Employee Monitoring: Legal Restrictions and Best Practices

As part of their fraud prevention strategies, many organizations monitor their employees’ activities in the workplace. Video surveillance can be used to deter and detect theft by employees. The monitoring of employee emails might reveal internal fraud schemes. Confidential business information can be protected by monitoring how employees use their computers. For each type of employee monitoring, however, there are legal restrictions that vary by jurisdiction. A company’s employee-monitoring program can be legal in one country but violate the laws of another.

Ron Cresswell, J.D., CFE               
Research Specialist, ACFE

 As part of their fraud prevention strategies, many organizations monitor their employees’ activities in the workplace. Video surveillance can be used to deter and detect theft by employees. The monitoring of employee emails might reveal internal fraud schemes. Confidential business information can be protected by monitoring how employees use their computers. For each type of employee monitoring, however, there are legal restrictions that vary by jurisdiction. A company’s employee-monitoring program can be legal in one country but violate the laws of another.

 

Employee Monitoring Laws: A Global Perspective

 

The U.S. has relatively weak privacy laws. As a result, U.S. companies can engage in almost any kind of monitoring as long as the monitored employees receive prior notice. The notice usually takes the form of a written policy stating that the company may monitor all company equipment and employee communications. If the company requires its employees to read and sign the policy, this generally satisfies the notice requirement.

 

Privacy laws are more stringent in European countries, where privacy is viewed as a fundamental human right. For example, in Germany and Italy, employees must give voluntary, written consent to any form of employee monitoring, and the consent may be challenged in court on the ground that it was not truly voluntary. In France, employers generally cannot access employee emails that are identified as “private” or “personal.” Most European countries have data protection laws that restrict the collection, disclosure and transfer of personal information. These laws may also give employees the right to access and correct the personal data collected by their employers. In some European countries, works councils or data protection authorities must be notified before an employee-monitoring program is implemented. There are additional restrictions for countries that are members of the European Union (EU). For instance, EU guidance states that employee monitoring must be no more intrusive than is necessary to achieve a legitimate business purpose.

 

Outside of Europe, the laws are varied. India and most Australian states have no laws specifically restricting workplace monitoring, while China, Japan and Singapore require notice of employee monitoring but generally don’t require consent. In the United Arab Emirates, employee monitoring requires consent from all affected employees.

 

Best Practices

The best practices discussed below are intended as general guidelines for employee-monitoring programs. They are not applicable to every situation or every jurisdiction. Due to the variety and complexity of the laws, companies should consult legal counsel for more specific and detailed guidance.

 

  

Create a written policy. Companies that engage in employee monitoring should have a written employee-monitoring policy. The policy must clearly and accurately state the purpose of the monitoring, how and when it is conducted, and which employees are affected. Legal counsel should draft or review the policy. Multinational companies generally need multiple employee-monitoring policies — one for each jurisdiction in which the monitoring occurs.

 

Notify employees. Employees must receive notice of the employee-monitoring policy before they are monitored. The most effective ways to give notice are to require employees to read the policy, or to require employee training on the subject. Employees should be required to acknowledge, in writing, that they have received notice.

Get employee consent. Whenever possible, companies should obtain employees’ written consent to the monitoring policy. In some jurisdictions, the employee’s signed acknowledgement of the policy also constitutes consent. In other jurisdictions, including several European countries, employee consent requires more than just acknowledgment of the policy. Some courts have questioned the very notion of employee consent, arguing that it is impossible to obtain consent that is truly voluntary because of the power disparity between employers and employees. Therefore, seeking legal advice is especially important in jurisdictions that require employee consent to monitoring.

 

Be reasonable. An employee-monitoring policy should be no more intrusive than necessary. In other words, it should be reasonable. If a type of employee monitoring — such as tracking the physical location of employees — is not necessary to achieve the stated purpose of the policy, then it is probably unreasonable.

 

Be consistent and fair. Employee-monitoring policies should be applied consistently and fairly. Individual employees should not be targeted for special or enhanced monitoring unless they are suspected of specific misconduct. Discipline should also be fair and consistent. Singling out employees for special treatment can decrease employee morale and invite discrimination lawsuits.

 

Do not monitor personal areas or communications. Companies should not use cameras to monitor personal areas in the workplace, such as restrooms or areas where employees change clothes. Most jurisdictions have laws prohibiting cameras in such places. Also, employers should try to avoid monitoring employees’ personal communications (e.g., personal telephone calls and personal emails). Many jurisdictions have laws prohibiting the monitoring of personal communications.

 

Protect employee data. Employers must ensure that any data gathered through employee monitoring is kept secure. Such data often includes sensitive employee information that is subject to data protection laws and other legal protections. Therefore, companies must have adequate technology and internal controls to securely store such data and keep it safe.

 

While employee-monitoring programs can be a useful tool to catch potential red flags for fraud, companies must ensure that such programs comply with all applicable laws. This can be a daunting task for multinational companies that operate in multiple jurisdictions. With the assistance of legal counsel, however, it is possible to design and implement an employee-monitoring program that is legal and ethical.