Helping Employers Leverage Monitoring
While Staying Compliant With A Dynamic Legal Landscape
As a consequence of changes in technology and work as a whole, including the increasing adoption of hybrid and remote work, such as “work from home (WFH),” employers are increasingly implementing employee monitoring of varying forms. While employers have reasonable justifications for wanting to ensure the accountability and productivity of employees, employee privacy and related laws are increasingly putting guardrails in place on the types of employee monitoring allowed and the compliance obligations that come into effect when undertaking such monitoring. After all, employee monitoring can be highly invasive, especially when proper notice is not given to employees and is conducted in secret. Therefore, whether it is in the context of the European Union’s General Data Protection Regulation (GDPR), the respective version of the law in the UK, or the increasing number of states in the United States passing comprehensive privacy laws such as California’s Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), lawmakers are instituting regulatory frameworks that must be followed concerning employee monitoring. There are also employee monitoring-specific laws, such as New York’s law (Section 52-C), which requires, among other things, employers to provide employees with notice of electronic monitoring. Furthermore, privacy regulators have emphasized that addressing this area will be a top priority.
Historically, employee monitoring has been a uniquely sensitive area of the law, particularly in light of the power imbalance between employers and employees. For this reason, in the context of EU and UK law, consent is generally not the appropriate legal basis for undertaking data processing that occurs as part of the employer-employee relationship, particularly when it comes to employee monitoring. Even beyond the nuances of consent and the appropriate legal bases for processing, by the very nature of the activity, monitoring an employee, especially the occasional type aimed at a particular individual based on suspected wrongdoing, notice, and consent, can sometimes defeat the purpose of the monitoring. In contrast, the analysis and legal considerations shift for systematic and broad-ranging types of employee monitoring aimed at employees across the company. As a general matter, due to consent not being generally appropriate as a legal basis, employers must justify monitoring as a “legitimate interest” and ensure it is (a) necessary, (b) legitimate, and (c) proportionate to the perceived threat.
Another nuanced scenario in the context of employee monitoring concerns the potential of data processing that may include a variety of categories of personal information deemed “sensitive.” While each law has its own definitions for what is deemed “sensitive category data,” generally, various types of biometrics and health information, as well as other data types, fall into this more protective category. There are specific compliance considerations and obligations that accompany the handling of such sensitive data. Given the numerous considerations surrounding employee monitoring and the evolving regulatory landscape, ensuring compliance is a critical aspect of decision-making.
As artificial intelligence becomes increasingly present in our lives and its applications for employee monitoring continue to grow, there is a renewed focus on the legal and compliance obligations that arise in certain scenarios. The FTC has signaled its intention to regulate this space, including in the employee context, and other regulators, such as the CFPB, are paying attention to it.
At RICHT, we help clients capitalize on the value and necessity of employee monitoring in various scenarios, while also accounting for compliance and associated legal risks. From ensuring robust legitimate interest analysis and documentation to notices aimed at transparency, as well as data mapping and data privacy impact assessments (DPIAs) of monitoring activities, we take a holistic approach aimed at avoiding negative consequences beyond just the legal enforcement realm in the form of fines, to include bad press or friction with employees.
Employee Monitoring Legal Services We Offer
Legitimate Interest Analysis
Data Loss Prevention (DLP)
Vendor Risk Review