Monitoring in the Workplace: What You Need To Know

Is monitoring in the workplace legal?

With vast technological advances over recent years, the reliance on monitoring methods to enhance productivity, ensure security and maintain a healthy work environment has grown significantly.

So how can you ensure your monitoring practices are lawful?

The key considerations to keep in mind are:

• Privacy Laws – Check that you are compliant with both Article 8 and Data Protection laws
• Notice and Consent – Inform your employees about monitoring practices in advance and obtain explicit consent where required.  Transparent communication fosters trust and helps avoid legal issues arising
• Proportionate – Monitoring methods must be proportionate to the intended purpose.  Excessive or unnecessary monitoring could violate privacy rights and lead to costly employment tribunal claims
• Data Security – Employers are obliged to safeguard collected data to prevent breaches and unauthorised access.  Make sure that anyone reviewing the data only reviews what is absolutely necessary, and does not share the information with unauthorised personnel
• Union agreements and employment contracts – Monitoring methods must align with any collective bargaining agreements or employment contracts
• Equality and Diversity – Monitoring should not result in discrimination or harassment based on any of the nine protected characteristics

Obtaining the right balance

The most important thing to consider prior to implementing any form of monitoring is “why”? Why do you need to introduce monitoring in the workplace? Is this a legitimate business reason – that is – can you justify the need to monitor?

Any form of monitoring should be clearly documented via a staff handbook or singular policy. Staff must be updated as to any monitoring changes with the business.

Some standout considerations are:

• Be transparent – Communicate why you need to implement the monitoring practices and the benefits and document this
• Obtain consent – And document this on personnel files
• Limitations – Restrict the data collection to only what is necessary and relevant for the intended purpose
• Security – Ensure robust data security measures to prevent unauthorised access and breaches
• Review – Review the requirement for access regularly to continuously assess the effectiveness and legality of monitoring methods and adjust them accordingly

Who has the right to monitor?

You should carefully consider who, within your business, should have the right to access the information and how this may be shared. This is crucial from a data protection perspective. The Information Commissioner’s Office sets out detailed guidance on monitoring at work.

Policies for the right to monitor

Company policies should clearly set out the reasons and benefits for monitoring, as well as any sanctions for non-compliance. It is important to provide employees with either a copy of the staff handbook, or individual policies in relation to monitoring, from as early as the offer of employment. Regular training should also be provided e.g., data protection, cybersecurity etc, in order that your expectations continue to be reinforced throughout the employment relationship.

Monitoring tools

There are many tools that can be used to monitor employment practices, including:

• Email – tracking employee emails to prevent security breaches or ensure compliance
• Computer and internet usage – used to mitigate risks, prevent misuse and ensure productivity levels remain high
• CCTV – used to monitor access, deter theft and maintain safety
• GPS tracking – to manage fleet operations and monitor the location of employees – particularly useful for lone workers
• Performance – analysing performance matrix such as call duration, keystrokes, task completion
• Biometric data collection – facial recognition/fingerprint detection for access control
• Social media monitoring – observing social media activities that may affect the company’s reputation

Case Law

The 2017 case of Barbulescu v Romania stresses the importance of understanding Article 8 of the Human Rights Act 1988.

In this case, an engineer set up an email account to deal with customer enquiries, via Yahoo. In July 2017 the company identified that Barbulescu had been emailing his brother on numerous occasions, as well as his fiancé, on personal matters.

When questioned Barbulescu denied this. However, he was subsequently provided with copies of the discussions, following an investigation. Once the disciplinary proceedings were concluded Barbulescu was dismissed for gross misconduct, the reason cited for the dismissal being that he had breached company policies.

The employer claimed that they had a policy which set out that company equipment could not be used for personal purposes. It also claimed that it had a policy which allowed monitoring of personal emails. However, Barbulescu denied any knowledge of having been issued with copies of the same.

Barbulescu claimed unfair dismissal. This was rejected by both local courts and upon appeal in a Chamber vote. However, the European Court of Human Rights Grand Chamber subsequently ruled 11 votes to 6 that there had indeed been a violation of Article 8.

The ECHR determined that Barbulescu was not given enough detail in relation to company policies as to how email monitoring would be implemented and to what extent. The judgment also noted the failure of the company to give proper consideration as to whether such intrusive monitoring was necessary at all.

This case does not rule out the use of monitoring in the workplace, but it does send out a very important message to all business owners that monitoring must be reasonable and justifiable, in all cases.

A blanket policy will therefore likely fail if a legitimate business reason cannot be established.