<– Use the green share button to send this article to your customers
A. In the UK, data protection is governed by the Data Protection Act 2018 and the UK General Data Protection Regulation (“GDPR”). As monitoring involves the processing of personal data (information which identifies the individual), these rules apply. It’s important therefore that your clients are aware of them if they intend to, or already do, monitor employees.
The rules apply to any monitoring of anyone who carries out work on behalf of the employer and cover systematic and occasional monitoring. Examples include monitoring timekeeping or access control, keystroke monitoring to track, capture and log keyboard activity and productivity tools which log how employees spend their time and CCTV, although there are others.
Monitoring must also be dealt with in a way that is sensitive to the employee’s position. Privacy expectations of employees working from home are likely to be higher than for those in the office, and this should be taken into account.
Firstly, your clients must be clear about the purpose of any monitoring and why the personal data is being processed, and only use data collected via monitoring for that purpose.
Employees have the right to be informed about processing of their personal data, and your clients need to be transparent about it. A monitoring policy is an ideal way to do this, which sets out the purpose of monitoring, what data is being collected and the lawful basis for it. Unless there is a good reason for not doing so, such as suspected criminal activity, monitoring should be discussed with employees first and their views documented.
A Data Protection Impact Assessment (DPIA) must also be carried out before undertaking any processing which is likely to cause high risk to employees’ interests such as processing biometric data or using profiling or special category data to make decisions.
A lawful basis is needed to collect and process personal data. These are:
- Consent
- Legal obligation – where it’s necessary to do so to fulfil a legal requirement, such as monitoring driving hours,
- Legitimate interests, either of the employer or a third party, unless the risks to the employees’ rights overrides them.
Special category data is sensitive personal data including information on protected characteristics and biometric data. Collecting this data requires a special category condition to be identified. These are:
- Explicit consent
- Legal compliance
- Substantial public interest.
All reasonable steps must be taken to ensure data collected is accurate, and if it’s not it should be remedied quickly. Data must be kept securely, and for only as long as it is needed. Employees have the right to request data held on them, and to ask for that data to be erased.
Covert monitoring happens when employees are unaware of it. Generally, this is difficult to justify. If your client is considering this, they must:
- Carry out a DPIA
- Get it authorised by senior management
- Have grounds for suspecting criminal activity or similar
- Be sure informing employees about it would prejudice its prevention or detection
- Target it at obtaining evidence in the shortest time possible, and stop once the investigation is complete
- Not use covert audio or video monitoring in areas where employees would reasonably expect to be private, such as changing rooms
- Not be used to capture communications that employees would reasonably expect to be private, such as personal emails
