Data Protection, Monitoring & Covert Monitoring

In an age where it is largely recognised that employers have the ability to and may carry out checks on the quality of and quantity of their employees work, as well as monitoring to protect health, welfare and safety, when does this become excessive and is covert monitoring justifiable.

To comply with data protection law any monitoring must be done in away that is lawful and fair to workers.  Excessive monitoring can adversely affect data protection rights and the freedoms of workers. Monitoring should not intrude into a workers’ private live or impinge on their privacy. 

It is often accepted that monitoring will take place in the workplace, but lines are blurred when the workplace is home, as is the case of a homeworker or when a worker uses personal devices for work.

Data protection law does not prevent an employer monitoring a worker’s activity but to be compliant with data protection requirements, the employer must be clear about the purpose and chose the least intrusive means.

In usual circumstances an employer is unlikely to be able to justify covert monitoring.  Covert monitoring means carrying out monitoring in way which is designed to ensure the worker is unaware they are being monitored.

There may be exceptional circumstances when covert monitoring may be acceptable, for example, to prevent a criminal activity.   If employers are considering such monitoring the Information Commissioner’s Office (ICO) guidance outlines that a Data Protection Impact Assessment (DPIA) must first be carried out.  The monitoring should be targeted, not overly used and not used in areas where workers would expect privacy.  Whilst many employers may recognise such areas as changing facilities or toilets this guidance extends to covertly capturing communications which would ordinarily be private such as a personal email.

If an employer has been able to establish a legal basis to carry out covert monitoring the information gathered should only be used for the purpose intended and any other information destroyed.  The ICO guidance provides for any covert monitoring to be carried out under a contract with an investigator who is legally complaint in the provision of collecting such data.

 An employer should also remember that if it was to receive a data subject access request it may have to disclose the personal information obtained.  When deciding whether to use covert monitoring the employer must balance the interests of the business and worker and importantly be able to justify the decision to proceed.

If you would like assistance with a data protection policy or managing a sensitive situation please get in touch on 01473 276170 or email us at soshr@sos-hr.co.uk