Employee surveillance:
a new age in hi-tech spying

Anthony Drake, Senior Associate | Wednesday 8 February 2006

Employers have been monitoring their staff since time immemorial.

What is changing is the tools they use to do it. The days of punch time clocks are gone - today the employer has access to a bewildering range of technology to spy on workers.

Employers who are suspicious and mistrustful have the capability to monitor employees overtly or covertly with video surveillance or by hiring security firms or private investigators. The spying toolkit enables them to monitor employee email, internet use, phone calls and even track employee movements through mobile phones, global positioning system (GPS) devices in company vehicles, and via workplace access cards and Radio Frequency Identification (RFID).

Employee surveillance has well and truly hit the hi-tech age - and this brings with it a whole raft of new issues to consider.

Why spy?

On the whole employers are worried about two key things: their legal liability (which includes exposure to breach of contract, copyright, trade secrets and personal grievances) and loss of productivity or property.

Employers have, of course, a legitimate right to protect sensitive, confidential information, proprietary information, trade secrets or take preventative steps to stop an employee conducting personal business in company time.

There is another important reason why devices such as GPS in vehicles and RFIDs - microchips implanted under the skin of employees - are being used, particularly overseas – and that is safety. They help employers keep track of drivers on long cross-border journeys, for example, or those working in potential danger zones like Iraq.

Privacy: the critical factor

The starting point for checking workplace privacy rights is considering whether the employee has any legitimate expectation of privacy. The Privacy Act (the Act) sets out rules for the collection, storage, use and disclosure of personal information and grants the right of access to and the right to request corrections of such information.

The Act plays an important part in ensuring that there is communication between an employee and employer so that employees' rights to privacy are not intruded upon. It also places some limits on the rights of the employer to monitor employees.

Privacy Principles

In New Zealand, privacy has been infringed if one or more of the 12 information privacy principles, set out in the Act, have been breached. The principles apply in any situation where information relating to an individual is collected or held by an agency.

The first issue is whether material collected by the employer would fall under its coverage as personal information, being "information about an identifiable individual".

For example, while some personal email messages could hold such information about the employee, many would not. Jokes or offensive material that are not about the employee would not be personal information and therefore not covered by the Privacy Act.

In general, within the Privacy Principles:

• Principles 1 - 4 regulate the purposes for which and the manner by which information may be collected. Collection does not, however, include the receipt of unsolicited information. Personal information put on an employer's network by employees voluntarily is therefore not solicited and therefore not collected.
  
  
• Principles 5 - 11 apply to the way in which information held by an agency is stored, accessed and corrected by the individual concerned. These principles set out limits on the use of personal information held by the agency and apply regardless of how the information is obtained.

Although employers will consider monitoring employees to ensure compliance with their company policy, they may be opening themselves up to further liability of their own.

When a company monitors employee activities, the employer could easily stumble across personal information. Employers cannot always assume that the Privacy Act will not apply to the monitoring of their employees. In such a situation, employers could find themselves liable for breach of the privacy principles.

Video surveillance

Generally, there is no bar to an employer maintaining video surveillance of workers. For example, most workers are aware that employers use video cameras to monitor loading docks and customer service areas. Some employers will also, from time to time, use hidden cameras for secret surveillance of employees to detect theft or dishonesty.

Employers should be aware that video film is a document within the meaning of the Act and therefore the use of video cameras to collect personal information is covered.

A key issue to consider with covert surveillance is whether it is "not reasonably practicable" and would "prejudice the purposes of collection". Employers must take particular care not to collect personal information by means that are unlawful, unfair or which intrude unreasonably upon the personal affairs of workers.

Where video surveillance (particularly covert) is considered by employers they should:

• Have reasonable suspicion of unlawful activity.
  
  
• Be clear it is not reasonably practicable to draw the fact of the filming to employees' attention without prejudicing the purpose of collecting the information.
  
  
• Ensure other forms of investigation have been considered and found unsuitable or inconclusive.

Email and internet surveillance

Some employers monitor employees' email and internet use when there are concerns about trade secrets, misappropriation of company information, liability for employee defamation, harassment, copyright infringements or downloading pornography.

