Workers at IKEA’s distribution centre in Peterborough may well be horrified to learn this week that their employer has just removed hidden surveillance cameras installed in the male and female toilets some six years ago.
At least those working from home can assume their employer won’t be following them into the bathroom. But now kitchens, living rooms and bedrooms are the new workspaces for many hybrid workers, what are their rights as employees to a private and family life? And how far can employers go to lawfully monitor the performance and conduct of staff when they are working from home?
There is no specific law in the UK which either sanctions or prohibits employee monitoring. However, employers have a legitimate interest in ensuring the smooth running of the company and this can be done by establishing mechanisms for checking that its employees are performing their professional duties adequately.
There are numerous ways employers can monitor staff who are working remotely on devices provided to them for work purposes. For example, by monitoring email content, internet usage, and the recording of telephone conversations with customers.
What information can be collected through employee monitoring?
Providing that the information is being collected and processed legally (see more below on the GDPR) then employee monitoring can be used for various reasons including:
- Tracking productivity and performance
- Ensuring security of confidential information
- Ensuring IT systems are not being misused
- Ensuring internet and social media are not being misused.
- Decisions relating to enhancing employee well-being. An example of this might be checking that staff are not working excessively outside normal office hours.
- Where the information gathered raises performance or misconduct issues the information may be used during capability or disciplinary procedures.
- This information may then be used in employment tribunal or court proceedings
- Despite its obvious uses to employers, employee monitoring appears to be widely disliked by most employees. A YouGov poll taken in September 2020 found that 48% of workers said monitoring software would damage their relationship with their line manager. This rose to 62% among younger workers.
Furthermore, under Article 8 of the European Convention on Human Rights (ECHR) an individual has the right to “his private and family life, his home and his correspondence”.
This is not an absolute right but a ‘qualified’ one. That means other interests of the community - such as the prevention of crime and disorder, and the rights and freedoms of others, can, in certain circumstances, override the individual’s privacy rights.
Article 8 is incorporated into UK law through the Human Rights Act 1998 (HRA). The HRA only applies directly to workers in the public sector but the courts and tribunals must take the HRA into account when making decisions. This means private sector employers must also take heed of their employee’s Article 8 privacy rights.
So far, the European Court of Human Rights has not handed down any judgments on the specific issue of whether it is lawful to monitor staff working at home. The decisions to date have largely examined the lawfulness of using information gathered through employee monitoring in disciplinary cases. (And the answer is that employers were acting lawfully in some cases and unlawfully in others).
The legality of employee monitoring is also a complex issue as it covers so many different areas of law and legal frameworks including:
- Employment Rights Act 1996 and the Equality Act 2010
- Investigatory Powers Act 2016
- Investigatory Powers (Interception by Businesses etc for Monitoring and Recordkeeping Purposes) Regulations 2018
- Information Commissioner’s Office (ICO) Employment Practices Code
- Data Protection Act 2018
- UK General Data Protection Regulations(GDPR)
It can be even more complex when employers are monitoring staff across different jurisdictions where different laws apply. For example, employers using monitoring software produced in the USA, where less stringent data protection rules apply, should take care they are not breaching the UK GDRP by deploying the software without further consideration.
Every time an employer monitors an employee they are collecting and processing their personal data, and sometimes their personal sensitive data.
Complying with privacy rights under the GDPR
Employers must:
- Establish a sound legal basis for the processing of the data.
- Let staff know which of their activities will or may be monitored (the ‘transparency’ principle).
- Only gather information that is strictly necessary and only use it for the purpose it was originally intended.
- Ensure the monitoring is proportionate. There needs to be a fair balance between the employer’s interest in monitoring and the protection of employee’s rights to privacy.
- Covert surveillance can only be used in exceptional circumstances, for the detection and prevention of serious crime, fraud, or other malpractice, and only then if there is no other less intrusive way of achieving that.
Claims that can be brought for breaches of privacy
Unfair dismissal claims
Where employees have been dismissed using evidence obtained through employee monitoring there may be a breach of the employee’s Article 8 rights impacting on the fairness of dismissal.
Over intrusive, unnecessary or disproportionate employee monitoring may also breach the implied term of mutual trust and confidence, enabling the employee to resign and claim constructive unfair dismissal.
Discrimination claims
Employees may argue they have been unlawfully discriminated under the Equality Act if they think they have been unfairly targeted by their employer’s monitoring for a reason connected with a protected characteristic.
Data protection claims
Employees may make a complaint to the ICO who has the power to fine businesses up to 4% of global annual turnover or £17,500,000 (whichever is higher) for breaches of data protection law. Businesses found in breach may be ‘named and shamed’ by the ICO. Employees may also bring claims for compensation for damage suffered for breaches of data protection legislation.
The way ahead?
We may see more tribunal cases featuring privacy rights emerge over the next 12 months as the hybrid and remote working model becomes a permanent feature for so many employers.
Employers who believe they need to monitor staff working from home will need to get to grips with many complex issues. But perhaps the first question should be, is so much monitoring really necessary? How much monitoring could be replaced by mutual trust, respect, collaboration and teamwork?
It remains to be seen if any of the staff at Ikea’s distribution centre will make a complaint to the ICO but the reputational damage has already been done.
If you would like further information on this complex topic, please contact our Employment team.