The growth of remote working has led many organisations to introduce digital monitoring tools to supervise employees outside the traditional ‘in-person’ workplace. Employers do have a legal right to monitor work-related activity carried out on devices used for employment purposes, but this right is carefully constrained by data protection laws.

Employers commonly monitor activity for legitimate operational reasons. For example, organisations may review work emails to prevent data breaches, monitor login and logout times to verify attendance, analyse internet usage to detect cybersecurity risks, or use productivity software that records time spent on particular applications. These practices are generally lawful where they support business security, regulatory compliance, or performance management.

However, employers must comply with the UK GDPR and the Data Protection Act 2018 when monitoring employees. This means they must identify a lawful basis for collecting personal data and ensure that monitoring is necessary rather than excessive. Employers should select the least intrusive monitoring methods available and recognise that workers have a right to a private life, as protected under Article 8 of the European Convention on Human Rights.

Transparency and open communication are the cornerstones of ethical and legal employee monitoring. Employers are expected to inform employees in advance if monitoring will take place and explain what information will be collected and why. For instance, a company may include monitoring provisions within a staff handbook or privacy notice explaining that activity on a company laptop may be logged. Covert monitoring is rarely acceptable unless there is suspicion of serious misconduct or criminal activity and no reasonable alternative investigation method exists.

Employers should carry out an 'impact assessment' to decide if and how to monitor staff working from home by setting out the reasons for monitoring and the likely benefits, identifying any negative effects the monitoring might have, considering other options to monitoring or alternative ways to carry it out, understanding the law around monitoring and collection of data, and deciding whether there is a valid reason for carrying out monitoring.

The distinction between company equipment and personal devices is also significant. Monitoring a work-issued laptop to prevent unauthorised data transfers whilst an employee is working from home is usually easier for an employer to justify than monitoring an employee’s personal mobile phone used occasionally for work communications. The Information Commissioner’s Office advises employers to carefully assess the risks associated with bring-your-own-device arrangements and ensure that private information remains protected.

Inappropriate employee monitoring risks triggering claims for unfair or constructive dismissal, breach of privacy, or discrimination, as well as potential regulatory investigation and enforcement action by the Information Commissioner’s Office. Employers should also be mindful that engaging in overly oppressive practises may undermine employee trust, and risks exposing the organisation to reputational damage and high staff turnover. Employers have a responsibility to ensure any monitoring of employees is proportionate, transparent, and justified, and avoids crossing the threshold into excessive and unlawful surveillance.

This article was provided by Madison Bowyer, an Associate in the Employment Law Group at Arthur Cox NI. 

T:+44 28 9026 5886 
E: Madison.bowyer@arthurcox.com 
https://www.arthurcox.com/