When it comes to work lunches, I trust my fellow employees to keep their distance but if my lunch started to disappear daily, I’m not sure what I would do. Maybe a simple note or a lunch box with a lock, but how about surveillance? That might be going too far but if your employer had to set up CCTV to protect your soup and sandwich, the question arises as to what level of monitoring can be undertaken by an employer and what expectation of privacy do employees have at work?

Employees in Ireland have a general expectation of privacy in the workplace which can be balanced with an employer’s legitimate interests in protecting its business, reputation, resources and equipment. Employers must disclose that they monitor their employees except in very limited circumstances where covert surveillance may be justifiable (i.e. there is a demonstrable need and the employer intends to involve the police; a missing lunch is unlikely to qualify).

It is imperative that the policy detailing the employee monitoring that may take place is clearly communicated to employees.

In the absence of a well communicated policy, it is difficult for employees to assess what level of privacy is afforded to them in the workplace. They must be made aware of what monitoring will take place and for what purpose. The Workplace Relations Commission in Ireland has in the past been critical of employers who have failed to do this.

The employee will inevitably rely on the Data Protection Acts 1988 – 2018 and GDPR regarding their privacy but it is the responsibility of the employer to assess what monitoring activities will take place and to ensure they are, necessary, reasonable and proportionate in the circumstances. The employer should ensure:

• The monitoring activity is necessary: employers should consider whether there are less intrusive means.
• The monitoring activity is legitimate.
• The monitoring activity is proportionate to the aim being achieved.
• The monitoring activity is transparent to employees: employers need to clearly communicate to their employees the basis on which they are monitored in all relevant policies. It is imperative in all situations that employers make sure their employees are aware that they can be monitored and the reasons for the monitoring. Monitoring should also be detailed in the employer’s workplace privacy notice.

Whether consent is required from the employee will depend on the reasons for the monitoring. If the monitoring can be justified by means of another lawful basis under GDPR, such as the employer’s legitimate interests, then consent will not be required. However, the monitoring should still be limited to what is reasonable and proportionate to achieve the employer’s legitimate aims while balancing this with an employee’s reasonable expectation of privacy in the workplace.