Monitoring employees

Employer monitoring of employees is legal. In many cases there is a legal duty to monitor employees. However, there are boundaries employers should operate within.

We specialise in keeping employers within the legal framework of permitted employer monitoring and able to successfully defend themselves against claims. 

Can you monitor employees without consent?

Most employers do not want to invade the privacy of employees. On the other hand there can be legal reasons why employers need to monitor employers. We advise employers on the many grey areas that arise concerning legal monitoring of employees and guide on the judgment calls often needed.

The technology available to employers is rapidly developing.  Unfortunately, the law has not kept up.  The legal powers available to employers is in a state of development. However the employer may be on firm legal ground if it can rely on the employment contract.  Modern employment contracts and policies should include provisions detailing any monitoring that will take place. As the scope of intellectual property rights develops, your employment contracts need to be updated and reviewed to reflect these developments, regardless of your business’s size or operations.

A good monitoring policy will set boundaries, inform employees what they can and cannot do,  highlight activities detrimental to the business and set out the type of monitoring the employer may undertake.

Monitoring employees working remotely

Remote monitoring may range from random spot checks of emails and internet use to installing more invasive software that records laptop screens and calls and tracks keyboard use.

Under the GDPR and DPA, any processing of personal data must have a specific, explicit and legitimate purpose. A legitimate purpose for monitoring employees may be, for example, to safeguard the security of personal data while employees are working remotely, to ensure compliance with legal obligations or to ensure an employee is performing their obligations under an employment contract.

Employee rights to object to monitoring

Employees could object to employer monitoring under “Human Rights” legislation.  Furthermore, an employer has a responsibility to store the information obtained via monitoring.  The responsibility extends to:

• The employer must collect only the information necessary for a specific purpose(s);
• The employer should only hold as much data as required, for as long as required;
• The employer must allow the employee to see it on request; and
• The  employer must keep the information secure.

Legal reasons for monitoring employees

Employers can be held legally responsible for their employees actions. This is termed vicarious liability. This means an employer could be liable for comments made about another employee or a competitor.

Defamation, discrimination and data protection laws all make employers responsible. Even if the employee was not at work the employer can still be liable.

Even if vicarious liability does not apply, employers often need to know what employees actually do.

There are also legal risks for employers if there is a breach of copyright by an employee because the employer may be accused of facilitating the breach.  Employers can be liable for secondary infringement of intellectual property such as copyright. Thus employers do need to monitor this and act quickly if there is a suspected breach of copyright. Copyright breaches could include employees whilst at work:

Employers should ensure they have clear and well drafted disciplinary and investigatory procedures which allow swift action.

Data protection obligations

When monitoring employees, consider data protection laws. The laws are complex, and encompass EU regulations and regulatory bodies’ practice guides and procedures. Generally, there are two types of data:

• Personal data: names, addresses, telephone numbers and dates of birth; and
• Sensitive personal data: race, religion, health records and memberships, e.g. trade unions.

How employers can reduce legal risks

The legal risks can be limited by including in the employment contract provisions such as:

• Clauses stating what employees can or cannot say online or offline about your business, customers, competotors or anything which may be controversial or detrimental.
• Restricting use of confidential information;
• Restricting employee’s use of social media following termination, e.g. Employers commonly include clauses specifying the removal of any reference to the business from an employee’s social media sites.

In addition, employers should ensure they have the power to access:

• Private accounts where there are reasonable grounds for the employer to require access;
• Third party accounts if there are potential security risks.

As an example of why it's so essential to have the right employment contracts, if an employee loads company information onto a personal account this can amount to a misuse of business’ confidential information if  the employment contract contain provisions about the use and misuse of confidential information.