I spy: what are the rules on workplace surveillance?

When we think of surveillance, CCTV cameras, cyberspying, or social media mining might spring to mind, but Big Brother is also watching us as we go about our working day.

Surveillance is widespread and is likely to become even more so. More than half of UK employees (56%) believe they are being spied on at work, according to a 2018 workplace monitoring report. Meanwhile, two-thirds (66%) are concerned “that workplace surveillance could be used in a discriminatory way if left unregulated”.

Working from home during lockdown has highlighted the issue of workplace surveillance as companies look at ways to monitor staff productivity. Here we explore what it means for you, wherever you are working, and what to do if you think you’re being spied on.

What is workplace surveillance?

Workplace surveillance or monitoring comes in different forms. It can include monitoring of employees’ work emails and browsing history, analyzing phone logs, recording calls, or scrutinizing their social media presence. It can also include movement tracking through CCTV, facial recognition, or wearable devices.

The coronavirus pandemic moved most of our communication online, which meant that employers got the chance to keep tabs on staff via various software apps. Many of these were originally conceived as tools to support company culture, including the video conferencing app Zoom which removed the attendee attention tracker feature on April 2 that allowed call hosts to track whether participants were paying attention. Another popular choice is Sneek, an always-on, video conference app that features a “wall of faces” of the office. It constantly updates every one to five minutes by taking photographs of staff with their laptop cameras, thus ensuring they stay at their desks.

A return to the office will not necessarily mean a drop in surveillance. The tech industry is gearing up to make the post-Covid workplace as safe as possible. These new tools, designed to stop the virus from spreading, include intelligence security cameras, symptom-tracking apps, and thermal scanner technology to monitor body temperature.

What does the law say?

The laws that cover monitoring and surveillance include the Regulation of Investigatory Powers Act, the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations, General Data Protection Regulation (GDPR), and the Data Protection Act. However, these regulations also intersect with labor law, internet law, and the Human Rights Act.

Do these laws fully protect our privacy in the workplace? Not really, says Max Winthrop, head of employment law with Short, Richardson & Forth. “In the UK, we tend to work on a basis that the parties to an employment contract can do what they like, provided that it is not prohibited [by the law]. We don’t tend to have a general right to privacy at the workplace, but in some situations, your other rights will enable you to protect your privacy,” he said.

Points for both you and your employer to bear in mind:

Your employer has to give you prior notice

Monitoring employees’ phone calls and internet searches or checking their social media interactions can all be legitimate under the Lawful Business Practice regulation. “Normally, the interception of communication would not be legal. But an employer operating within their own business system can do it—as long as they comply with the requirements of the Lawful Business Practice regulation,” said Lilian Edwards, a professor at Newcastle University Law School and expert in internet law.

This means that your employer should inform you that you might be affected by workplace surveillance. Monitoring without giving notice is only permitted in very exceptional circumstances. An employer can do so if they suspect criminal activity is taking place, and if telling staff about the monitoring would put the investigation at risk. Moreover, this type of monitoring has to stop once the investigation is complete.

You’re entitled to a private life

Article 8 of the Human Rights Act protects your right to live your life privately and enjoy family life without government interference. It also means that your personal information should not be shared without your permission (except in extraordinary circumstances). “The initial problem with anything derived from the EU conventions [including the Human Rights Act] is that it is a right between a citizen and the State, and not necessarily between private individuals,” said Winthrop.

However, Article 8 stipulates that employers need to balance the right to privacy of employees with their interest to keep staff under observation. This is especially important in cases when employers might be tempted to read employees’ private emails or online messaging.

GDPR offers additional protection

What if your employer installed CCTV cameras in the toilet? “This is an old-school example,” said Professor Edwards. “Since it doesn’t involve the interception of communication, it doesn’t fall under Lawful Business Regulations. It is only regulated by the Data Protection Act. To be able to monitor you in such a way, the employer would need to prove that they are doing it for prevention of crime.”

“However, the Information Commissioner’s Office has issued guidance stating that one [a company] should never covertly monitor their employees with CCTV because it would not be proportionate.”

Moreover, if an employer is gathering data, they become a “data processor”, and principles apply such as the fact that the data must be stored securely and deleted after a certain period under GDPR. Any data must be gathered for legitimate purposes and cannot be used for any other reason than the one for which it is originally intended.

What can you do if your employer is spying on you or monitoring your online activity?

All surveillance that an employer carries out needs to be justifiable. What can you do if you believe your employer is violating your rights? This should be decided on a case-by-case basis. Maybe the situation will resolve if you confront your employer and see how they justify their actions? Understandably, this might not always be possible, so here are your other options:

If you’ve been fired, bring a claim for unfair dismissal

Let’s say your employer is reading your private emails. If the company is monitoring the number of sent emails only, without looking at their content, UK law probably allows for this. However, if they are reading employees’ private emails, this would be treated as a breach of privacy. “If the employee treats this as a breach of privacy, a breach of mutual trust and confidence between two different parties, this could be seen as a serious breach of contract,” said Winthrop.

In theory, this means that if you lose your job, you could bring a claim of unfair dismissal. However, this might be difficult to achieve in practice. Under UK law, there are important criteria that an employee needs to satisfy to be eligible to lodge an unfair dismissal claim. For example, you need to be an employee under a contract of employment for at least two years.

Winthrop has a word of warning. “Bringing a claim and winning a claim are two different things,” he said. “Not only you have lost your job, but you also need to start a legal proceeding, and that takes time. Also, the reparation for unfair dismissal is capped at 52 weeks gross salary. Many employees whose rights might have been breached might opt not to do anything for purely practical reasons.”

Contact the Information Commissioner’s Office

Depending on circumstances, another option is getting in touch with the Information Commissioner’s Office (ICO), an independent UK authority set up to “uphold information rights in the public interest”.

• “Under Section 42 of the Data Protection Act 1998, any person who is, or believes that they are, directly affected by the processing of personal data, can ask the Information Commissioner to consider whether the processing is likely to comply with the law,”* states the ICO on whistleblowing disclosures. On receiving such a request, the Commissioner is obliged to make an assessment.

However, this isn’t a simple procedure, says Winthrop. “Whistleblowing legislation is complex and requires public interest, so an argument against the employee might be that, even though their rights were infringed, there was no public interest involved,” he said.

Turn to the trade unions

If you’re a member of a trade union, they may well be able to help. “If you found out that you were covertly monitored and you could prove it, you have a good case to take to your union,” said Professor Edwards. “In that case, union representatives might do the talking with your employer.”

So far, Professor Edwards believes the topic of workplace surveillance hasn’t attracted anywhere near the attention that it deserves and there are still very few safeguards in place. “Traditionally, surveillance at work has been an issue for blue-collar workers such as Amazon or Uber employees or warehouse workers. Now it is going to become an issue for high-level workers, working from home in education or IT, or procurement. As middle-class jobs get more surveilled, this issue will get more attention,” she said.

This means that the surge in remote working could have an upside in terms of workplace surveillance. Despite exposing us to increased monitoring, it could finally put this important issue on lawmakers’ agendas.

Photo: Welcome to the Jungle

Follow Welcome to the Jungle on Facebook, LinkedIn, and Instagram, and subscribe to our newsletter to get our latest articles every day!