ICO issues guidance on employee monitoring
The UK regulator of data protection the Information Commissioner’s Office (ICO) has this week announced that it has revised its guidance on employee monitoring.
The ICO has defined ‘monitoring workers’ as any form of monitoring of people who carry out work on the employer’s behalf. This definition includes both employees and workers. The monitoring can be in the workplace or elsewhere i.e. in the home and monitoring can take place using a number of different technologies, which include: camera surveillance including wearable cameras and webcams, keystroke monitoring, tracking internet activity and hidden audio recording.
The guidance states that data protection law does not prevent employers from monitoring, but, the ICO cautions that any monitoring should be in compliance with data protection law. The ICO has also explained that employers should be aware of Article 8 of the European Convention on Human Rights (ECHR) which is the right to private and family life. The ICO points out that expectations of privacy are likely to be higher when at home. In other words, I wouldn’t expect my employer to effectively bug my home while watching television in the evening or doing homework with my children. Conversely, I would expect to be captured on CCTV when entering the workplace.
The example that the ICO has given is, if remote workers are suspected to start later than recorded on their timesheets, using webcam footage to ensure they are at their computers on time, is likely to infringe data protection law because it is disproportionate, whereas the same outcome can be achieved by checking when the employee logged on to the computer. The employer should then give the employee the opportunity to explain their position via an investigation meeting.
The ICO has warned employers that just because monitoring is available, it doesn’t mean it is the best way to achieve aims (and ideally it should not be the only evidence Employers rely upon as part of investigation and/or disciplinary procedures). Employers must be clear about the purpose for monitoring and select the least intrusive means to do it. Employers should also have a lawful basis for processing data. One of the lawful bases is in performance of a contract, but it wouldn’t be sufficient to monitor an employee because there is an employment contract in place, employers should only use that basis if monitoring is necessary for the employer’s side of the contract. The example given by the ICO is that an employer can’t insert into an employment contract a clause that states that video surveillance is used to monitor productivity and improve efficiency because there are less intrusive ways to improve productivity.
From a practical point of view, it is sensible for employers to carefully consider if and how they monitor employees. If employers do deem it necessary to monitor employees, employers should consider having robust policies in place to inform employees and make them aware of any monitoring that an employer is planning to conduct, explaining how the information that is gathered from monitoring could be used. Employee monitoring should also be included in any privacy policy.
JMW Solicitors data protection and employment law teams can advise employers.