‘Business interests must never take priority over employee privacy’ – ICO warns firms over staff monitoring systems

Information Commissioner’s Office says working from home has heightened the risk of data protection breaches by employers

Credit: Gary Burchell/10'000 Hours, LueratSatichob/DigitalVision Vectors/Getty Images

The temptation to use tech to monitor employees working from home may be proving counter intuitive, the Information Commissioner’s Office (ICO) has warned. 

It noted workers’ expectations of privacy were likely to be higher at home than in the workplace and consequently the risks of capturing information about employees’ family and private lives were higher, thereby risking breaking data protection laws. 

Workers are reporting concerns over the rising popularity of monitoring tech following the pandemic and, in an ICO survey of 1,012 UK adults across the UK, seven in 10 (70 per cent) said they found monitoring in the workplace intrusive.

One in five (19 per cent) said they would feel comfortable taking a new job if they knew their employer would be monitoring them.

Emily Keaney, deputy commissioner for regulatory policy at the ICO, said: “Our research with Hibob shows that today’s workforce is concerned about monitoring, particularly with the rise of flexible working – nobody wants to feel like their privacy is at risk, especially in their own home.

“As the data protection regulator, we want to remind organisations that business interests must never be prioritised over the privacy of their workers. Transparency and fairness are key to building trust and it is crucial that organisations get this right from the start to create a positive environment where workers feel comfortable and respected.”

One in five (19 per cent) people believe they have been monitored by an employer. Of those who believe they have been monitored, monitoring timekeeping and access was the most common practice, observed reported by 40 per cent of those surveyed, followed by monitoring emails, files, calls or messages at 25 per cent.  

Taking screenshots or webcam footage was the least common practice, reported at 10 per cent. 

To lawfully collect and process information from monitoring workers, businesses must identify a lawful basis, the ICO said. There are six lawful bases for monitoring employees: consent, contract, legal obligations, vital interest, public task and legitimate interests. But it warned that “consent” could rarely exist because of the power imbalance between the two and pressure employees might feel. 

Firms therefore must be able to clearly justify why they are implementing monitoring tech and be transparent about this with workers. 

“We are urging all organisations to consider both their legal obligations and their workers’ rights before any monitoring is implemented,” Keaney added. “While data protection law does not prevent monitoring, our guidance is clear that it must be necessary and proportionate and respect the rights of workers. We will take action if we believe people’s privacy is being threatened.”    

The ICO concluded that monitoring employers in a way that is deemed “unfair” will hamper trust between the employer and employees. “Just because a form of monitoring is available, does not mean it is the best way to achieve your aims. You must be clear about your purpose and select the least intrusive means to achieve it,” it said.

Jess Lancashire, CEO of flexible working advisers From Another, said: “While employee monitoring tech may seem like an easy solution for managing remote and hybrid teams, it tends to breed distrust and disengagement when taken too far.

“Strict surveillance of employees' activities, like logging keyboard strokes or webcams, infringes upon personal boundaries and gives rise to a host of ethical concerns, particularly concerning privacy.

“When you try to keep a very close eye on flexible workers, it usually doesn't end well. A quick online search will show you how crafty employees can get to look busy even when they're not at their desks.

“Plus, too much monitoring tells your team that you don't trust them, which can kill morale. It's simple – when people feel trusted and appreciated, they tend to care more about their work.”

She said it would be better for managers to “invest in building strong relationships with their teams”.

“Our latest research (listening to 350 employees and line managers over 110 hours) underscores the growing importance of building trust, particularly as we shape more effective and flexible workplaces in the future,” Lancashire continued. “Our findings highlight that, in flexible workplaces where trust thrives, productivity soars, teamwork flourishes and overall satisfaction increases.”  

She said the “three essential pillars” to foster trust were “ability, intent and integrity”. 

“When employees consistently demonstrate strong ability, managers can trust they have the skills to excel without micro-management,” Lancashire explained. “When employees exhibit caring intent, managers can trust their commitment to the team. Empathetic leadership and open communication maintain engagement. 

“When employees act with integrity, managers can trust their character even from afar. Operating with transparency and aligning words with actions builds loyalty.”

Cathy Acratopulo, managing director of HR consultancy LACE Partners, said monitoring tech should only be used if employers can show that it is relevant to the business, makes sense to employees, is practical and is transparent. “Organisational culture is a big part of this,” she said. “If employee monitoring tech is positioned so that everyone understands the rationale as to why it’s needed and it doesn’t impact the perception of trust within your organisation, then that’s one thing.

“Why wouldn’t you record who’s clocking in and out, for instance, simply for health and safety reasons? That’s not draconian and has long been a part of many organisations, where everyone understands why it’s there. Using it to show that people are doing their mandated three days in the office is then just an extension of this.

“If it’s about tracking a digital experience that employees are having – for instance, their network is slow – then that’s understandable. If it’s because you don’t believe people are working as hard as they should be, this is a trust and line management issue. The message that’s being sent must be challenged.”