Navigating Workplace Monitoring: New ICO Guidelines

Navigating Workplace Monitoring: New ICO Guidelines

On October 3rd 2023, the Information Commissioner’s Office (ICO) released comprehensive guidance to assist employers in managing lawful monitoring in the workplace. Whether you employ traditional workers, freelancers, volunteers, remote staff, or even if you are part of the gig economy, these guidelines apply to you.

The ICO states that:

“The guidance aims to: help provide greater regulatory certainty; protect workers’ data protection rights; and help employers to build trust with workers, customers and service users.” ICO Guidance document

Understanding the Scope of the Guidance
The ICO’s guidance covers various monitoring scenarios within the workplace and beyond. It includes monitoring at work premises, homes, vehicles, and even streets. The scope encompasses monitoring during and outside working hours, including systematic and occasional monitoring. Various monitoring technologies, such as keystroke monitoring, internet activity tracking, audio recording, camera surveillance, telematics devices, body-worn cameras, wearable devices, and covert monitoring, are also addressed.

Key Considerations for Ethical Monitoring
Monitoring workers is a delicate process that should prioritise transparency, fairness, and respect for their privacy. To maintain ethical workplace monitoring, you need to consider the following key steps:

Document and Communicate: Ensure that the nature, extent, and purpose of monitoring are well-documented and communicated to workers transparently.An employee privacy notice is typically sufficient, but complex technologies may require additional explanations.

Purpose Clarity: Clearly define the purpose of monitoring and choose the least intrusive means to achieve it. This step is crucial in aligning your monitoring practices with legal requirements.

Lawful Basis: Confirm that the processing of workers’ data is lawful and that you’ve identified a lawful basis for processing, such as Health and Safety or preventing and detecting fraud, but only if there is genuine concern.

Relevance: Only retain information that is relevant to your monitoring purpose. Unnecessary data collection can lead to privacy concerns, legal issues and compensation claims.

Data Protection Impact Assessment (DPIA): In many cases, conducting a DPIA is recommended, even if not strictly required by law. This assessment demonstrates a commitment to assessing fairness and considering potential risks. You can download a DPIA template from the ICO here or contact us for a more user-friendly template.

Data Access: Make personal data obtained through monitoring available to workers upon request, in compliance with subject access requests.

Put yourself in your workers’ shoes. Consider what you consider excessive, and question whether other people would agree with you.

For example, it may be acceptable having tacking functionality and a dashcam in a works van but not having audio recording active as this may capture an employee having a private conversation about a medical issue. If the users is permitted to use the vehicle for private and business use there should be a way for the employee to be able to deactivate tracking in private use periods.

It’s not just a legal issue; it’s a PR one too. Think about all the bad press Amazon received due to their employee survey that returned results stating :

• Over 57% of responders say Amazon’s monitoring has had a negative impact in their mental health.
• Over 51% say Amazon’s monitoring system has a negative impact in their overall health.
• 59% of workers feel that Amazon’s monitoring is excessive.
  Source: https://uniglobalunion.org/news/globalsurvey23/

Workers’ Perspective on Monitoring
It’s essential to be aware of how workers perceive monitoring. In the UK, a recent survey conducted by the ICO revealed that one in five UK adults believes their employers have monitored them. The most common practices include tracking timekeeping and access, monitoring emails, files, calls, or messages. The survey found that 70% of respondents found workplace monitoring intrusive, emphasising the need for ethical and transparent monitoring practices.

Balancing Remote Work and Privacy
The rise of remote work has significantly altered the workplace monitoring landscape. Workers now have a higher expectation of privacy at home, which businesses must respect. This consideration is in line with Article 8 of the Human Rights Act 1998, which outlines the right to respect for a private and family life. As remote work grows, businesses must adapt their monitoring practices to protect privacy but at the same time maintain compliance.

Implications of Workplace Monitoring
Excessive monitoring can lead to higher staff turnover rates and employee resistance. Businesses need to be aware that monitoring can impact employee well-being and worsen power dynamics in the workplace. Transparency, fairness, and trust are critical to building a positive work environment.

The Role of Data Protection Authorities
Data protection authorities play a crucial role in ensuring that businesses adhere to ethical monitoring practices. The ICO emphasises the importance of transparency, fairness, and workers’ privacy rights. Organisations should take these guidelines seriously, as the ICO is prepared to take action if privacy is at risk.

We recommend prioritising ethical monitoring practices that respect workers’ privacy rights. This ensures compliance with data protection regulations and fosters a positive work environment where employees feel comfortable and respected. By following the ICO’s guidance and considering the ethical implications of monitoring, you can strike the right balance between productivity and privacy in the workplace.

If you need help creating this balance, please take advantage of your complimentary thirty-minute data protection consultation call. Book yours here.