Let’s start with some definitions.

Monitoring – to watch closely for purposes of control, surveillance, etc.; keep track of; check continually

Surveillance – the continuous observation of a place, person, group or ongoing activity in order to gather information

Let’s face it, we are all subject to some level of monitoring or surveillance in the workplace, even if we don’t use a computer or electronic device.

Whether you’re a software engineer, payroll analyst, checkout operator or care assistant there is a record of your activity in an audit log or performance report that is maintained to ensure your employer can see whether you are adhering to company policies.

Let’s confine ourselves to our digital footprint. Every time you log into a system a record is kept of the when and sometimes the where.

Surveillance is usually undertaken through overt CCTV, but it can also be through the ongoing review of someone’s online activity.

When you read your employer’s acceptable use policy it should tell you that this is happening, and the privacy notice should explain the purpose of it.

In most cases, this monitoring will be background activity and won’t be reviewed on a regular basis. The trigger for a review will be specific activity that contravenes the policy – such as visiting prohibited sites, removing anti-virus software or undertaking activity that constitutes unacceptable behaviour.

All reasonable uses of monitoring in the workplace?

Well, that depends…

Monitoring and surveillance should be proportionate to the risk involved. It also needs to be transparent in relation to the purposes for which it’s used, who has access to the data and how long it is kept for.

Recommended

• NHS to trial new ethical AI project
• M2M Cloud targets water monitoring device at EU markets
• Foreign Office cyberattack: What do we know so far?

So now that we have established that it’s OK to do this if it is proportionate, what does this mean from a privacy perspective?

When a monitoring activity is instituted the question to be asked is: “What is the risk that I am looking to mitigate?”

In 2019, the European Court of Human Rights ruled that employee privacy rights had not been infringed when the owners deployed covert CCTV to identify perpetrators of theft for which the owners had a reasonable suspicion gleaned from other sources.

However, in 2021 the Spanish Data Protection Authority (AEPD) fined a Supermarket €2.5m for using facial recognition software to detect customers with criminal convictions or restraining orders.

Due to the wide scope of the data collection and the small number of criminals identified compared to the total sample, this was deemed to be disproportionate.

These cases and others relating to the collection of personal data, such as the Office of the Australian Information Commissioner or the ICO’s actions against Clearview AI, highlight the need to balance the rights of the data subject against the rights of the organisation collecting the data.

Surveillance and monitoring can be privacy intrusive. So it’s important people know that it is going on, and more crucially, why.

If you are planning to introduce surveillance in your workplace there are a few things you need to consider:

• What is the risk I am trying to mitigate?
• Whose data am I capturing, and do I need to capture all of it?
• What am I going to do with the data that I capture?
• Who will have access to the data?

Data Protection Summit 2022 | Join the Conversation

Lesley Holmes will discuss the privacy considerations associated with workplace surveillance at the upcoming Data Protection Scotland Summit on 24^th March.

​The Summit will contextualise the latest developments within the data protection field, with insight from frontline practitioners reflecting on key trends, challenges and best practice.

The event will be hosted live and in-person at Dynamic Earth in Edinburgh.

Register your free place now at: https://www.dataprotection-summit.com/