What does the new draft employee monitoring guidance mean for employers?

The Information Commissioner’s Office (ICO) has recently released new draft guidance for employers on monitoring employees. The latest guidance will replace the relevant sections in the current Employment Practices Data Protection Code and is intended to better reflect data protection obligations under the UK GDPR and Data Protection Act 2018, as well as developments in technology and working practices. The draft guidance is open for consultation until 11 January 2023. In this article we highlight some of the main points employers should be aware of, and outline best practice for employee monitoring.

Transparency

The new ICO guidance emphasises the importance of informing your workers of when and how you will monitor them. All workers should be provided with a privacy notice which sets out in clear terms the type of data which will be processed and your specific purposes for processing it. This notice should be kept under review and workers supplied with an updated privacy notice whenever you implement substantial changes to your monitoring.

Covert monitoring will not normally be justified and you are required to complete a Data Protection Impact Assessment (DPIA) before engaging in any covert monitoring.

With the increase in remote working some employers may be considering introducing new forms of monitoring such as:

• Keystroke recording;
• Video and audio recording on workers’ devices; and
• Email monitoring.

Employers should be aware however, that workers are likely to have an increased expectation of privacy when working from home. There is also an increased risk of capturing information about their family and private life. It is therefore more important than ever that employers make it clear to employees when they may be monitored or recorded.

Proportionality

Another important factor to consider under the Guidance is proportionality. After you have identified a legitimate purpose for the monitoring you must evaluate whether your methods are the least intrusive. For example, video monitoring may be necessary to protect your business from theft or vandalism, but audio recording may go further than is necessary for these purposes and so would not be proportionate.

When considering proportionality you should take into account the increased risk of recording family and private life when a worker is working from home. You will need to balance the interests of your business with the level of intrusion on the workers’ privacy. A DPIA can help you do this and may also help you identify less intrusive methods of monitoring.

Biometric data

The new draft guidance also features a section on processing biometric data, something the older Employment Practices Code did not touch on. According to the UK GDPR, biometric data is data “relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person.” This may include:

• Fingerprints;
• Facial recognition;
• Voice recognition.

When used for identification purposes, biometric data will constitute special category data, and so you will need to identify both a lawful basis and a special category condition to lawfully process such data.

If you want to rely on consent to process biometric data, the consent would need to be “freely given,” which may be difficult to achieve considering the imbalance of power in an employee/employer relationship. The guidance therefore advises offering employees an alternative to the biometric data processing which would not place those employees who do not consent at a detriment. You must also carry out a DPIA whenever processing biometric data which will be used to identify an individual.

If you are considering implementing new monitoring measures at your workplace, or have questions about your data protection obligations to employees, we can advise. We can also help you draft an employee data protection policy and privacy notice so that your employees understand how you will process their data. Make an enquiry with one of our employment solicitors today by calling 023 8071 7717 or emailing employment@warnergoodman.co.uk.