INSIGHT
With many companies struggling to persuade employees to limit their work-from-home and return to working in the office, there is a tendency for some employers to increase employee monitoring, not just to ensure their employees are working but also that they are physically at work.
Setting aside the pros and cons of requiring employees to spend a minimum number of days a week in the office, using employee location data to enforce such a requirement throws up a number of challenges to the principles of data privacy which employers must follow. These include:
Data minimization
Organisations should only gather and use the minimum amount of personal data to achieve their purpose. If an employer wishes to use an employee’s location data (whether gathered from badging in/out of the office, company laptop IP addresses or otherwise) to determine if they are in the office on any particular day, it must take care not to gather data which goes beyond this. Where an employee is when they are out of the office or how long a lunch break they take is not needed for this purpose.
Purpose limitation
Organisations may already have access to data which would allow them to determine which days an employee is in the office. However, this does not mean that employers can simply re-use this data for this purpose. Re-using data from an office badging in/out system intended for access control in order to determine presence represents a new purpose and requires applying the same privacy-by-design measures – including potentially performing a data protection impact assessment – as if the data were being gathered anew.
Lawfulness
Even before the move to work-from-home, an employer might have had legitimate reasons for wanting to know whether an employee was in the office on a given day or not. However, in order for an employer to rely on these legitimate interests as the grounds for lawful monitoring, they should perform a legitimate interest assessment and demonstrate that their interests are not overridden by the interests of their employees. What does not work is simply asking employees for their consent for such monitoring as it could hardly be argued that any such consent was freely given.
Transparency
Irrespective of the extent of the employee monitoring an employer performs and the privacy-by-design measures they put in place, nothing excuses them from making sure that their employees are well informed about this. This is typically achieved through an employee privacy notice and is not just required to meet transparency obligations but clearly a healthy practice for employee relations.
