Monitoring employees – what are the legal issues you need to be aware of?

  • Posted

As a result of COVID-19 and the pandemic lockdowns, many people have been required to work from home. This has created significant challenges for some businesses and led to a number of employers investing in activity tracking software to keep tabs on their workforce.

Research by academics at Cardiff University found that employers were worried that employees might “shirk and productivity will fall” while they were away from the workplace and did not have physical presence in the workplace.  As a result of these concerns, a significant number of employers are reported to have signed up for software monitoring solutions with companies such as Hubstaff and Sneek who reported a huge increase in users during lockdown. However, interestingly, at the date the report was produced by the academics at Cardiff University, productivity had not been affected.

Products described as ‘workplace analytics’ or ‘time tracking’ may sound like harmless and easy solutions to manage productivity or protect against data breaches, however, many of these will log every action by individual keystroke which arguably goes  beyond what is necessary to manage a workforce, whether working remotely or not. Many will take regular screenshots from devices and some can even provide live video feed of the screen.

Whilst some may argue that such software is necessary for maintaining and monitoring productivity, the surveillance of employees in the workplace can undermine trust and adversely affect employer/employee relationships.

Surveillance of employees in the workplace will involve the processing of personal data and, as such, it is necessary to ensure compliance with data protection law, as set out in the Data Protection Act 2018. Failing to comply with data protection legislation when monitoring and collecting data can have a serious impact for businesses, both financially and reputationally.

The Information Commissioner’s Office (ICO), the UK’s regulator for data protection, offers useful guidance on this topic within its code of employment practice. It considers the key issues of transparency, proportionality, and legality.

In weighing up the merits of monitoring, the interests of the employee must be balanced against those of the employer. No business case, such as keeping track of productivity to protect the business, can override the employer’s obligations to comply with the Data Protection Act 2018. Where an employer is considering monitoring its employees, they must first undertake a data protection impact assessment (DPIA) to assess the necessity and proportionality of the proposed data processing.

An employer also needs to consider Article 8 of the European Convention on Human Rights, incorporated into UK law by the Human Rights Act 1998, which provides everyone with the right to respect for their private life and family life, their home and their correspondence. This also includes a right to privacy in the workplace. An employer should be mindful of an employee’s right to privacy when considering implementing a monitoring system.

Finally, there is also the legal consideration of the mutual duty of trust and confidence which is implied into the employment contract between employer and employee. If an employer were to breach this duty, through the use of certain monitoring practices, it could give rise to claims for constructive dismissal.

Due diligence should also be undertaken with any proposed software provider, as they will be processing data, some of which will be personal data. It’s likely you will need to carry out a data protection impact assessment (DPIA) in this regard as well. As above, undertaking a DPIA involves a systematic approach to consider all aspects of the data processing and identify risks and how they may be mitigated. It’s a useful tool to ensure you have covered all bases, and the ICO has a template for organisations to follow.

If monitoring has been assessed as being justified and lawful, the next step is to inform everyone as to how it will work in practice and explain its purpose in an open and transparent way. Privacy notices and policies should also be updated.

As we continue through the pandemic, developments such as employee monitoring should be considered with care and the necessary steps followed before being implemented into an organisation.

If you have any queries regarding this or any other employment matter, please do not hesitate to contact a member of the team.