Privacy in the Workplace – INSIGHT

Monitoring in the workplace is commonplace, with employers frequently monitoring staff email and internet usage, telephone calls and use of company devices. Many employers will also have surveillance cameras (such as CCTV) in place for security reasons or other purposes. Employers must ensure they comply with the applicable restrictions and requirements to protect their employees’ privacy.

Businesses should be familiar with the data protection laws which apply in the UK, including the Data Protection Act 2018 (which implements the General Data Protection Regulation (which came into force in the UK on 25th May 2018)), Freedom of Information Act 2000 and the Protection of Freedoms Act 2012, as well as the Information Commissioner’s Office Code of Practice for use of surveillance cameras (“the Code”). The Code makes clear that any response to Subject Access Requests (‘SAR’) or Freedom of Information requests must include surveillance footage. Meaning that footage needs to be accessible and kept for an appropriate period.

Recent judgments from the European Court of Human Rights (“ECtHR”) have confirmed that employees have the right to a private life whilst at work, under Article 8 of the European Convention on Human Rights (“ECHR”). Article 8(2) ECHR allows this right to be interfered with only if the interference is legal and necessary, i.e. if it has a legitimate aim, and the ECtHR has repeatedly shown that a fair balance must be found between the
employer’s and employee’s interests.

In Barbulescu v Romania 2017, the ECtHR ruled that there had not been sufficient warning given by the employer that Mr Barbulescu’s personal instant messenger conversations on company computers would be monitored, or to what extent. The company’s policy of expressly prohibiting all personal use of company computers was not
sufficient to warn Mr Barbulescu that communications he did make about his private life would be accessible and monitored. The ECtHR said such monitoring was not permitted as employees have a reasonable expectation of privacy in all areas of the workplace. The ECtHR went further and confirmed that this right to privacy cannot be entirely removed by an employer’s monitoring policies.

In acknowledging that employers need to be able to run their businesses effectively, which may necessarily involve monitoring employees, the ECtHR confirmed a case-by-case balancing exercise is required to ensure any monitoring policies are “accompanied by adequate and sufficient safeguards against abuse” considering that “proportionality and procedural guarantees against arbitrariness are essential”. It set out guidance for domestic
courts and employers to consider and assist them in avoiding breaching an employee’s right to privacy:

(i) advance, clear notification to be provided to employees of any monitoring measures, together with methods of implementation;
(ii) details of the extent of monitoring procedures and the degree of intrusion into employees’ privacy, including whether the content of communications are being monitored and any time limitations;
(iii) the employer’s reasons for the monitoring which must be legitimate and justify the aims – noting that the more invasive the monitoring, the weightier the justification will need to be;
(iv) whether alternative, less intrusive, monitoring measures are possible;
(v) what the consequences of the monitoring are (for the employee subjected to it) and whether the actual use of the resulting data meets with the previously communicated aim;
(vi) does the employee have adequate safeguards against particularly intrusive monitoring which has not been previously notified.

With regard to the use of surveillance cameras to monitor employees, the ECtHR ruled in Antovic and anor v Montenegro 2017 that whilst the University of Montenegro lecturers were informed that video surveillance would be introduced, the stated purpose given by the University was not a legitimate aim. The University’s stated reasons for introducing video surveillance included safety of property and people, and the surveillance of teaching. In Kopke v Germany, however, the ECtHR found that, preventing criminal activity may be a legitimate aim for covert surveillance by an employer.

In applying Barbulescu and Kopke in Antovic, the ECtHR said that the video surveillance of the lecturers amounted to a significant interference with their private social life because they could not avoid being recorded due to their contractual obligation to perform their duties where the surveillance was being carried out. This therefore required a legal and legitimate aim for the surveillance (under Article 8(2) ECHR), which could not be found. Monitoring teaching was held not to be a legitimate aim. Further, there was no evidence of risk to safety of property or people in the filmed areas and alternative monitoring methods had not been considered by the University.

In Lopez Ribalda and ors v Spain 2018, the ECtHR distinguished the covert use of surveillance cameras from the Kopke scenario on the basis that the latter case was targeted on specific employees suspected of theft and the surveillance was for a time-limited period (two weeks). Whilst Kopke shows that preventing criminal activity can be a legitimate aim for covert surveillance, the ECtHR ruled in Lopez that by filming all cashier staff throughout the entire working day without any limit on duration was disproportionate and did not strike a balance between the employees’ Article 8 rights and the employer’s interests. The level of intrusion into the employees’ private social life was considerable because (as in Antovic) they could not avoid being filmed. Further, the fact that covert
surveillance amounted to a breach of Spanish data protection law and guidance, and alternative surveillance methods were not considered, meant that it was not a justified monitoring method.

It is clear that employers need to consider their surveillance operations carefully. Whilst it can be temping (and often more convenient) to monitor continuously, this will almost certainly not be appropriate. Consider the need to operate cctv, the aim behind the monitoring and whether that need justifies the intrusion into the privacy of those working in the area. Importantly consider whether that stated aim can be achieved in a less intrusive manner. Employees will be more aware of their rights than ever following the implementation of the GDPR and employers are likely to see an increase in requests for personal data as a result, particularly from employees who are exiting on less than favourable terms