It is generally accepted that one of the ‘positives’ to come out of the Covid pandemic is the new regime of hybrid or remote working. Whilst ‘working from home’ was arguably forced on many companies and organisations to ensure business survival, the new dawn has seen the concept of flexible working being implemented as the ‘norm’. There have been many reports published which advocate the mental health benefits of promoting the ‘work/life balance’ with flexible working being used more frequently as a benefit to retain staff and attract new talent.
With this recent trend, there have also been many advancements in modern technology and monitoring software. Keystroke monitoring to track and capture keyboard activities is one that we have recently been asked to comment on.
‘Reasonable’ monitoring clauses have been a standard provision in many employment policies and contracts for some time. But with this new trend and an increased number of remote workers, there is a risk that the lines between private and family life are being blurred with work life.
It has therefore come as no surprise that the Information Commissioners Office (ICO) has this month produced ‘draft’ guidance on monitoring in the workplace which has now been published for public consultation.
According to the consultation commentary, the draft guidance “aims to provide practical guidance about monitoring workers in accordance with Data Protection legislation and to promote good practice”. Input from multiple stakeholders was sought before the draft guidance was published including the views of Employers & Employees, professional associations and recruitment agencies to name but a few. As well as addressing ‘systematic’ monitoring, the guidance also deals with more discrete and ‘occasional’ monitoring such as covert recording.
The current legislation which covers workplace monitoring is the UK General Data Protection Regulations (GDPR) and the Data Protection Act 2018. Public bodies must also consider various rights enshrined within the Human Rights Act – the most relevant for this subject matter being the right to respect for a private and family life.
In a nutshell, any monitoring of workers must be done in a way that is compliant with the legislation. This includes for example only using the information collated as part of any monitoring process for the purpose it was intended for, and only storing the data for a reasonable period of time. The Data Protection Act sets out 8 principles for compliance which should be at the heart of any monitoring and data processing, and not just seen as a checklist.
Advice for Employers
If you are considering ways of introducing monitoring software or monitoring your workers generally our advice would be to ensure that any surveillance is justified and proportionate. To help demonstrate this you will need to have a clearly documented business rationale explaining why it is felt necessary, and how the monitoring will be achieved. Transparency is key in managing expectations about privacy in the workplace. We would also recommend you carry out a Data Protection Impact Assessment – whilst currently this is only required for “high-risk” projects, the draft guidance describes as an “important accountability tool”. If as an Employer you find yourself on the wrong end of a complaint, being able to evidence that you gave the monitoring activities suitable consideration and assessed its likely impact, will go a long way to being able to show ‘reasonableness’.
We would also recommend you look at other policies such as your general I.T and communications policy to ensure these address monitoring in the workplace. If you are an Employer who has embraced ‘working from home’ consider either enhancing your current homeworking policy or in the absence of one, create a policy which specifically addresses any remote monitoring you will be undertaking.
The ‘draft’ guidance not only provides detailed information on monitoring generally, but also deals with more advanced areas of monitoring being utilised by commerce, such as ‘biometric’ data. The guidance provides many practical recommendations, and in our view, a useful insight into the trajectory of travel this somewhat complex area of law is taking.
Advice for Employees
There is no doubt that excessive monitoring can have an adverse impact not only on Data Protection rights, but on the relationship of trust and confidence which is essential to every working relationship. It is only in exceptional circumstances that covert monitoring will be acceptable, such as where criminal activity is suspected, with any covert monitoring being limited to a specific investigation which should cease as soon as the investigation is concluded.
If you are an Employee who has been the subject of excessive workplace monitoring and you feel that your rights are being infringed, you could have many avenues of recourse, ranging from submitting a grievance, through to claiming Constructive Unfair Dismissal if you can demonstrate a fundamental breach.
Have your say
The public consultation on the draft guidance will remain open until 11 January 2023. The consultation asks for responses to specific questions, and as this could potentially influence major change, all are encouraged to contribute.
For further information on the draft guidance please click here :
