Employees’ right to privacy

Our employment team often receive queries in relation to monitoring and surveillance of employees. There have been three recent European cases on this topic which emphasise employees' right to privacy and highlight some key points which employers should consider.

In all three cases, the employer was found to have breached Article 8 of the European Convention of Human Rights which protects the right to respect for private and family life.

The court considered three very different scenarios which included:-

1. Installing video surveillance at a public lecture theatre at a University which was the subject of a complaint by one of the lecturers.
2. A disciplinary investigation involving personal emails which an employee sent in work time using the employer's computer system. The emails included information of an intimate and medical nature and the transcript of the messages was read by numerous colleagues involved in the disciplinary process.
3. Employees working in a supermarket who were suspected of theft. The employees were told about some of the cameras however additional hidden cameras were put in place. The footage recorded cashiers stealing and this was relied upon by the employer to dismiss.

The key themes which flowed from the decisions included establishing a proportionate means of achieving whatever was the employer's legitimate aim These included:-

• the importance of ensuring there were legitimate grounds for data collection. In the first case involving the University despite them arguing a case there was a need to protect safety of property, people and students, the Court found there was no evidence that safety was an issue that justified the video surveillance.
• Private life is a broad term and emails sent from work were protected under Article 8. Proportionality is important and employers should notify employees of the possibility of monitoring, the extent of the monitoring, ensure there are legitimate reasons for monitoring and accessing the content of conversations, consider whether less intrusive means could be used, consider the consequences for the employee and put safeguards in place to ensure the employer cannot access the content of communications unless the employee has been notified in advance.
• Video surveillance is considered to be a "considerable intrusion" into employees' private lives, bearing in mind they are contractually required to go to work, they cannot evade it. Surveillance should therefore be targeted and not generally used, should not be over a prolonged period and less intrusive means should always be considered, for example, informing employees in advance of the installation of cameras and of their personal data protection rights.

Considerations for employers

Whilst it is commonly known that it is unlawful for public bodies to act in a way which is incompatible with the European Convention of Human Rights and therefore decisions of the court, section 2 of the Human Rights Act requires UK courts to 'take into account' any decision of the European Court of Human Rights and our courts generally do. These decisions are therefore relevant to all employers as they undoubtedly reflect good employment law practice and the ethos of the decisions are enshrined in the General Data Protection Regulation 2018. This will mean employers will not be able to rely on blanket contractual consents to process personal data and will have to justify processing on other grounds, including the legitimate interests of the business.

The cases do not impose any form of ban on monitoring or covert surveillance and there are some helpful points that can be derived from these cases including:-

• Robust policies which set out the employer's position on internet usage, monitoring, surveillance that is in place such as cameras and the employee's rights in relation to their data;
• Considering each case on its own merits i.e. is there a justifiable reason for installing cameras?
• If the investigation is covert, record a rationale as to why this is necessary and limit the time periods to only what is necessary;
• Consider the impact of monitoring from the employee's perspective;
• Could any less intrusive measures be taken?
• Only use the data collected for the purpose it was obtained and thereafter it should be deleted or destroyed;
• Ensure safe storage of personal data and strictly limit access to those who require it for the legitimate purpose; and
• Record the reason for the data recording, monitoring or surveillance.

This article is for general guidance only. It provides useful information in a concise form. Action should not be taken without obtaining specific legal advice.