Employers have always monitored their staff in one way or another because they have always needed to be able to check the quality and quantity of their employees' work. As employers are very often liable for the actions of their employees, they also need to be sure that their staff members are behaving properly.
Employers have always monitored their staff in one way or another because they have always needed to be able to check the quality and quantity of their employees' work. As employers are very often liable for the actions of their employees, they also need to be sure that their staff members are behaving properly.
Most employees have access to a variety of hi-tech tools such as email, the internet and mobile phones to help them with their work. Employers need to be sure that these ways of working do not give rise to additional liabilities – for example, some employers have found themselves liable for claims of sexual harassment, defamation or breach of contract due to their employees' improper use of their systems or equipment. It is also all too easy for company security to be breached, confidential business information to be leaked or for employers to become the victim or perpetrator of fraud because of the deliberate or inadvertent acts of their staff. In addition, the increasing use of social network sites by staff has the potential to damage an employer's reputation.
There is an abundance of technology - such as CCTV or monitoring software - which employers can use to monitor their staff, but employers need to ensure they do not go too far and risk claims for unfair dismissal or breach of the considerable volume of legislation which dictates what employers can and cannot do in terms of monitoring their staff. Nonetheless, employers can protect their businesses and obey the law if they stick to some basic rules about monitoring.
Before carrying out any monitoring at all, the employer should go through a process of weighing up carefully the pros and cons of the proposed monitoring, consulting the Information Commissioner's Office's guidance on data protection impact assessments (DPIAs). What exactly is the purpose of the monitoring? How much of a real difference will it make to the company to have information which could be obtained? What steps would the employer put in place to make sure the information was properly handled once it was obtained?
The employer should then consider whether there are any less intrusive ways in which it could achieve the same goal. For example if an employer is worried that staff are sending too many personal emails at work, could it reduce the number simply by sending a 'round robin' reminder to staff or does it need to set up a system to check the number of personal emails being sent?
The employer should then weigh up the advantages of the monitoring against the adverse impact it might have for staff or customers of the business. Any adverse impact of monitoring on individuals must be justified by the benefits to the employer and others and monitoring must be a proportionate response to the problem it seeks to address. More often then not, employees' private lives do extend into the workplace and the employer should assess how much the proposed monitoring will affect employees' privacy or damage their trust in their employer.
Ideally, once the employer has considered the pros and cons it should set out briefly in a note the issues they have considered and the reasons they have come to the decision they have made.
More often than not, employers do not need to keep monitoring a secret. Employees understand and expect their employers to keep an eye on their business. If the employer can explain the reason why it believes monitoring to be necessary they will not normally have any objections. Employers must inform their staff about the types of monitoring taking place, the reasons for it, the sort of information that will be obtained and when, why and how it will be obtained, how the information will be used and to whom it will be disclosed.
By far the best way to tell staff what you are doing is to have a clear policy which sets out the monitoring which is taking place and the reasons for it.
A policy alone will not suffice and employers must make sure that employees are made aware of the policy and that they practice what they preach. To be safe, employers will be expected to clearly communicate to staff what they can and cannot do and the best way to do this is by training them. If and when systems change, the policy should be updated and employees should be told about any changes.
There may be times when an employer would prefer not to tell staff that it is monitoring them, but this type of 'covert' monitoring should be used rarely and with particular care.
Before considering implementing any type of covert monitoring, employers should therefore remember that an additional detailed privacy impact assessment should be undertaken.
The employer should ensure that any covert monitoring is strictly targeting, that monitoring does not continue for any longer than absolutely necessary and that as few people are involved in the investigation as possible. Senior management would be expected to sign off on any decision to use covert monitoring.
The purpose of monitoring is obviously to collect information whether this is in the form of emails, video footage, audio recordings or information about someone's internet usage. However, employers must remember that with information comes obligations. Employers must be able to manage and store the information they receive properly, especially if it relates to a living person who can be identified from that information. The Data Protection Act (DPA) sets down rules about how this information should be used and stored.
In addition to the DPA, the Human Rights Act gives every individual a right to respect for their private and family life, home and correspondence. Although the Human Rights Act applies directly only to public authorities and their employees, it indirectly affects private employers and employees because employment tribunals and courts are expected to take it into account when deciding cases. Although the employees' right to privacy does not outweigh all other rights and must be balanced against other interests - such as public safety, the prevention of crime and certain economic considerations - it is valued very highly by employees. Employers will be expected to balance their own needs very carefully against their employees' legitimate right to privacy in the way they hold and use information they gather in the course of monitoring.
Employers should ensure that the number of people who have access to the personal information obtained through monitoring is kept to a minimum. Those in receipt should be subject to confidentiality and security requirements and should be properly trained where the nature of the information requires this. Information collected through monitoring should only be used for the purpose for which the monitoring was introduced.
Laws on the interception of communications are also relevant. The Regulation of Investigatory Powers Act (RIPA) makes it unlawful to intentionally intercept communications in the course of transmission without lawful authority. Intercepting basically means making some or all of the content available, while being transmitted, to a person other than the sender or intended recipient. Transmission also covers diverting or recording the content to look at later. RIPA will cover monitoring email use at a content level rather than at a traffic level.
Employers who discover their staff members have been committing misconduct should make sure they follow their own internal disciplinary procedures carefully if they have them before taking any disciplinary action against an employee, and whether they have internal procedures or not they should ensure that they follow the Acas Code of Practice. The Out-Law guide to disciplining employees fairly sets out in more detail the steps employers should follow in investigating alleged misconduct, holding a disciplinary hearing and ensuring that any disciplinary sanction they impose can be justified.