Monitoring employees at work may be necessary for a variety of reasons. For example, you may need to safeguard employees to ensure workers aren’t at risk from unsafe working practices. In some sectors employers may have a legal or regulatory need to carry out some monitoring.
It’s important to be aware that any information you gather through monitoring should only be used for the purpose it was carried out for, unless it leads to the discovery of other things such as a breach of health and safety. The Data Protection Act doesn’t prevent employers from monitoring workers, but employers should remember workers are entitled to some privacy at work. For example, employers must tell employees about any monitoring arrangements and the reason for it.
Steps to take before monitoring employees
The Information Commissioners Office (ICO) encourages employers to undertake an “impact assessment” before carrying out any monitoring of workers. Undertaking such an assessment is an important step to take for employers wishing to engage in monitoring employees. Details of how to undertake such an assessment are set out in the ICO’s Code, however, some key take away points include:
- Employers should be able to show the purpose of carrying out the monitoring and that they have considered whether the particular monitoring arrangement truly achieves this purpose.
- Employers should consider the impact of the monitoring on its employees, the need to be fair to its employees and whether there are less intrusive alternative or restricted methods of monitoring which achieve the same purpose, such as reviewing email subject lines rather than the contents.
- Employers should ensure their workers are aware of the extent to which they are being monitored and why. This could be through notice-board signs, through training or by sending an email to them about the monitoring.
- Employers should limit the number of people who have access to the information collected through the monitoring process and be particularly careful when monitoring communications which are clearly personal in nature.
Be careful not to view an impact assessment as a tick box exercise. Once all information has been collated, you will need to make a balanced decision as to whether or not the proposed monitoring is justified in the circumstances.
Monitoring employees and the GDPR
Notably, the regulation of data protection in the UK is being reconsidered as part of the implementation of the General Data Protection Regulation (“GDPR”) and the ICO guidance is likely to be reviewed when the new Data Protection Bill comes into force in May 2018. Until then, the current guidance is useful to help employers maintain the delicate balance between their right to monitoring and their workers’ reasonable expectations of privacy.
Key points to consider when monitoring employees
- Employers should have written policies and procedures in place regarding monitoring at work and in some cases give their explicit written consent to this.
- Monitoring shouldn’t be excessive and should be justified.
- Staff should be told what information will be recorded and how long it will be kept .
- If employers monitor workers by collecting or using information the Data Protection Act will apply.
- Information collected through monitoring should be kept secure.
Types of employee monitoring
Employers may monitor staff at work in various ways, which may include:
- CCTV;
- looking at use of email or website visits;
- listening in on telephone calls;
- bag searches; and
- email and web monitoring.
Although employers don’t have to allow workers the use of phone, email or internet for personal use, many employers will allow some access as long as it doesn’t interfere with their work. If you do monitor this, ensure your employees are clearly informed and given the reason why it will be carried out.
You’re advised to ensure you have procedures in place setting out what is and isn’t allowed, some websites may be banned or marked as at risk. Employers should tell workers:
- if they are being monitored;
- what counts as a reasonable amount of personal emails and phone calls; and
- if personal calls and emails are not allowed.
These procedures should be made clear and understood by all workers. If a worker does not comply with the policy and procedures you will then be able to take disciplinary action.
CCTV monitoring
CCTV monitoring can be used in the workplace for a number of reasons. If CCTV is installed, you should make sure employees are aware of it, this is usually done by displaying signs to say where the locations of the cameras are. Also notify workers of the reason for the monitoring.
Signs should:
- be clear, visible and readable;
- contain details of the purpose of the surveillance and who to contact about the scheme; and
- include contact details such as website address, telephone number or e mail address.
Under the Data Protection Act if you give a reason for the CCTV monitoring, for example to prevent theft, you can’t then use the footage for another reason such as recording entry and exit of workers from the workplace.
Further information is available from the Information Commissioner’s Office guidance: CCTV Code of Practice.
Bag searches
If you intend to carry out bag searches a workplace policy must be in place that informs employees that bags and purses will be subject to searches. Employers must have a legitimate work-related reason for carrying out searches. You should also have explicit consent for this in your contract of employment.
Covert monitoring
It’s very rare that employers would need to carry out monitoring in secret without staff being told they are being monitored. Employers must have a genuine reason to carry out covert monitoring such as criminal activities or malpractice. Monitoring must be obtained as quickly as possible, and only as part of a specific investigation. The monitoring must stop when the investigation has finished.
For assistance on implementing a monitoring policy or strategy in the workplace or for advice on dealing with particular cases, please contact us.
