Employment and Labor Law

The Balancing Act between Employers’ Legitimate Interest to Monitor Employees and Employees’ Right to Data Privacy

With the plethora of mitigating measures implemented and recommended by the health authorities to curb the spread of COVID-19, many businesses were compelled to shift their workforce to operate remotely from the safety of their own homes. With this transition in mind, employers had to seek alternative ways aimed at ensuring the uninterrupted productivity of employees working outside the employer’s appointed premises.

There are multiple tools which enable employers to exercise a level of oversight over the employees’ activities when working remotely – less invasive technologies include simple monitoring of connection to Virtual Private Network (VPN) and/or by accessing computer usage. However, more draconian measures, such as installing location determination devices, video surveillance through the employees’ webcams, might raise certain legal questions.

In recent months, there seems to be an unequivocal consensus by local commentators in that employee monitoring which involves the processing of personal data, should be implemented with the utmost caution and prudence. This primarily stems from the fact that, the COVID-19 pandemic has prompted employers to shift their workforce from the ‘traditional’ office work environment to a ‘domestic’ one, with many employers allowing their employees to work from their residential home. Thus, employers electing to exercise surveillance to remote-working personnel are exposed to a higher risk of impinging on employees’ fundamental right to respect for private and family life, home and correspondence enshrined in Article 8 of the European Convention of Human Rights (ECHR) as well as the employees’ data protection rights.

Back in 2017, prior to the implementation of the General Data Protection Regulation (EU) 2016/679 (GDPR), The Working Party on the Protection of Individuals with regard to the Processing of Personal Data issued an opinion1 specifically on data processing at work. This opinion highlighted the importance of safeguarding fundamental data protection principles even in situations where the employer might be monitoring its employees. Whilst under the provisions of the GDPR, freely given consent is arguably the most commonly relied upon legal basis for the processing of personal data, this should not be the case in the context of the employment relationship. Due to the imbalance of power inherent to the relationship between employer and employee, consent of the employee would generally be vitiated as it is not deemed to be freely given. Therefore, for the majority of data processing carried out at work, one of the other legal bases should be resorted to. Additionally, employers should ensure that any monitoring of their employees should be done in a legitimate and transparent manner.2

In a landmark judgment3 delivered by the European Court of Human Rights (ECrtHR) in 2017, relating to an employee whose personal communications were being monitored, established that monitoring of employees could only be carried out in compliance with the applicable legislation, in a transparent manner and on grounds provided for by law4.There is a legitimate reason to assume that the employer has a right to ensure that ‘hours of work’ as defined under the Employment and Industrial Relations Act, Chapter 452 of the laws of Malta, are used diligently, especially when the employee is receiving remuneration. However, in adopting such measures a certain degree of ‘proportionality and procedural guarantees against arbitrariness are essential’.5 In its judgment, the ECrtHR established a set of principles and considerations which must be taken into account to determine whether or not the monitoring process is in breach of the employees’ rights. Although the judgement predates the current global pandemic, they are still very much applicable, and inter alia include:

  • Notifying the employee in advance of monitoring;
  • Extent of the monitoring process;
  • The legitimacy of the reasons to justify the monitoring;
  • Whether a less intrusive method could have been established;
  • The consequences of the monitoring; and
  • Provision of adequate safeguards where the measure implemented is of a substantially intrusive nature.

The fact of the matter is that monitoring of employees at the workplace has been around for decades. New technologies make this process far more efficient but concurrently pose greater risks to subjects being monitored. As previously mentioned, the less intrusive the methods employed are, and the more reasonable they are, the easier it is for the employer to justify the use of such methods. By way of example, monitoring their employees at random intervals as opposed to continuously scrutinising their activity. Also, as stated in the abovementioned opinion, “[T]he fact that an employer has the ownership of the electronic means does not rule out the right of employees to secrecy of their communications, related location data and correspondence.”

Though there exists an array of products and technologies being offered to help achieve these aims, an employer should always exercise a degree of discretion in order to ensure that a fair balance is struck between the two competing interests and avoid employing unnecessarily intrusive monitoring practices.

For more information on this topic please contact us on: info@fff-legal.com.

Reference materials

< Back

Fenech Farrugia Fiott Legal
 Malta
TAGLaw
Member Profile
www.fff-legal.com