Staff security: employer responsibilities
Staff monitoring: reasons and methods
What workplace monitoring is, why monitor staff, and the methods you can use for surveillance.
What is employee monitoring?
Employee monitoring or staff monitoring is the use of various workplace surveillance methods to gather information on the activities and location of your staff. There may be a number of reasons why employers may choose to monitor employees such as safeguarding staff, protecting resources, or improving productivity.
Why monitor staff?
You might want to monitor your staff to:
- check the quality of customer service
- find out if staff require training by observing their performance
- review staff skills and competencies used in their job
- ensure the safety of all workers
- observe the application of health and safety rules
- ensure compliance with the law or an internal employment policy, eg on email and internet usage
- confirm any fraudulent, criminal, or otherwise illegal or undesirable conduct by your staff that you suspect
- check whether your workers are entitled - or continue to be entitled - to work in the UK and undertake the work in question - see ensure your workers are eligible to work in the UK
Employee monitoring methods
Employee monitoring can include:
- recording staff activities by CCTV cameras
- keeping recordings of telephone calls, eg in a call centre
- opening staff emails or listening to voicemails
- checking logs of telephone numbers called
- examining logs of websites visited
- searching staff, their personal space and work areas
- installing tracking equipment in vehicles
- making and storing copies of documents that include personal information and those that demonstrate that the worker is - or continues to be - entitled to work in the UK and undertake the work in question - see ensure your workers are eligible to work in the UK
- checking internal and external candidate CVs and application forms during the recruitment and selection processes
Employee monitoring: the legal requirements
The law recognises several reasons why an employer might want to monitor staff and sets out principles for carrying out such monitoring. The principle of purpose limitation is very important to ensure privacy. The results of any employee monitoring must be used solely for the purpose for which they are obtained. To ensure any employee monitoring you carry out is lawful and proper see monitor staff correctly and lawfully.
See the General Data Protection Regulation (GDPR) and the Information Commissioner's Office (ICO) guidance on the Data Protection Act.
HelpAlso on this siteContent category
Source URL
/content/staff-monitoring-reasons-and-methods
Links
Staff monitoring: deciding if it is justified
Using an impact assessment to determine if staff monitoring is justified and ensuring that you meet legal requirements on privacy.
If you monitor your staff, you must ensure that it is both appropriate and proportionate. You must ensure, as an employer, that you balance your need for information in order to protect your business with respect for your employees' privacy.
If used in inappropriate ways or in the wrong situations, monitoring can have an adverse impact on your staff. It can intrude into their private lives, disrupt work or erode the trust and confidence that has been built between you and your employees.
Staff monitoring: impact assessment
To decide whether your employee monitoring is justified, you should undertake an impact assessment.
Purpose
Clearly identifies the purpose(s) behind monitoring and the benefits of monitoring over any alternatives.
Benefits
Assesses the benefits of monitoring against any adverse impact on staff, eg intrusion into workers' private lives or the oppressive effect of monitoring.
Confidential information
Identifies whether confidential information will become known to others in the workforce as a result.
Is it fair?
Consider how to be fair to workers when employing workplace monitoring.
Intrusion
Recognises how any intrusion is kept to a minimum.
Reasoning for any potential intrusions
Ensures that significant intrusion into workers' private lives will be justified.
Consult workers
Assesses the results of consultation with the workers and/or their representatives.
Monitoring obligations
Considers the obligations that arise from monitoring, such as setting up new processes to ensure records are secure.
Legal compliance
Considers how to ensure compliance with the law.
Employees' rights on workplace monitoring
Your workers have the right to access any personal information on them that you collect via workplace monitoring. Therefore, your monitoring systems must be capable of meeting this need and other data protection requirements.
If following your impact assessment you decide that you can justify monitoring of your employees, you must ensure you carry it out within the limits of the law. See monitor staff correctly and lawfully.
HelpAlso on this siteContent category
Source URL
/content/staff-monitoring-deciding-if-it-justified
Links
Set up staff monitoring policies
Writing staff monitoring policies, particularly on the use of computers phones, and business vehicles.
You should have a workplace policy in place that covers employee monitoring. Your staff monitoring policy should outline your reasons for using staff monitoring practices and the business benefits that this brings. Explain the monitoring arrangements that are in place in the workplace and how data collected from monitoring will be used and stored.
When putting together any kind of staff monitoring policy, you also need to set out the rules and standards expected. For example, if you need to have CCTV surveillance overseeing till areas in shops to ensure the safety of checkout staff, you should:
- inform staff why you are using CCTV monitoring
- inform them of the nature and extent of the monitoring
- remind them what might happen if the monitoring reveals breaches of your disciplinary rules
You should consider consulting your workers and/or their representatives, such as trade unions, when drafting a policy.
See how to set up employment policies for your business.
Policies on monitoring the use of electronic communications
A workplace policy on electronic communications should cover the use of email, internet access and web usage, social media, telephone, mobile phone, and fax.
The policy should:
- set out the standards expected for business use
- state what personal use is allowed and when - eg outside normal working hours
- cover confidentiality of communications and the purpose and methods of monitoring the use of equipment
You may wish to instruct staff to mark personal emails as private or personal in the title so that you can try to avoid opening them during monitoring procedures. Download social media, email, and internet use section of the Invest NI Employers' Handbook (PDF, 61K).
You may also find it useful to give guidance on the potential legal risks and liabilities/security problems that misuse may create, such as the:
- appropriate content and style for emails
- importing of viruses
- use of inappropriate websites
- use of disclaimers
Staff should receive appropriate training to use business equipment in compliance with the monitoring policy.
