New guidance for employers on monitoring workers and reminder any monitoring must be fully compliant with data protection law.
The Information Commissioner’s Office (ICO) is warning organisations to consider both their legal obligations and their workers’ rights before they implement any monitoring in the workplace. It is publishing new guidance to help employers, including in the public sector, to ensure full regulatory certainty, protect workers’ data protection rights, and help employers build trust with workers, customers and all service users.
Monitoring can include tracking calls, messages and keystrokes, taking screenshots, webcam footage or audio recordings, or using specialist monitoring software to track activity.
The official UK privacy watchdog notes that with the rise of remote working, many employers are looking to carry out checks on workers — with research it just commissioned showing that almost one in five (19%) respondents convinced they have been monitored by an employer. The same research shows a very high 70% said they would find monitoring in the workplace intrusive and 19% would not feel comfortable taking a new job if they knew that their employer would be monitoring them.
The guidance therefore tries to provide clear direction on how monitoring can be conducted lawfully and fairly. As well as outlining legal requirements, it also includes good practice advice to help employers build trust with their workers and respect their rights to privacy.
“Our research shows that today’s workforce is concerned about monitoring, particularly with the rise of flexible working,” said Emily Keaney, deputy commissioner - regulatory policy at the ICO.
“Nobody wants to feel like their privacy is at risk, especially in their own home, and as the data protection regulator, we want to remind organisations that business interests must never be prioritised over the privacy of their workers. Transparency and fairness are key to building trust and it is crucial that organisations get this right from the start to create a positive environment where workers feel comfortable and respected.
“We are urging all organisations to consider both their legal obligations and their workers’ rights before any monitoring is implemented. While data protection law does not prevent monitoring, our guidance is clear that it must be necessary, proportionate and respect the rights of workers.”
She also warned that her team will act if it believes employee privacy is being threatened by use of monitoring tech.
If you are looking to monitor workers, you must take steps including:
- ensuring workers are aware of the nature, extent and reasons for monitoring
- having a clearly defined purpose and using the least intrusive means to achieve it
- having a lawful basis for processing workers data – such as consent or legal obligation
- telling workers about any monitoring in a way that is easy to understand
- only keeping the information which is relevant to its purpose
- carrying out a Data Protection Impact Assessment for any monitoring that is likely to result in a high risk to the rights of workers
- making the personal information collected through monitoring available to workers if they make a Subject Access Request (SAR).
The guidance provides an overview of how data protection law applies to the processing of personal data for monitoring workers. It also considers specific types of monitoring practices, including the use of biometric data to monitor timekeeping and attendance.
