The Information Commissioner’s Office is calling on employers to consider both their legal obligations and their workers’ rights before implementing workplace monitoring, including any tracking of remote workers’ activities.
Research commissioned by the ICO revealed that 19% of people believe they have been monitored by their employer. Two-thirds (70%) of people surveyed said they would find workplace monitoring intrusive and 19% would feel comfortable taking a new job if they knew that their employer would be monitoring them.
If monitoring becomes excessive, said the ICO, it can easily intrude into people’s private lives and undermine their privacy.
The new workplace monitoring guidance provides clear direction on how monitoring can be conducted lawfully and fairly, including advice to help employers build trust with workers and to respect their privacy.
Emily Keaney, deputy commissioner for regulatory policy at the ICO said: “Our research shows that today’s workforce is concerned about monitoring, particularly with the rise of flexible working – nobody wants to feel like their privacy is at risk, especially in their own home.
Workplace monitoring
“As the data protection regulator, we want to remind organisations that business interests must never be prioritised over the privacy of their workers. Transparency and fairness are key to building trust and it is crucial that organisations get this right from the start to create a positive environment where workers feel comfortable and respected.”
Of those who believe they have been monitored, monitoring timekeeping and access was the most common practice at 40%, followed by monitoring emails, files, calls or messages at 25%. Taking screenshots or webcam footage was the least common practice at 10%.
Keaney added: “We are urging all organisations to consider both their legal obligations and their workers’ rights before any monitoring is implemented. While data protection law does not prevent monitoring, our guidance is clear that it must be necessary, proportionate and respect the rights of workers. We will take action if we believe people’s privacy is being threatened.”
Monitoring can include tracking calls, messages and keystrokes, taking screenshots, webcam footage or audio recordings, or using specialist software to track activity.
If an organisation is looking to monitor workers, it must take steps including:
- Making workers aware of the nature, extent and reasons for monitoring
- Having a clearly defined purpose and using the least intrusive means to achieve it
- Having a lawful basis for processing workers’ data – such as consent or legal obligation
- Telling workers about any monitoring in a way that is easy to understand
- Only keeping the information which is relevant to its purpose
- Carrying out a data protection impact assessment for monitoring that is likely to result in a high risk to the rights of workers, and
- Making the personal information collected through monitoring available to workers if they make a subject access request.
Monitoring personal devices is considered the most intrusive practice at 83%, followed by recording audio and video (78%) and taking screenshots or webcam footage (77%). Monitoring timekeeping and access is considered the least intrusive practice, although 47% still found this intrusive.
The guidance also provides an overview of how data protection law applies to the processing of personal data for monitoring workers and considers specific types of monitoring practices, including the use of biometric data to monitor time-keeping and attendance.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
Employee relations opportunities on Personnel Today
Browse more Employee Relations jobs
