Overzealous monitoring may overstep data protection boundaries

Employers who harness software to help manage productivity and other employee activity may find themselves inadvertently over-stepping data protection regulations.

The rise of electronic monitoring of employees has risen in tandem with the rise in home working triggered by the Covid-19 pandemic.  While the numbers working from home has dropped from its peak of 49% during the 2020 lockdowns, most recent figures from the Office of National Statistics show that around 40% of working adults are still working from home at least some of the time.

Before the pandemic the figure was around 12.5%, and the dramatic shift has driven businesses and organisations into uncharted territory to manage their newly remote workforce.  Many have addressed the challenge through an increasing use of electronic monitoring to tackle what may be seen as a loosening of control.

New research from the Information Commissioner’s Office, which oversees and regulates data protection and freedom of information in the UK, found that 19% of those surveyed believe they have been monitored by an employer.

Asked how they felt about being monitored, 70% of those surveyed by the ICO said they felt it was intrusive and only 19% were comfortable taking a new job where an employer would be monitoring their activity.

This discomfort echoes findings by the Trades Union Congress in 2022, which found significant and growing support among workers for stronger regulation of AI and tech-driven workplace surveillance, with more than 70% saying they believed technology-informed decision-making could increase unfair treatment.  The TUC research found some sectors reporting very high levels of surveillance, at more than 70% across the financial sector and the wholesale and retail sectors.

Developments in software have made a range of options available to employers, making it all too easy to implement a form of monitoring, whether to check if people start work on time or to monitor activity – such as through the number of keystrokes being made – but that ease of monitoring should not be taken for granted.  Any monitoring has to comply with data protection law.

There’s also the potential breakdown in trust and reputational damage that may come through implementing what employees may consider to be a surveillance culture.

To support organisations in ensuring that any monitoring of workers is undertaken lawfully, transparently and fairly, the ICO has issued guidance for employers, which highlights some of the key considerations.  The privacy watchdog has also issued a warning to employers, saying they will take action if people’s privacy is threatened.

Monitoring workers is only legally allowed if one of six situations apply: consent; contract; legal obligation; vital interests; public tasks; and legitimate interests.

Any surveillance needs to measure up against at least one of these criteria, although in some situations it may be hard because of the imbalance in an employer/employee relationship. In some circumstances employees may feel they would be putting their job at risk if they were to dispute a planned form of monitoring.

The best approach is to ensure not just that any action is legal, but also be sure that employees know what is happening and have a sense of trust. It’s too easy for surveillance to feel like an invasion of privacy, whether or not it passes the legal test.  Policies also need to be reviewed and updated regularly, to keep in line with advances in technology.