Following a call for views from stakeholders in 2021, the Information Commissioner’s Office (ICO) has launched a consultation on its new guidance on monitoring at work. This was published on 12 October 2022 and updates the ICO’s earlier guidance contained in the Employment Practices Code and Supplementary Guidance. The new guidance reflects:

This blog picks out five key takeaways from the new guidance, which is aimed at employers in the private, public and third sectors outside of law enforcement processing.

1. Carry out a data protection impact assessment

The concept of employee monitoring covers a wide range of checks – including monitoring emails, recording productivity (such as time spent on different programmes or keystroke monitoring), recording telephone calls, capturing images via CCTV, body worn devices to track location, dashcams, and hidden audio recording.

Organisations should remember that the fact a technology is on the market or being promoted by a vendor does not mean it is lawful. It is the employer, as controller, that is responsible for ensuring any monitoring technology it deploys is compliant with data protection law. Organisations should therefore be wary about relying on claims made by vendors around data protection compliance.

A data protection impact assessment (DPIA) is mandatory if the monitoring involves the processing of personal data which is likely to result in a high risk to individuals’ rights and freedoms (taking into account the nature, scope, context and purposes of the processing). The new guidance states that it is ‘good practice’ to carry out a DPIA even if it is not mandatory.

The ICO’s view is that if employers are planning to introduce monitoring, they should seek and document the views of workers or their representatives unless there is a good reason not to. Consultation can form part of the DPIA.

DPIAs are seen as one of the main ways controllers can demonstrate and justify why a particular processing decision was taken and document the approach taken to ensure compliance with data protection laws. Carrying out a DPIA requires employers to think critically about the basis for, and specific purpose of, the monitoring and is something which should be revisited to ensure there is no function creep over time.

2. Have a legal basis for processing personal data captured through monitoring

Employers must identify a lawful basis for monitoring workers.

There might be a specific legal obligation to conduct monitoring (for example transport sector employers monitoring drivers’ driving time to ensure compliance with the laws on drivers’ hours). Otherwise, the most likely legal basis for processing will be ‘legitimate interests’ (which might be to check productivity / attendance, for health and safety reasons or to allow access control, for example). While the guidance confirms that this is the most ‘flexible’ basis and that it can apply in a wide range of circumstances, it won’t apply if the same result can be reasonably achieved in a less intrusive way.

If an organisation is relying on ‘legitimate interests’, then the specific legitimate interest should be identified (and specified in a privacy notice). In other words, what is the purpose of the monitoring? Why is it necessary? What interest is being protected? What benefits is it likely to deliver?

The organisation will also need to carry out a legitimate interests assessment to weigh its legitimate interests against the potential intrusion and impact on data subjects. We discuss this in more detail in the next section.

If monitoring captures special category data (for example, health information, information about racial or ethnic origin, biometric data used for the purposes of identification, such as fingerprints), then a special category processing condition must be identified as well as a lawful basis (e.g., ‘processing is necessary in relation to the employer’s employment law rights or obligations or those of the individual’). This is the case even if the special category data is captured inadvertently, for example if device monitoring captured emails about health conditions or to union representatives.

The legal bases for processing special category data are much narrower and mean that organisations cannot rely solely on legitimate interests. While explicit consent is one option, it is unlikely that consent from a worker will be freely given and valid unless they genuinely have a free choice as to whether to agree to the processing.

3. Balance the employer’s interests v individuals’ rights

The ICO recognises that employers may have legitimate reasons for invoking employee monitoring but is also clear that employers must ensure their interests don’t negatively impact on the workforce’s rights and freedoms.

What are the privacy implications for workers? How intrusive is the planned monitoring? Is there a less intrusive way of achieving the aim? For example:

4. Be transparent

The guidance highlights the fact that workers have the right to be informed about the collection and use of their information. Workers must understand what monitoring is happening and what data is being processed.

How this is done will depend on what kind of monitoring is taking place.

In the changing rooms example above, being transparent means putting up clear signs to draw individuals’ attention to the fact CCTV is in operation. It would also mean ensuring that the worker privacy notice and relevant policies (e.g., Acceptable Use of IT policy, CCTV policy) had all the relevant information.

The privacy notice should contain details of the information that will be processed; the legal basis and purpose of the processing; access procedures, security and retention rules etc, while the policy would give workers detailed information about how the monitoring will be carried out.

5. Consider particular issues in relation to new technologies

Biometric data

Videoconferencing platforms

Don’t forget your other controller duties

As well as carrying out a DPIA and updating privacy notices, it is important to remember to update any other policies and documents that might be impacted by new monitoring activity. For example, organisations should ensure that they record an agreed retention period for personal data collected through monitoring in their organisational retention policy and update their record of processing activities.

More information

The consultation is open for responses until 11 January 2023.

Although the guidance is still in draft form, it is worth reviewing policies and privacy notices just now to identify any gaps which may have arisen because of changes in working practices or new technologies.

If you would like to discuss anything raised in this blog or the use of new monitoring technologies, please contact a member of the IP, Technology and Data or Employment and Immigration teams. Users of Workbox by Brodies, our award-winning HR and employment law site, will find useful FAQs and guidance at Data Protection: Employee Monitoring.