Working from home and cyber snooping

The COVID-19 pandemic has meant more of us than ever have been working from home. However, this is a new territory for many, and some employers have been left wondering how productive their staff are whilst working remotely. It may be that some employees are working efficiently and to full capacity, whilst others are not motivated enough or too distracted to do so.

In this regard, some employers have taken to using surveillance apps and programs to monitor productivity. Indeed, providers of such apps and software have reported an unprecedented growth in demand during the pandemic. If an employer wants to know when an employee has logged on, what they are looking at on their screen, if they are focused on the task in hand or spending too long on their coffee break – there is technology for it!

Webcams are being increasingly used in the wake of the ‘stay at home if you can’ requirements due to the sharp increase in virtual meetings. It is even possible to capture regular images of employees via their webcam on an automated basis – but this certainly raises employee privacy concerns and questions around whether it is legal for employers to engage in such activity.

Under Article 8 of the European Convention on Human Rights, everyone is entitled to respect for their private and family life and home. In a recent Workforce Monitoring Podcast by the CIPD, a study  found that 73% of workers believe that these technologies could damage trust between workers and employers and around 43% expressed concerns that its introduction would make it easier for their privacy to be violated.

Where employers do engage in a degree of surveillance, employees should normally be informed they’re being monitored in advance and that monitoring should be necessary, justified, proportionate and reflected in relevant policies and procedures. As far as covert surveillance was concerned, this should only be considered in exceptional circumstances where there’s a reasonable suspicion of criminal activity or equivalent malpractice on the part of an employee. Even then, the surveillance should not to go beyond what would be reasonably necessary to protect the business (i.e. it should constitute a proportionate response in the circumstances) and be strictly restricted to a specific investigation as well as time-limited. To get to this point, the employer would need to carry out a Data Protection Impact Assessment which would need to cover:

1. 1. 1. the purpose of the processing;
      2. a description of the envisaged processing operation(s);
      3. an assessment of the necessity and proportionality of the data processing activity;
      4. an assessment of the risks to the privacy rights of the individual(s) affected; and
      5. the measures envisaged to address the risks identified and demonstrate GDPR compliance.

However, people working remotely are starting to report that they feel their work / life balance is slipping away and that they are working longer hours, often out of a sense of obligation. There isn’t the structure you would find in the workplace, with many sitting at their desk for longer periods and not taking the breaks they normally would in the office environment. There is no commuting to / from the workplace and / or appointments. Rather, it can be back-to-back virtual meetings and a tendency to log on outside normal working hours. With this in mind, it may be more appropriate for employers to be monitoring the mental health of their employees and watching for digital burnout instead of slacking, skiving and shirking.