Employee Monitoring - Updated ICO Guidance

The rise of working from home and developments in the technology available has led to many employers introducing or investigating methods to monitor their employees.  The Information Commissioner's Office (ICO) published guidance on 03 October 2023 for employers on monitoring workers lawfully, transparently and fairly.  As well as outlining the legal requirements that employers must adhere to in order to comply with data protection legislation, the guidance also provides good practice advice to help employers build trust with their workforces and respect their employees' rights to privacy.

Comment

This new guidance note is not revolutionary and does not contain anything surprising. However, it is worth reviewing, not least because the ICO has various enforcement powers to take action for a breach of data protection legislation, including the power to issue fines of up to the higher of £17.5 million or 4% of a company's annual worldwide turnover for serious breaches. We have already seen enforcement action in European courts, with an employee of an American company in the Netherlands receiving a judgement for 75,000 Euros in November 2022 for unfair dismissal having refused to keep his webcam on whilst working.  Employers should direct particular attention to the ICO checklists.  On a more positive note, the ICO survey suggests that not only will close adherence to the data protection legislation keep companies compliant with the legislation, but compliance with the ICO good practice will likely assist employers with employee satisfaction and retention.  

Background

A survey commissioned by the ICO, which was released along with this guidance, revealed that 19% of respondents believed that they had been monitored by an employer, whilst 70% of respondents stated that they would find monitoring in the workplace intrusive and fewer than 19% would feel comfortable taking a new job if they knew that they would be subject to monitoring by their new employer.

Accompanying the release of this research and the ICO's guidance, Emily Keaney, the Deputy Commissioner - Regulatory Policy at the Information Commissioner's Office, said that "while data protection law does not prevent monitoring, our guidance is clear that it must be necessary, proportionate and respect the rights of workers. We will take action if we believe people's privacy is being threatened." 

Monitoring

Monitoring can include the use of tracking calls, messages, internet activity and keystrokes, webcam footage and audio recordings, productivity tools which log employee activity and camera surveillance.

The ICO guidance states that if an organisation is looking to monitor workers, it must take steps including:

• Making workers aware of the nature, extent and reasons for monitoring;
• Having a clearly defined purpose and using the least intrusive means to achieve it;
• Having a lawful basis for processing workers data - such as consent, legal obligation or legitimate interests;
• Telling workers about any monitoring in a way that is easy to understand;
• Only keeping the information which is relevant to its purpose;
• Taking all reasonable steps to ensure the personal information gathered is not incorrect or misleading;
• Carrying out a Data Protection Impact Assessment for any monitoring that is likely to result in a high risk to the rights of workers; and
• Making the personal information collected through monitoring available to workers if they make a Subject Access Request.

It is important that employers should not monitor workers 'just in case'. Employers must document why they are monitoring employees and what they intend to do with the information they collect.