Firstly, employers have a duty to be transparent about any monitoring. Except in very limited circumstances, they must explicitly tell workers if they’re being monitored, and what monitoring will occur, for example in their contract, a privacy notice or a staff handbook.
Such monitoring might include, for example, looking at websites workers have visited, listening to their phone calls, reading their emails, viewing CCTV footage of workers, carrying out bag searches, drug testing, and so on.
The main exception to transparency is where an employer suspects that an employee might be breaking the law, although monitoring in such circumstances should only be done as part of a specific investigation, and for a limited period of time. Plus an employer must still clarify in their policies the circumstances in which such covert monitoring might take place, and should complete a data protection impact assessment before commencing the covert monitoring.
Note that certain monitoring is prohibited regardless of whether employers tell their employees about it, for example monitoring employees in toilets. Moreover, where monitoring is permitted, certain limitations or caveats may also still apply. To give some examples:
- According to the Information Commissioner’s Office, any monitoring should be reasonable, necessary and proportionate, in light of the relevant circumstances;
- When searching an employee, the search should respect their privacy, be carried out by a member of the same sex, and take place in the presence of a witness; and
- Any information recorded should be kept secure and deleted when no longer needed.
Failure to adhere to the relevant rules on monitoring can constitute a breach of the Data Protection Act, as data protection law covers any monitoring that involves taking data, taking images or drug testing. Moreover, workers might have a claim for discrimination, assault or false imprisonment where a search or drug test is not handled correctly. I’m guessing monitoring could also lead to a breach of contract claim, if the contract explicitly states that the relevant monitoring would not take place.
