• Login
    • Advanced search
    • Title
    • Channel
    • Module
  • Home
  • Industry
    •  

      • Aerospace, Defense, and Government Services
      • Automotive
      • Consumer
      • Manufacturing and Industrials
      • Education
      • Energy and Natural Resources
      • Financial Institutions
    •  

      • Insurance
      • Life Sciences and Health Care
      • Private Capital
      • Real Estate
      • Sports, Media and Entertainment
      • Technology and Telecoms
      • Transport and Logistics
  • Practice
    • Corporate & Finance

      • Banking and Loan Finance
      • Business Restructuring and Insolvency
      • Capital Markets
      • Corporate Governance and Public Company Representation
      • Digital Assets and Blockchain
      • Infrastructure, Energy, Resources, and Projects
      • Leveraged and Acquisition Finance
      • Mergers and Acquisitions
      • Pensions
      • Private Equity, Venture Capital and Investment Funds
      • Real Estate
      • Real Estate Investment Trusts (REITs)
      • Tax
      • Transfer Pricing
    • Global Regulatory

      • Administrative and Public Law
      • Antitrust and Competition
      • Communications, Internet, and Media
      • Education
      • Energy Regulatory
      • Environment and Natural Resources
      • Financial Services
      • Food Law
      • Gaming Law
      • Government Contracts and Public Procurement
      • Government Relations and Public Affairs
      • Health
      • Immigration
      • International Trade and Investment
      • Medical Device and Technology Regulatory
      • New Nuclear
      • Pharmaceuticals and Biotechnology Regulatory
      • Privacy and Cybersecurity
      • Space and Satellite
      • Strategic Operations, Agreements and Regulation
      • Transportation Regulatory
    • Intellectual Property

      • Copyright
      • Designs
      • Domain Names
      • IP and Technology Transactions
      • IP Enforcement
      • Patents
      • Trade Secrets and Confidential Know-how
      • Trademarks and Brands
      • Unfair Competition
    • Litigation, Arbitration, and Employment

      • Business and Human Rights
      • Construction and Engineering
      • Corporate and Securities Litigation
      • Employment
      • International Arbitration
      • Investigations, White Collar, and Fraud
      • Products Law
      • Risks, Disputes, and Litigation
  • Comparative guides
  • Engage Premium
  • Login
  • Register
Hogan Lovells Engage 5.7.7
      • Title
      • Channel
      • Module
    • Hit ENTER to search in content
    • Advanced search
    • Login
  • Home
  • Industry
    •  

      • Aerospace, Defense, and Government Services
      • Automotive
      • Consumer
      • Manufacturing and Industrials
      • Education
      • Energy and Natural Resources
      • Financial Institutions
    •  

      • Insurance
      • Life Sciences and Health Care
      • Private Capital
      • Real Estate
      • Sports, Media and Entertainment
      • Technology and Telecoms
      • Transport and Logistics
  • Practice
    • Corporate & Finance

      • Banking and Loan Finance
      • Business Restructuring and Insolvency
      • Capital Markets
      • Corporate Governance and Public Company Representation
      • Digital Assets and Blockchain
      • Infrastructure, Energy, Resources, and Projects
      • Leveraged and Acquisition Finance
      • Mergers and Acquisitions
      • Pensions
      • Private Equity, Venture Capital and Investment Funds
      • Real Estate
      • Real Estate Investment Trusts (REITs)
      • Tax
      • Transfer Pricing
    • Global Regulatory

      • Administrative and Public Law
      • Antitrust and Competition
      • Communications, Internet, and Media
      • Education
      • Energy Regulatory
      • Environment and Natural Resources
      • Financial Services
      • Food Law
      • Gaming Law
      • Government Contracts and Public Procurement
      • Government Relations and Public Affairs
      • Health
      • Immigration
      • International Trade and Investment
      • Medical Device and Technology Regulatory
      • New Nuclear
      • Pharmaceuticals and Biotechnology Regulatory
      • Privacy and Cybersecurity
      • Space and Satellite
      • Strategic Operations, Agreements and Regulation
      • Transportation Regulatory
    • Intellectual Property

      • Copyright
      • Designs
      • Domain Names
      • IP and Technology Transactions
      • IP Enforcement
      • Patents
      • Trade Secrets and Confidential Know-how
      • Trademarks and Brands
      • Unfair Competition
    • Litigation, Arbitration, and Employment

      • Business and Human Rights
      • Construction and Engineering
      • Corporate and Securities Litigation
      • Employment
      • International Arbitration
      • Investigations, White Collar, and Fraud
      • Products Law
      • Risks, Disputes, and Litigation
  • Comparative guides
  • Engage Premium
  • Login
  • Register
  1. News
  2. Less is more - UK ICO issues draft guidance on employee monitoring

Less is more - UK ICO issues draft guidance on employee monitoring

13 October 2022
    • Share by email
    • Share on
    • Twitter
    • LinkedIn
    • Get link
    • Get QR Code
    • Download
    • Print

In 2021 the UK ICO said that it would revise its Employment Practices Data Protection Code to reflect the UK GDPR and Data Protection Act 2018. It has now published its first topic-specific guidance on employee monitoring in draft form. The draft guidance is open for consultation until 11 January 2023. 

