The Information Commissioner, the government official responsible for data protection issues, has issued Part III of the Employment Practices Data Protection Code. Part III deals with ways in which organisations can comply with the Data Protection Act 1998 in the context of monitoring their workers. Sanctions for not complying with the Act include criminal charges.
The legal requirement on employers is to comply with the Act itself. The new Code provides useful guidance and some benchmarks in terms of how to do this, it does not impose new legal obligations. The Code’s objective is to strike a balance between the legitimate expectations of workers to have their personal information handled properly and the interests of employers in deciding how best to run their business. The Code gives ‘good practice recommendations’ on managing data protection, general approach to monitoring, monitoring electronic communications, video and audio monitoring, covert monitoring, in-vehicle monitoring and monitoring through information from third parties.
The Code identifies the following ‘core principles’:
- it will usually be intrusive to monitor workers;
- workers have legitimate expectations that they can keep their personal lives private and that they are also entitled to a degree of privacy in the work environment;
- if employers wish to monitor their workers, they should be clear about the purpose and satisfied that the particular monitoring arrangement is justified by real benefits that will be delivered;
- workers should be aware of the nature, extent and reasons for any monitoring, unless (exceptionally) covert monitoring is justified;
- in any event, workers’ awareness will influence their expectations.
The Code recommends that employers clearly set out the circumstances in which workers may or may not use telephone systems, email and internet for private use. Employers should try to be as specific as possible in defining the extent and type of use that is permitted. Employers should include clear guidelines in staff handbooks and should include a contractual right to monitor telephone calls and email communications.
The very useful Data Protection website is at www.dataprotection.gov.uk. A copy of Part III of the Code can be found there along with other information about notification and the data protection principles.