection Enforcement and Regulatory Affairs| PwC Legal
[email protected] | +44 (0)161 245 2546