"You ate my sandwich" - monitoring employees in the workplace
22 March 2019
I would never give up a meal but I certainly wouldn’t begrudge someone a taste (unless they were a sibling – that’s a different story). I would trust my fellow employees to keep their distance but if my lunch started to disappear daily I’m not sure what I would do - maybe a simple note, a lunch box with a lock, surveillance? – possibly too far but if your employer had to set up CCTV to protect your soup and sandwich, the question arises as to what level of monitoring can be undertaken by an employer and what expectation of privacy do employees have at work?
Employees in Ireland have a general expectation of privacy in the workplace which can be balanced with an employer’s legitimate interests in protecting its business, reputation, resources and equipment. Employers must disclose that they monitor their employees except in very limited circumstances where covert surveillance may be justifiable (i.e. there is a demonstrable need and the employer intends to involve the police – I’m not sure a missing lunch will cut it).
It is imperative that the policy detailing the employee monitoring that may take place is clearly communicated to employees.
In the absence of a well communicated policy, it is difficult for employees to assess what level of privacy is afforded to them in the workplace. They must be made aware of what monitoring will take place and for what purpose. The Workplace Relations Commission in Ireland has in the past been critical of employers who have failed to do this.
The employee will inevitably rely on the Data Protection Acts 1988 – 2018 and GDPR regarding their privacy but it is the responsibility of the employer to assess what monitoring activities will take place and to ensure they are, necessary, reasonable and proportionate in the circumstances. The employer should ensure:
- the monitoring activity is necessary - employers should consider whether there are less intrusive means;
- the monitoring activity is legitimate;
- the monitoring activity is proportionate to the aim being achieved;
- the monitoring activity is transparent to employees - employers need to clearly communicate to their employees the basis on which they are monitored in all relevant policies. It is imperative in all situations that employers make sure their employees are aware that they can be monitored and the reasons for the monitoring. Monitoring should also be detailed in the employer's workplace privacy notice.
Whether consent is required from the employee will depend on the reasons for the monitoring. If the monitoring can be justified by means of another lawful basis under GDPR, such as the employer’s legitimate interests, then consent will not be required. However the monitoring should still be limited to monitoring that is reasonable and proportionate to achieve the employer’s legitimate aims while balancing this with an employee’s reasonable expectation of privacy in the workplace. This is in reflection of a recent article in the news where CCTV was used to catch an employee stealing food:
The woman in question had her lunch, which was lovingly made by her chef husband, stolen every day. So she politely left a note to say that if the person wanted a chef-made lunch every day, her husband was willing to make it for them, provided they pay.
A few people in the office, not the thief themselves, decided to get in on the offer and get the chef to make them lunch too.
And yet the lunch thief continued to target the pregnant woman’s lunch which came in a special non-plastic microwavable container.
Despite telling the thief she was pregnant and needed to eat certain nutritious food and that HR was now involved, the brazen thief kept nicking the grub. That is until cameras were installed, catching the thief in the act. To read the full article please click here.