New ICO guidance published on employee monitoring

Background

The new guidance comes in response to the evolving landscape of remote work and technological advancements which have prompted employers to increasingly explore various forms of worker monitoring. With the aim of ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the ICO's guidance seeks to strike a balance between employers' legitimate interests and employees' fundamental rights.

The ICO's decision to publish this guidance follows a public consultation and research which provides insights into workers' perceptions of monitoring practices. The research reveals that nearly one in five respondents believe they have been monitored by their employers. In addition, 70% of respondents find workplace monitoring intrusive, and only 19% would feel comfortable accepting a job offer if they knew their employer intended to monitor them.

Forms of workplace monitoring

Workplace monitoring can include:

• tracking calls
• messages
• keystrokes
• taking screenshots
• capturing webcam footage
• recording audio
• utilising specialised monitoring software to track employee activities

These practices can vary in intrusiveness and impact on an individual's privacy, making it crucial for employers to carefully consider (and communicate clearly) their approach.

Key guidelines for employers

To ensure compliance with data protection regulations and respect for employees' rights, the ICO's guidance explains that organisations must take the following steps when monitoring workers:

• Employers must make workers aware of the nature, extent, and reasons for monitoring. Communication should be clear and straightforward.
• Employers must have a clearly defined purpose for monitoring and should use the least intrusive means necessary to achieve that purpose.
• Employers must establish a lawful basis for processing workers' personal data, ensuring that their actions comply with legal requirements.
• Employers should inform workers about any monitoring activities in a manner that is easy to understand, ensuring that employees are aware of what to expect.
• Organisations should only collect and retain information that is directly relevant to the stated monitoring purpose, preventing the unnecessary accumulation of data.
• For monitoring activities that pose a high risk to workers' rights, employers must conduct a Data Protection Impact Assessment to identify and mitigate potential risks.

Learning points

This guidance underscores the need for organisations to carefully consider their legal obligations and the rights of their workers in the context of workplace monitoring.

For more information or advice on the new guidance on employee monitoring, please contact Mark Stevens in our Employment team on 0117 314 5401, or complete the form below.