Time spent on the internet, or email, can lead to loss of productivity which may be a breach of the employee's duty to devote their working time and attention to their employer's business.

For example, in a recent UK case, Franxhi v Focus Management Consultants Ltd, the employee was found to be fairly dismissed after logging onto a holiday related internet site 150 times during working hours. The Employment Tribunal held that Ms Franxhi was guilty of serious misconduct and had acted in breach of her employment contract. It upheld her employer's right to send her on a "permanent holiday".

There is no doubt it is in the interests of employers to regulate email and internet access to avoid criminal or civil liability for the wrongdoing of their employees.

Recording phone calls

Recording phone calls is not unlawful. However, whether it is fair depends largely on the situation. Many employers monitor employee telephone calls as part of staff performance assessments, particularly in cases where levels or standards of telephone performance are expected. Undoubtedly surreptitious recording could breach the privacy principles.

Cellphone use and tracking

Work cellphones and Blackberry devices are valuable communication tools for organisations. But when they are misused by staff they can leave employers vulnerable. Problems can arise through the illegitimate exchange of material or harassment and excessive texting or calling can lead to productivity loss. It is clearly in employers' interest to prevent inappropriate or illegal activity. Technology allows tracking employee movements through mobile phones and monitoring material exchanged. Having a clear policy and monitoring employee usage are ways to ensure that risks are appropriately managed.

GPS

More recently, employers are considering the use of Global Positioning Systems devices to monitor use of company vehicles. While initially GPS has been used for other reasons, such as safety, there is now a move to use the tracking technology to monitor the movements and productivity of staff such as travelling sales reps.

While New Zealand Courts are yet to consider this use, privacy principles apply and ought to be contemplated. Employers should inform employees that a GPS device has been fitted to a company vehicle to avoid any potential breach.

Use of information

Principles 1 to 4 do not prohibit an employer from accessing information and viewing email messages on its email network. However, principles 5 - 11 apply to the way in which information is held and used by an employer.

Where practicable, the employer should clearly inform employees that it will carry out monitoring and where possible secure their agreement to it. It seems that an employer may lawfully monitor employee activities without notification where it has a good reason for doing so, such as ensuring pornographic material is not being distributed.

However, until more specific guidance from the Privacy Commissioner is received, employers need to be careful that monitoring is not carried out in a way which would be an unreasonable intrusion upon the personal affairs of the individual.

Either a current employee or a dismissed employee could make a complaint under the Privacy Act. The employer's exposure to a complaint being made under the Privacy Act can be reduced if a legitimate reason for monitoring can be established.

Policy implementation

The prudent course of action is for an employer to implement a specific policy on monitoring employee activity at work.

This policy should state the circumstances in which employees' activity will be monitored or accessed and the individuals authorised to access the personal information collected. All employees should be made aware of the policy and the employer should take steps to ensure that all employees read the policy.

If an employer implements policies that its employees are aware of, and where appropriate, have had input into, it would be difficult for an employee to argue that he or she had thought they were not monitored.

The precise contents of any policy will vary from organisation to organisation but should include:

• Who the policy applies to (for example employees and contractors).
  
  
• The primary reason for monitoring and an indication of expectations regarding personal privacy.

Employees should be trained regularly and frequently in the application of the policy and any changes should be notified promptly, preferably by electronic means. The policy should be kept constantly under review and the people who were consulted in its development should be consulted in its review.

Striking a balance

The speed of technological development is showing no signs of abating and so employers and employees can expect to be faced with a growing arsenal of sophisticated monitoring equipment.

Unfortunately, it's not likely that the need for monitoring will decline either - although there is always hope that surveillance programmes and policy will bring a degree of deterrence.

The challenge will continue to be in striking a balance between upholding employees' rights to privacy and taking measures to minimise the potential serious impact the behaviour of the minority of dishonest staff can have on business.

For further information, please contact your usual Bell Gully advisor or:

AUCKLAND

Rob Towner
Partner

WELLINGTON

Andrew Scott-Howman
Partner