Following publication of the much-criticised Recruitment and Selection Code
of Practice, the three remaining sections of the Information Commissioner’s
Data Protection Code will be published in the next few months. Each of the four
sections is intended to give practical guidance to employers to ensure
compliance with the Data Protection Act 1998. The four sections involve: the
recruitment and selection process; management of employment records; obtaining
medical records and monitoring of workers’ e-mails and telephone calls. The
draft monitoring code is receiving the most flak at the moment. Employers’
organisations have claimed the ‘benchmark’ standards they are obliged to follow
in the draft are unduly restrictive and overprotective of employees.
Practice guidance
To summarise the essential elements, the keywords are justification,
notification and consultation. In the draft monitoring code employers must:
– Audit monitoring practices and appoint a compliance officer to ensure
every procedure can be justified according to ‘specific business risks’
– Establish a clear monitoring policy, communicate the reasons for it and
the form it might take to employees and representatives and remind them of it
regularly
– Consider covert monitoring and inform the police if a specific criminal
offence has been identified
– Ensure monitoring is strictly targeted, with a set timeframe and that any
extraneous information is deleted
– Ensure customers or any third parties are aware of any monitoring which
may affect them, and the purpose behind it
Employers argue the draft monitoring code obliges them to inform employees
whenever they are considering monitoring, negating the purpose. This may not be
accurate because the accompanying notes state employers could inform them
generally "through staff handbooks" or "signage", not
before each act of monitoring is considered. Employers must inform workers that
monitoring is taking place at least "periodically", but this could be
achieved by sending an e-mail to all staff every six months or via staff
newsletters.
Employers also interpret the draft as stating the police must be informed
and involved in covert monitoring because it is non-consensual and potentially
intrusive. The notes again appear to clarify this, stating it would be
appropriate to inform the police, "although they do not have to sanction
or take part in the monitoring".
Lobbying for substantial alterations to the draft code will continue.
