Technological advancement has enabled employers to monitor their workforce in ever more sophisticated ways. Meanwhile, public attitudes towards individual data privacy are hardening. Two important factors have accelerated this: the advent of the EU’s General Data Protection Regulation (GDPR) and scandals over the handling of data by social networking and technology companies. The effects of these have brought the issue into sharp focus for employers worldwide, with employees less likely than ever to accept ‘intrusive’ monitoring strategies.
So far as UK law in this area is concerned, this is now the domain of the GDPR, together with the Data Protection Act 2018. Enforcement of the legislation is overseen by the Information Commissioner’s Office, the UK’s data protection watchdog. Mishandling of data in breach of the rules can have serious repercussions for employers, including costly legal claims.
Monitoring law in the UK can be described as operating on broad principles, rather than specifics, which would be impossible in a world of diverse, dynamic businesses. The data protection principles leave some room for interpretation by employers, for example in relation to the requirement for employers to collect data that is adequate, relevant and not ‘excessive.
The interpretation of ‘excessive’, while contentious, is to a large degree for employers to decide themselves. Some organisations gather data constantly throughout the working day, including employees’ locations, while others collect employee credit scores. Neither is likely to be unlawful, depending on the particular circumstances, due to the necessity in certain industries for the employer to possess this type of knowledge.
Once acquired, data must be kept securely, yet needs to be accessible should the individual data subject request to view it. It is important that data is used for defined reasons only – for example, employers must provide their reasons for using cameras in the workplace. Any use of the data for a different purpose – such as checking employee procrastination when cameras are there to prevent theft is then invalid.
It is surprisingly easy for employers to inadvertently stray into dangerous territory. Last year, for example, a BBC report mentioned an employer in Norfolk who asked staff to install what he thought was time management software, before discovering it tracked all browser activity and took pictures of the workforce at regular intervals to ensure they were at their desks.
Developments in technology are leading some employers to collect data in ways with which employees can be uncomfortable, such as facial recognition software automatically reporting workers leaving their desk, how often they do so and where they go. This type of software can even be capable of tracking employees’ facial expressions. While employees must be notified of the cameras’ existence and the purpose of the monitoring, their consent is not required as long as the processing of data is ‘proportionate’ in scope.
A difficult legal issue is the extent to which employers can monitor employees outside the workplace, and when such action is justified. It could, for example, be legitimate to monitor an employee taking calls outside office hours on a company telephone. But with employees increasingly using their own technology to deal with work matters outside their regular hours, the justification for monitoring becomes more complex and uncertain.
A recent report we released cites the example of an employer that was ruled to be justified in tracking an employee’s private car in a misconduct case, but was later denied the ability to use the data as evidence as the vehicle had been tracked outside working hours.
A good rule of thumb for employers in the UK and the EU is that it is generally more difficult to justify monitoring outside the workplace, so this should be avoided wherever possible and the minimum necessary measures implemented instead. It will also be problematic for employers to justify the collection and storage of information where the methods used to obtain it are otherwise overly intrusive.
The original version of this article can be found here.
