As part of its latest guidance on employment practices and data protection, the Information Commissioner’s Office (ICO) has released new draft guidance concerning employee monitoring. Partner David Edwards from Harrison Drury’s regulatory team, and trainee solicitor Hannah Pinder from our employment law team, highlight and explain key areas of the proposed new guidance.

Once finalised, the draft guidance will replace the current employee monitoring guidance contained in the ICO’s Employment Practices Protection Code, which was published in 2011. The draft guidance is open for public consultation until January 11, 2023.

The draft new guidance

Given the previous guidance was published over a decade ago, certain technologies and working practices of today were non-existent back then, meaning it was in desperate need of reform.

The new guidance has been prepared to reflect the current legal framework of the UK GDPR and the Data Protection Act 2018, along with the innovations in working practices and new technologies that have arisen over the years, particularly with regards to the shift to remote working during the Covid-19 pandemic.

What is ‘monitoring at work’?

The ICO acknowledges monitoring at work as the use of various workplace surveillance methods to gather information on the activities and location of staff using the following:

The purpose of monitoring at work includes reviewing the quality and quantity of a worker’s output, protecting the health and safety of workers, including their wellbeing, meeting regulatory obligations and forming part of a short-term response to a specific need i.e. installing surveillance to monitor for a suspected theft.

The position under UK law on monitoring at work

Although employee monitoring is permitted under UK law, employers should note it is regulated under data protection, human rights and equality laws. When conducting employee monitoring, employers must ensure they balance the level of intrusion against their needs, those of their workers and members of the public.

Employers should always consider the right to respect for a private and family life enshrined in Article 8 of the Human Rights Act 1998, particularly with regard to homeworking.

To lawfully collect and process information from monitoring workers, an employer must identify a specific lawful basis. There are six to choose from under Article 6 of UK GDPR:

The guidance confirms that employers are unlikely to be able to rely upon ‘consent’ as a lawful basis for processing employee personal data, due the imbalance of power between employer and employee. The guidance states that consent is “only appropriate in circumstances where workers have a genuine choice and control over the monitoring”.

The guidance also suggests a lawful basis in ‘contract’ will only arise in scenarios where the monitoring is genuinely necessary for performance of the contract between employer and employee.

‘Legitimate interests’ is the most flexible Article 6 condition upon which employers can rely when monitoring employees. As identified above, when considering whether employee monitoring is justified as a legitimate interest, employers must balance their own interests against the privacy rights and expectations of employees.

Key points from the new guidance

Noteworthy points arising from the new guidance include:

Example: an employer monitors the emails of an employee to gauge the employee’s client-handling performance. During the email monitoring, information concerning the health of the employee is also processed. The purpose of the email monitoring was not to process health data, but the employee’s health data was nonetheless processed by the employer. Therefore, an Article 9 special category condition will be required, in addition to one of the lawful bases for processing personal data under Article 6, to lawfully conduct the email monitoring.

Example: an employer prohibits employees from making personal phone calls at work. However, the policy is not enforced, and employees often make personal phone calls at work. Accordingly, the employer is not lawfully able to justify monitoring employees for the purpose of enforcing such a policy.

Next steps for employers

It is important that employers take a proportionate and balanced approach to employee monitoring, and employers who intend to monitor their employees should have appropriate policies and other documentation in place before doing so. There is no need to update data protection policies as of yet, however the monitoring sections should be reviewed to identify areas which could be improved in light of the draft guidance.

Employers can respond to the consultation and the ICO welcomes feedback on the specific questions contained in the monitoring at work survey and draft impact assessment survey. Any responses should be submitted by 5pm on 11 January 2023.

If you operate a business and would like further information regarding employee monitoring, please contact Harrison Drury’s employment law and regulatory teams on 01772 258 321 or at enquiries@harrison-drury.com.