With thanks to Stacie Cheadle, technical writer, Croner-i
Remote working – Employee monitoring is becoming more important, but there are limits.
Remote working away from the employer’s premises, often at home, is now relatively common in the UK. It has numerous benefits including giving employees the flexibility to work around their personal commitments and access to work for employers located geographically far away.
However, remote working does lead to questions over how these employees can be effectively monitored.
One of the most significant issues is data protection. In the UK, data protection is governed by the Data Protection Act 1998 and the UK General Data Protection Regulation (GDPR).
As monitoring involves the processing of personal data (information which identifies the individual), these rules apply. It’s important therefore that an employer is aware of them, especially as failure to comply with data protection rules can lead to a maximum penalty of £17.5m or 4% of total annual worldwide turnover.
Data protection rules apply to any monitoring of employees and covers systematic and occasional monitoring. Examples include monitoring timekeeping or access control, keystroke monitoring to track, capture and log keyboard activity and productivity tools which log how employees spend their time and CCTV, although there are others.
The personal data gathered during monitoring must be processed lawfully, fairly and transparently and it must be dealt with in a way that is sensitive to the employee’s position.
Privacy expectations of employees working from home are likely to be higher than for those in the office, and this should be considered. The proportionality of monitoring therefore needs to be assessed, and a Data Protection Impact Assessment (DPIA) must be carried out before undertaking any monitoring, so that measures can be put in place to reduce or remove any negative impacts and to provide support for the organisation’s rational for monitoring.
An employer must be transparent about the fact monitoring is taking place. Employees have the right to be told what data is being collected by their employer, how it’s being used, who in the organisation (or externally if applicable) access to it and how it can be challenged.
An employee monitoring policy and a privacy notice are ideal ways to do this. Unless there is a very good reason for not doing so, such as suspected criminal activity, monitoring should always be discussed with employees first and their consent must be documented.
All reasonable steps must be taken to ensure data collected is accurate, and if it’s not it should be remedied quickly. Data must be kept securely, and for only as long as it is needed. Employees also have the right to request data held on them, and to ask for that data to be erased.
Aside from the data protection issues, your client will also need to consider the impact monitoring of remote workers can have on the employment relationship.
Done excessively or inappropriately, it can breach the implied term of trust and confidence, leading to the breakdown of the relationship, reduced retention and potentially even constructive unfair dismissal for those employees with over two years’ service.
