Big Brother is coming to a workplace near you, and the privacy regulator wants a word
- Reference: 1696413667
- News link: https://www.theregister.co.uk/2023/10/04/ico_workplace_monitoring_guidance/
- Source link:
[1]As far as the ICO is concerned , "monitoring workers" means any form of monitoring of people carrying out work on behalf of the employer. This might include anything from recording calls to snapping the odd screenshot, recording keypresses, or peering at webcam footage.
This might occur in the office or offsite during or outside work hours.
[2]
However, the monitoring, according to the ICO, must take place in a fair and lawful way.
[3]
[4]
According to the ICO, 70 percent of the public would find it intrusive to be monitored by an employer. Nearly 19 percent reckoned they had already fallen under the gimlet gaze of The Boss.
Although the law in the UK does not prevent monitoring, it must be done in a way that complies with data protection requirements and Article 8 of the Human Rights Act 1998 concerning the right to respect for family life.
[5]
It is, therefore, a balancing act for employers – sure, employees can be monitored, but a lawful basis must be identified. And consent is always needed.
The latter is unsurprising, given a [6]recent UK government report into monitoring that recommended companies ensure they consult and get consent from staff they are tracking.
Even then, the ICO guidance recommends thought be given to how and what data is collected and consideration to whether an employee is on site or working from home. After all, random snooping via webcam might be an unwelcome invasion of privacy.
[7]
The ICO is big on the words "must," "should," and "could," with only the former comprising absolute rules to follow. For example, workers must be informed if calls are to be monitored, but employers should ensure workers understand the purpose and extent of any monitoring.
That said, the guidance is helpful for employers considering monitoring their staff. With some US companies [8]deploying monitoring tools , businesses with UK operations need to be aware of what can and can't be done.
[9]As TikTok surveils staff's office hours, research indicates WFH is good for planet
[10]Meta spends $181M to get out of lease at vacant London offices
[11]Blue Origin tells staff to catch next rocket back to their desks
[12]Bosses face losing 'key' workers after forcing a return to office
Microsoft famously came unstuck after it inadvertently exposed employee monitoring – as far as some privacy campaigners were concerned – via [13]2020's Productivity Score, an incident that emphasized the amount of data it already had on file.
Emily Keaney, deputy commissioner of Regulatory Policy at the ICO, said: "Our research shows that today's workforce is concerned about monitoring, particularly with the rise of flexible working – nobody wants to feel like their privacy is at risk, especially in their own home."
Get your staff's consent before you monitor them, tech inquiry warns [14]READ MORE
Tech companies are increasingly keen on getting workers back into the office. IBM's CEO recently warned that working from home [15]could be bad for a worker's career while Mark Zuckerberg appeared to suggest that the Metaverse was perhaps better experienced from behind a desk as staff [16]were instructed to return to the office three days a week.
Checking up on workers, wherever they may be, is therefore of great interest to employers.
Keaney warned: "As the data protection regulator, we want to remind organisations that business interests must never be prioritised over the privacy of their workers. Transparency and fairness are key to building trust and it is crucial that organisations get this right from the start to create a positive environment where workers feel comfortable and respected."
Transparency and trust. Novel concepts in the IT world. ®
Get our [17]Tech Resources
[1] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/10/ico-publishes-guidance-to-ensure-lawful-monitoring-in-the-workplace/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZR2MJLn53V2XZ5B2jKUjlwAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZR2MJLn53V2XZ5B2jKUjlwAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZR2MJLn53V2XZ5B2jKUjlwAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZR2MJLn53V2XZ5B2jKUjlwAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2023/08/10/workplace_monitoring_select_committee/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZR2MJLn53V2XZ5B2jKUjlwAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/09/20/is_wfh_good_for_planet_ask_tik_tok/
[9] https://www.theregister.com/2023/09/20/is_wfh_good_for_planet_ask_tik_tok/
[10] https://www.theregister.com/2023/09/27/meta_coughs_181m_to_exit/
[11] https://www.theregister.com/2023/08/03/blue_origin_wfh_rules_change/
[12] https://www.theregister.com/2023/06/29/wfh_rto_survey/
[13] https://www.theregister.com/2020/12/01/productivity_score/
[14] https://www.theregister.com/2023/08/10/workplace_monitoring_select_committee/
[15] https://www.theregister.com/2023/05/04/working_home_ibm/
[16] https://www.theregister.com/2023/06/02/meta_return_to_office_mandate/
[17] https://whitepapers.theregister.com/
Re: "or offsite [...]outside work hours.
But US working hours are apparently 24/7... I'm definitely with you on this one, Jake: if you want me to work - or even to talk to - outside my core hours (for me and my colleagues, 37.5 hrs/wk, though I work part time these days), you damn well pay me overtime for them. That's *significantly extra*, not the default rate, and definitely not zero.
This concept of 'if you're not prepared to put the company above everything else' expectation is completely and utterly insane...
Re: "or offsite [...]outside work hours.
I remember seeing a t-shirt more than 30 years ago at the Bulldog Bash that said "Cash, gas, or ass! Nobody rides for free!"
Re: "or offsite [...]outside work hours.
The ICO is big on the words "must," "should," and "could," with only the former comprising absolute rules to follow.