Templates for internet, email, and social media use policies
- Sample internet acceptable use policy (DOC, 29K)
- Sample business acceptable email use policy (DOC, 29K)
- Sample social media policy (DOC, 20K)
Policies on monitoring the use of business vehicles
Vehicles owned by businesses can also be monitored. For example, tachographs and satellite tracking systems can record vehicle locations, distances covered, and related information about users' driving habits. This monitoring process is regulated by the Data Protection Act.
Inform all workers who drive business vehicles about the vehicle monitoring policy. The policy should state what private use can be made of vehicles and the conditions attached to it.
Where private use of a vehicle is allowed, you will rarely be able to justify monitoring its movements when used privately without the freely given consent of the user. If possible, provide a privacy button or similar arrangement to enable monitoring to be disabled when a vehicle is for private use.
HelpAlso on this siteContent category
Source URL
/content/set-staff-monitoring-policies
Links
Monitor staff correctly and lawfully
How to monitor your staff in accordance with the law and best practices.
In order to ensure that any staff monitoring you carry out is lawful and proper, you need to follow the principles of the Data Protection Act.
Ensuring staff monitoring is lawful: what you must do
You must:
Make sure that any monitoring is justified
For example, to ensure compliance with regulatory requirements, prevent or detect crime, and check whether communications are relevant to the business if a worker is away from work. See staff monitoring: deciding if it is justified.
Ensure that monitoring is proportionate
For example, place CCTV surveillance only where necessary or only spot check emails rather than monitor them continuously.
Inform staff
Notify staff if they are being monitored and what data you are collecting.
Explain why you are monitoring staff
Inform staff why you are monitoring them - if it's not clear why you are monitoring workers, they may feel you don't trust them.
Covert monitoring
Strictly target and limit covert monitoring only to cases where you suspect criminal or other serious malpractice and where telling the individuals about the monitoring would be likely to prejudice its prevention or detection.
Consider staff privacy at work
It's important to take into consideration how to balance the necessary intrusion with expectations of staff privacy at work. Take into account issues such as suitable notification and the purpose of the monitoring.
Ensuring staff monitoring is lawful: what you must not do
However you must not:
Use information unlawfully
Use information for any purpose other than that for which it was collected.
Access personal emails
Access the content of clearly marked personal emails except in exceptional circumstances.
Make routine inspections
Routinely check workers' phone messages, emails, etc - you should only do so if you have made all reasonable efforts to inform users that you may intercept messages.
Continuous monitoring
Carry out the continuous video or audio monitoring, other than usual CCTV surveillance measures.
Recording in private places
Film or make sound recordings in private places - eg toilets or staff changing rooms.
Physical searches
Physically search an employee, unless their contract of employment provides for this and they consent to it.
You should consider putting together appropriate workplace policies on staff monitoring - eg covering the use of internet, email, and business vehicles. See set up staff workplace monitoring policies.
HelpAlso on this siteContent category
Source URL
/content/monitor-staff-correctly-and-lawfully
Links
Penalties for improper staff monitoring
The right and wrong way to monitor workers, and the penalties for improper staff monitoring.
There are a number of possible consequences if you fail to monitor staff in accordance with the data protection principles. In order to avoid such penalties you should monitor staff correctly and lawfully.
Examples of penalties for improper staff monitoring
Constructive dismissal claims
You could face claims for constructive dismissal if - through improper staff monitoring practices - you have substantially breached the implied term of trust and confidence that is contained in the contract of employment of every employee or claims of unfair dismissal if an employee is dismissed unfairly as a result of monitoring.
Pay damages
You may have to pay damages to any individual who suffers a loss or distress because of a breach of data protection law, or to the sender or recipient of a communication you intercepted through unlawful monitoring.
Criminal prosecution
You could face criminal prosecution if you fail to get consent to search an employee, even if you have a contractual right to search.
Liability for inappropriate material
You and/or your staff may be liable for downloading inappropriate material from the internet at work.
If an individual is concerned about how an organisation has handled their information they can make a complaint to the Information Commissioner's Office. See your personal information concerns.
HelpAlso on this siteContent category
Source URL
/content/penalties-improper-staff-monitoring
Links
Staff security: employer responsibilities
Ensure your workers' safety and security by assessing the potential risks.
You are responsible for ensuring the safety and security of your workers.
One way of safeguarding your staff is to carry out a staff risk assessment and then take action to minimise those risks. Such action may include introducing monitoring technology, eg CCTV surveillance. Download a security risk assessment template (ODF, 13K).
High risk situations for staff
Examples of situations where the safety and security of your staff may be at risk include:
- lone working - see ensure lone workers' safety
- handling cash - see business security: cash
- bank runs
- late-night working
- getting home safely
- business travel to certain cities or countries - see international business travel: health and safety
- mobile working - eg drivers, sales representatives
- access to commercially sensitive information
- key holder or high level security access
See business security: protecting staff.
Managing risks to your staff
Once you have assessed the risks to your workers, you should assign someone to implement any measures you need to take to reduce those risks.
For example, you could consider:
- installing CCTV surveillance in appropriate locations
- providing any appropriate training - eg personal safety training
- getting the latest information on the place a member of staff is planning to go on business
- having a policy where necessary - eg on how you may help staff get home if they finish working late at night or on what staff should do if they are physically threatened or attacked - see set up staff monitoring policies
You should review your risk assessments and safety policies regularly. See business security: protecting staff.
If you employ security staff, they should have suitable training. Give security passes to your staff and train them to challenge unfamiliar visitors.
If a member of staff becomes a victim of crime while at work - eg they are assaulted:
- report the incident to the police
- record the incident
- take steps to prevent similar incidents in the future
ActionsAlso on this siteContent category
Source URL
/content/staff-security-employer-responsibilities
Links