Monitoring employees

Employers may need to monitor employees to meet legal obligations, but monitoring must remain within appropriate legal boundaries.

We advise employers on lawful monitoring, helping them manage risks and respond to challenges to their practices.

Can you monitor employees without consent?

Employers may have legitimate reasons to monitor employees, but must balance business needs with employees’ privacy rights. We advise on the legal and practical issues that arise when deciding what monitoring is appropriate.

Technology is developing rapidly, making clear employment contracts and monitoring policies increasingly important. These should explain what monitoring may take place, why it is necessary and how information will be used.

A well-drafted policy sets clear expectations, identifies unacceptable activities and explains the monitoring methods an employer may use.

Monitoring employees working remotely

Remote monitoring can range from checking email and internet use to software that records screen activity, calls or keyboard use. The more intrusive the monitoring, the greater the need to justify it and consider its impact on employees’ privacy.

Under data protection law, monitoring must have a lawful basis and a clear purpose. Examples may include protecting confidential information, maintaining IT security or investigating suspected misconduct. Employers should ensure that monitoring is necessary, proportionate and transparent.

Employee rights to object to monitoring

Employees may challenge monitoring where it unjustifiably interferes with their privacy or breaches data protection law. Employers must handle information collected through monitoring appropriately, including by ensuring that they:

• Collect only data necessary for a defined purpose;
• Retain information only for as long as necessary;
• Respond appropriately to requests for access; and
• Keep personal data secure.

Legal reasons for monitoring employees

Employers may be held liable for certain acts committed by employees in the course of their employment, including some conduct involving discrimination, defamation or misuse of information. Monitoring may help identify and address risks, but must itself be lawful and proportionate.

Employers may also need to investigate suspected breaches of confidentiality or intellectual property rights. Clear investigatory and disciplinary procedures can help ensure that concerns are addressed promptly and fairly.

Data protection obligations

Employee monitoring involves the processing of personal data and must comply with applicable data protection law. This includes ordinary personal data, such as names and contact details, and special category data, such as information about health, religion or trade union membership. Additional conditions apply when processing special category data.

How employers can reduce legal risks

Employers should review their employment contracts and policies to ensure they address relevant risks, including:

• Rules on employees’ online and offline conduct where it affects the business;
• Restrictions on the use and disclosure of confidential information; and
• Appropriate provisions concerning company information and social media accounts when employment ends.

Employers should not assume that contractual terms give them unrestricted access to private or third-party accounts. Any access must have a lawful basis and be justified by the circumstances.

For example, where an employee transfers company information to a personal account, clear confidentiality and information-security provisions can help the employer respond and protect its business interests.