ICO Guidance Overview: Lawfully Monitoring Workers

On 3 October 2023, the Information Commissioner’s Office (ICO) released a guidance document titled "Employment practices and data protection − Monitoring workers". This guidance was published following a public consultation and aims to assist employers in complying with the UK General Data Protection Regulation and the Data Protection Act 2018.

The ICO explains that monitoring workers can include tracking their calls, messages, keystrokes, screenshots, webcam footage, audio recordings, or using specialist software to track their activity. The ICO acknowledges that employers may have legitimate reasons to monitor their workers, such as ensuring productivity, quality, security, or compliance. However, the ICO also warns that monitoring can have negative impacts on workers’ privacy, dignity, trust, and morale.

The guidance is part of the ICO’s wider work on data protection and employment practices, which also includes guidance on processing workers’ health data and a draft strategic plan for consultation. The ICO will continue to engage with stakeholders and update its guidance as needed.

Key takeaways

• With the rise in remote working and advancements in technology, employers are increasingly looking to monitor their workers. The ICO advises organisations to consider both their legal obligations and their workers’ rights before implementing any workplace monitoring.
• Employers should have a clearly defined purpose for monitoring and use the least intrusive means to achieve it.
• Employers should have a lawful basis for processing workers’ personal data and carry out a Data Protection Impact Assessment for any monitoring that is likely to result in a high risk to workers’ rights and freedoms, such as covert, continuous, or extensive monitoring.
• Employers must inform workers about any monitoring in an easily understandable manner and only retain information relevant to the purpose of monitoring.
• Employers should only keep information relevant to the purpose of monitoring and delete or anonymise it as soon as possible. They should also ensure that the information is accurate, secure, and confidential.
• Employers should respect workers’ rights under the UK GDPR and DPA 2018, such as the right to access, rectify, erase, or object to their personal data. They should also provide workers with effective ways to raise concerns or complaints about monitoring.
• The ICO’s research shows that almost one in five people surveyed believe that they have been monitored by an employer, and that most people would find monitoring in the workplace intrusive and uncomfortable. The ICO urges employers to consider the impact of monitoring on their workers and to adopt a transparent and proportionate approach.

Our views

The ICO’s guidance is a timely and important resource for employers navigating the complexities of worker monitoring in the digital age. It underscores the need for a balanced approach that respects workers’ rights while allowing employers to leverage technology for legitimate purposes.

However, the ICO’s research revealing that 70% of people would find workplace monitoring intrusive and only 19% would feel comfortable taking a new job if they knew they would be monitored, highlights the need for transparency and dialogue between employers and workers. It’s crucial that employers clearly communicate the nature, extent, and reasons for any monitoring, and use the least intrusive means to achieve their objectives.

Although technology provides new opportunities for monitoring in the workplace, it’s essential that this is done in a way that respects workers’ rights and complies with data protection regulations.