Index
  1. What happened
    1. The draft guidance
    2. Next steps

What happened

The ICO published its Employment Practices Data Protection Code (the Code) in 2011. In 2021 it said that it would review the Code to reflect the legal framework in the UK GDPR and Data Protection Act 2018, along with changes to working practices and technological advances over the last decade. The new guidance would be online and topic-specific.

A draft of the employee monitoring guidance is now available, which is open for consultation until 11 January 2023. The consultation invites views on whether the guidance is clear, whether it covers the relevant issues and whether it should provide further examples or cover additional scenarios.

The draft guidance

The core message of the guidance is that employers need to balance their own interests against the degree of intrusion monitoring will entail for employees when deciding whether monitoring is justified. This is unsurprising and reflects the long-standing approach under the Code. Reflecting recent changes in working practices, the guidance emphasises that employees will have significantly greater expectations of privacy where they are working from home than when they are working from an employer’s premises.

The guidance covers both systematic and occasional monitoring. It explains the legal framework for lawful employee monitoring and highlights factors that will be particularly relevant in specific cases, such as email monitoring or video or audio recording. The final section focusses on using biometric data, which the Code did not deal with at all.

Points from the guidance that may require employers to review their approach to employee monitoring include:

  • The need to identify an ordinary and in some cases a special categories lawful basis for processing data. A special categories condition will be required where monitoring captures special categories data incidentally, even if this is not planned. For example, monitoring emails may involve processing data about an employee’s health, even if this is not the purpose of the monitoring.
  • The ICO’s view that monitoring to enforce an organisation’s policies will not be justified if a policy does not reflect what happens “on the ground”. If a nominal ban on personal telephone calls is not in fact enforced, for example, it will not be possible to use the policy to justify monitoring telephone calls.
  • An emphasis on the importance of transparency and of seeking the views of workers or their representatives before introducing monitoring. Employees need to understand the nature, purpose and extent of any monitoring and to be given this information in a way that is accessible and easy to understand. Covert monitoring is only likely to be lawful in exceptional circumstances.
  • The fact that it would be good practice to conduct a data protection impact assessment (DPIA) before introducing monitoring, even where there is no legal requirement to do so. DPIAs should consider the extent of an employee’s privacy expectations, and the impact of monitoring on people other than employees, such as household members, if an employee is working from home.
  • The importance of not using data captured through monitoring for a purpose different from that for which monitoring was originally carried out. However, the ICO recognises that there may be exceptional circumstances where monitoring reveals something that an employer cannot reasonably ignore, such as evidence of criminal activity or gross misconduct.

Next steps

The key points of the guidance are not surprising but highlight the importance of taking a balanced and proportionate approach to employee monitoring. Employers are unlikely to be able to justify intrusive monitoring if less intrusive monitoring would allow them to meet their objectives. As the guidance observes, “just because a form of monitoring is available, does not mean it is the best way to achieve your aims”.

 

 

Authored by Jo Broadbent and Stefan Martin.

Contacts
Ed Bowyer
Partner
London
Stefan Martin
Partner
London
Index
  1. What happened
    1. The draft guidance
    2. Next steps
Related Materials
Sanctions Navigator

Sanctions Navigator: Russia Sanctions

Additional Resources
  • ICO consultation on draft employee monitoring guidance
Keywords Data Protection, Employee Monitoring
Languages English
Topics Employment, Privacy
Countries United Kingdom
Delete Comment ?

Are you sure want to delete comment ?

Get link
Embed
Share by email
Get QR Code

Scan this QR Code to share this content

  • Contact us
  • Disclaimer
  • Privacy
  • Cookies
  • Legal Notices
  • Terms of Use

 

This website is operated by Hogan Lovells International LLP, whose registered office is at Atlantic House, Holborn Viaduct, London, EC1A 2FG. For further details of Hogan Lovells International LLP and the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses ("Hogan Lovells"), please see our Legal Notices page. © 2022 Hogan Lovells.

Attorney advertising. Prior results do not guarantee a similar outcome.

Thomson Reuters HighQ Logo
© 2023 Hogan Lovells | Privacy Policy | Terms of Service