Outside working hours they must have no jurisdiction whatsoever. Period.
FTFY
Re: "or offsite [...]outside work hours.
ICO on "should"
"Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. You should do this unless there is a good reason not to. If you choose to take a different approach, you must be able to demonstrate that this approach also complies with the law."
Re: "or offsite [...]outside work hours.
Yup - it's the same with road laws: Must is a requirement backed by legislation, Should is best practice and could is advice on how to be nice.
And just like road laws, there can be exceptional circumstances where the courts will allow that an action was justified that would otherwise be a breach of the legislation/law. However, much like road laws, there will also be people who think they're the exception and do what they want. Until caught. That's when you find out what teeth the law has.
Re: "or offsite [...]outside work hours.
I'm going to disagree here.
If I'm using a work supplied device (Laptop, mobile phone, tablet, car, etc) then I think the business is justified in ensuring I'm not misusing the business asset it has given me to perform my duties.
If you're using your personal devices to do work, then you're a muppet.
Re: "or offsite [...]outside work hours.
If I'm using a work supplied device (Laptop, mobile phone, tablet, car, etc) then I think the business is justified in ensuring I'm not misusing the business asset it has given me to perform my duties.
First, define misuse. It's one of those things that cuts both ways. I hire someone to do a job. That might be to produce 100 widgets a day, or 100 lines of usable code. As long as the job is done, I am not that fussed about how it gets done. Which is one of the problems with workplace monitoring. Just because you can, it doesn't mean you should. When I was an employee, and a permanent home worker there was a manager who insisted that everyone must have their laptop cameras uncovered and available at all times. Which would mean I'd have to get dressed. Sure, the company did have a dress code, but that was to keep the offices looking vaguely respectable. There are plenty of videos on the 'net where unexpected objects end up in the viewing area though on video calls.
There's also fun stuff like activity monitoring. So Mr Eel, your activity log show you've been idle for 3mins or more 72 times this week. Explain yourself! Which for many of us should be easy. We typically get paid to think how the hell we're supposed to implement whatever it is that's just landed as a task in our inbox. Until neural interfacing is more advanced, thinking time can't be measured. Which is also a bit of a shame because then thinking about work-related stuff outside of contracted hours also can't be invoiced.
It''s probably also an IR35 issue, ie if my work is going to be closely monitored and scrutinised, it's going to be harder to argue that I'm independent. Pay me, my or chosen delegate to solve a problem and it'll get solved. If it doesn't, don't pay or sue.
Re: "or offsite [...]outside work hours.
Outside working hours they should have no jurisdiction whatsoever. Period.
That's nice, but as you're from the US and therefore about 100 years behind the rest of the western world in employment rights, it's just a dream. You know, like if someone in Europe said there should be flying cars or nuclear fission or something.
And consent is always needed
Oh consent is simple: Either you consent or you don't work for us.
In that case my consent would only last long enough for me to find another role elsewhere.
Fortunately, consent is transferable.
" "monitoring workers" means any form of monitoring of people carrying out work on behalf of the employer.'
So the PHB looking through the office window, poking his head round the door or even listening to office chatter drifting through the building would count as "monitoring" under that definition.
Meh.
It's why I have privacy covers on all the laptop cameras. I don't trust *not* having them fitted and the cameras blanked until *I* decide I want to show my ugly mug to someone.....
Plus my job has me working across different laptops (customer requirement), so when it comes to productivity checking, my employer is going to have a bit of a struggle if they want to go down that route.
I don't have a problem with my employer making sure my work provided assets are used for company business, but I draw the line at them being able to access the camera to invade my privacy any time someone feels the need.
My company laptop is switched off and closed up when I am not working, good luck on getting any images from it then. During work hours I also have a cover on the laptop's camera unless I am actively using it. Again, good luck getting any images unless I am in a meeting.
My personal computer at home does have a camera on it, but if my company ever attempted to access it they would find themselves in the wrong end of a court case so fast you would here the sonic boom.
Dumb companies equate activity with productivity
Measuring activity gives no insight at all into whether an employee is earning their keep. To measure productivity you have to look at how much output they produce and evaluate the quality of the work. Which is harder to do for management, and the reason why unproductive managers often go for the lazy option of activity monitoring in the first place.
If employees know that they're being judged by activity they will generate plenty of it, in the easiest way possible, whether it's useful or not. Often to the detriment of producing better work, which may require doing things that don't look as active as more inefficient ways of doing them.
I can't think of any area of IT where this doesn't apply.
Re: Dumb companies equate activity with productivity
Exactly. Monitoring, for example, lines of code produced will just result in a lot of incredibly verbose code. Fixing code to run twice as fast or be half the size of existing code will show up as zero or negative productivity and therefore never happen.
Re: Dumb companies equate activity with productivity
Getting dangerously close to becoming a cynical BOFH.... Another management change, another management model. Rolled out as the 'new thing' but it is really the 'same thing' we saw several managers back.
We know how to win at that model and all the other models. We will make the metrics look positively glowing. Bonuses & atta-boy's for everybody!!
Actual productivity...what's that?
"or offsite [...]outside work hours.
Outside working hours they should have no jurisdiction whatsoever. Period.