Re:Bosses panic-buy spy software to keep tabs on remote workers
by Silhouette on Monday March 30, 2020 @12:36PM
(#22729484)
The mere fact that the employee is at work or using work resources has been found on several occasions to be insufficient justification for serious privacy infringements. These days it would come under GDPR or, in some member states, their national privacy laws where those are stronger.
As a rule of thumb, an employer can take reasonable steps to protect themselves as far as monitoring is concerned, often with the requirement that the subjects of the surveillance have been told in advance that it might happen. But there is always an implied requirement of necessity and proportionality in the background. Monitoring a specific employee where there is evidence to suggest they are leaking trade secrets is one thing. Routine monitoring of everyone's computers where you end up, say, recording the login details they used to access online banking and check whether their expenses have been paid yet is something very different.
You can also check the guidance from the various national data protection agencies, such as the ICO's publication "The employment practices code", which address this issue in quite a lot of detail.
As a rule of thumb, an employer can take reasonable steps to protect themselves as far as monitoring is concerned, often with the requirement that the subjects of the surveillance have been told in advance that it might happen. But there is always an implied requirement of necessity and proportionality in the background. Monitoring a specific employee where there is evidence to suggest they are leaking trade secrets is one thing. Routine monitoring of everyone's computers where you end up, say, recording the login details they used to access online banking and check whether their expenses have been paid yet is something very different.
Edit: Some easy-to-read sources:
https://www.peoplemanagement.co.uk/experts/legal/gdpr-implic...
https://gdpr.report/news/2017/11/17/5383/
You can also check the guidance from the various national data protection agencies, such as the ICO's publication "The employment practices code", which address this issue in quite a lot of detail.