Employee monitoring and Covid-19

What are the implications of monitoring employee communications in the current crisis?

Many employers perform some kind of communication monitoring of their staff to help an employer keep track of employee performance and/ or in an effort to protect the organisation or its clients or customers.

In the current coronavirus situation, with an increase in staff working in isolation or from home, employers will need to reconsider how to best apply employee such monitoring policies and procedures. This article considers the main points employers should consider if they wish to put employee performance and communication monitoring in place and what adjustments may be needed if staff are working differently due to coronavirus.

Why use monitoring?

The reasons vary. For example, monitoring staff emails and internet usage may provide evidence of an individual's performance or productivity, or identify behaviour that will potentially damage the employer's reputation.

Monitoring communications may also help to identify possible legal liabilities. For example, by scanning emails or websites for key 'danger' words or phrases employers might identify instances of harassment and discrimination, defamation and the transmission of confidential information and trade secrets. There are also obvious security reasons to monitor communications to protect an employer against hacking and computer virus transmission.

What are the issues with monitoring employees?

Article 8 of the European Convention on Human Rights ('ECHR') enshrines an individual's right to respect for a private and family life, home and correspondence, but this right is not absolute. Case law in particular has explored the balance of the rights under Art 8 ECHR and the circumstances in which this right can be interfered with.

For example in the case of Lopez Ribalda and Others v Spain [2019], which considered covert video surveillance placed above staff at their workstation, the European Court of Human Rights outlined six key areas that need to be considered when assessing if such surveillance, and by extension any employee monitoring, is in breach of the employees' Art 8 rights:

• the degree to which prior notification of the possibility and the implementation of monitoring was given, as well as to its exact nature;

• the extent of the monitoring, meaning the degree of limitations in time and space as well as the number of people with access to the footage;

• the legitimate reason to justify the monitoring;

• the possibility of implementing less intrusive methods;

• the severity of consequences of the monitoring; and

• the provision of legal safeguards for the employees (i.e. in order for them to challenge the measures before an independent body).

This guidance needs to be read in line with national legislation. Under the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 (the 'IPR'), monitoring may be permitted providing it falls within specific categories (see below) and the staff who are, or may be, monitored are given clear and advanced notification of monitoring and its extent.

How does an employer set about monitoring legally?

The employer will need to have a clear structural approach to employee monitoring. The IPR sets out three main ways an employer can legitimately monitor its employee's communications.

1. Monitoring with consent. This requires consent of both the sender and recipient of the communication and is the reason for automated 'this call is being recorded' messages.
2. Monitoring without consent. This is subject to employers being able to show that the monitoring was needed to:

1. ascertain compliance with regulatory or self-regulatory practices or procedures that are relevant to the business;
2. ascertain or demonstrate standards that ought to be achieved by persons using the systems (i.e. internal quality control);
3. prevent or detect crime;
4. investigate or detect the unauthorised use of a telecommunications system; or
5. ensure effective operations of the system itself.

    3. Monitor without consent, but not record communications. This can only be done to either                   determine whether communications are relevant to the business, or if monitoring the                         communication is related to an employer considering the amount of use its staff have for                   remote support services e.g. anonymous counselling and helplines.

It is also worth noting that monitoring of electronic communications at work may amount to data processing, which will necessitate a data protection impact assessment to comply with data protection legislation. The ICO provides useful guidance on this issue.

What should employers have in place?

Employers should have an electronic communications policy in place, which will often cover internet use. Ideally, this should extend beyond the issue of monitoring and seek to set out standards. It should also cross-refer to other relevant policies and address the risks and hazards arising from inappropriate communications use and internet access, clearly setting out the level of monitoring being undertaken and the reasons why this is necessary.

The policy needs to be well publicised so that staff can easily access it and ideally it needs to be given to employees at the start of their employment or otherwise circulated to staff when the policy comes in to effect. Employers should make sure that employees have been asked to confirm that they have read the policy and accepted its terms. Best practice would be to send out regular reminders that the policy is in place and provide information to staff on any changes to the policy as they occur. In order to ensure fair treatment, employers should also follow up by checking that employees are complying with the terms of the policy.

In accordance with data protection obligations, employers should also have in place an appropriate privacy statement, which links employees to the relevant monitoring processes.

How does coronavirus impact on employee monitoring?

For those employers who already had employees on flexible working arrangements and who considered the impact of an electronic communications policy on home or remote working, the impact of the current situation will be limited.

However, employers should consider precisely how their staff are communicating with others when working from home and whether it is appropriate to be able to monitor these communications. For example, to what extent would an employer's monitoring impact on people living with the employee and is it appropriate to carry on with monitoring of certain communications if this effectively means monitoring the employee in their own home and on their own devices? There are important questions of scope and purpose in monitoring employees outside of their usual work environment and employers must consider what data transmitted or made available in the current circumstances is relevant to their identified legitimate aims.

The increased use of work systems and devices at home also raises important issues of digital security – not just for the employer but for the employee. For instance, given the potential exposure of added audio-visual data that could be transmitted on work related calls and video conferences, are employees' properly safeguarded against unauthorised or unwanted access from third parties?

Also, employers need to consider the extent to which they maintain performance monitoring in the current circumstances. For example, given the current situation is it appropriate to keep the same level of monitoring up? Can employers reasonably expect employees to maintain the same output of work from home as in the office or should less be expected of staff?

Conclusion

Employers need to consider whether their polices and procedures relating to data processing and security and employee monitoring have kept up with the real-world developments created by the impact of coronavirus and whether the technology that has been put in place to help organisations continue to work creates any additional issues or obligations.

In particular, where employers have had to scramble to adapt to the current situation, time should be taken to review where gaps may have developed in the employer's data protection policy coverage. Employers should also consider to what degree and on what basis employee monitoring has been put in place or is desired and whether sufficient policies and notification has been put in place to avoid breaching employee rights.