Does Big Brother have a future?

Hidden behind a two-way mirror, Anna Jones keeps a watchful eye on workplace surveillance.

1984 may be history, but Big Brother seems to be our future. Employee surveillance is reportedly on the increase; and the unstoppable march of technology continues to arm employers with an ever more ingenious array of snooping gadgetry. We are all familiar with monitoring by: closed circuit TVs, accessing e-mails, tapping telephones and giving employees ‘smart cards’ in order to track their movements around the workplace. Such “Q” style electronic wizardry is no longer the exclusive preserve of James Bond. One employer in the US is understood to want all employees to have a microchip implanted in their arms to monitor their activities. The ‘smart’ nose ring may yet become compulsory office workwear. If it could be programmed, say, to log into your computer and turn the kettle on when you’re 5 minutes away from the office, it might just catch on. The Luddites among us might consider it just a touch invasive.

Employers have tried to justify their use of invasive surveillance by saying that they are protecting legitimate business interests. However, they may soon be forced to prove that the end really does justify the means. The issue is increasingly taking centre-stage with the trade unions, who argue that the erosion of privacy can cause stress, damage to dignity and personality, and general discontent among the workers.

Employees currently enjoy little legal protection from surveillance. Surveillance could amount to breach of the employer’s statutory duty to take reasonable care for the health and safety of employees, but this will be restricted to extreme cases. It is arguable that covert surveillance could sometimes amount to a breach of the implied duty of trust and confidence. Even then, an employer claiming a legitimate business purpose for the surveillance may succeed without being required to demonstrate that the use of such invasive methods was actually necessary to achieve that business purpose. If the employees have been told that their e-mails will be monitored or that there are cameras working in certain areas, they will be deemed to have ‘consented’ to the surveillance, so a case based on trust and confidence would be unlikely to get off the ground.

However, the tide may be about to turn. The Data Protection Act 1998 is expected to come into force in March 2000 and the Human Rights Act 1998 is likely to come into force in October 2000.

Data protection
As discussed more generally in our January 1999 bulletin and earlier in this bulletin, the Data Protection Act 1998 (the “DPA”) covers the processing of ‘data’ on individuals. ‘Data’ includes:

• information being ‘processed’ (which includes obtaining, recording and using) by means of equipment operating automatically in response to instructions given for that purpose, and
• information recorded to form part of a system enabling information on particular employees to be readily accessible. The records of video and other forms of surveillance are likely to be covered under the second part even if the surveillance itself is not covered by the first part. The use employers can make of such records may therefore be subject to the data protection principles. One of these principles is that data must be processed fairly and lawfully. In particular, where the employee has not given his consent to the processing, the employer may need to show either that the processing is “necessary for the performance” of the employment contract or that it is “necessary for the purposes of legitimate interests [of the employer]”. This second ground cannot be used “where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests [of the employee]”. Where the data is ‘sensitive personal data’, the employer must either get the explicit consent of the employee or show that the processing is “necessary for the purposes of exercising or performing” any legal right or obligation “in connection with employment.” The potential coverage of the DPA in the area of surveillance is greater than may at first be evident. For example, records of an employee’s access to pornographic websites are probably ‘sensitive personal data’ because they are information on sexual life. It is not yet clear to what extent privacy rights will be protected by this framework in practice. The interpretation of the concepts of ‘necessity’ and ‘consent’ and the balance between ‘legitimate interests’ of employer and employee will be key. However, the Data Protection Registrar has recently announced her commitment to protecting personal privacy as a top priority. The Registrar noted, from a survey she commissioned, that greater importance is now attached by the British public to personal privacy than to employment or freedom of speech. She therefore announced her intention to publish a Code of Practice under the DPA offering guidance for employers. This will apparently cover “employee surveillance involving collection of data to monitor performance or detect problems e.g. interception of e-mail and use of CCTV”. The Code is to be circulated for consultation and is not yet publicly available. Human Rights The Human Rights Act 1998 (“HRA”) incorporates the European Convention on Human Rights into UK domestic law. Article 8(1) of the Convention provides that “everyone has a right to respect for his private and family life, his home and his correspondence”. Article 8(2) states that “there shall be no interference by a public authority with the exercise of this right except as is in accordance with law and is necessary in a democratic society...”. The Act does not apply directly to private employers, nor to the private, employment-related acts of some public bodies. However, this does not mean that private employers can ignore the Act. When the Act comes into force, UK courts will be required to interpret UK law in accordance with the Convention, taking into account caselaw of the European Court of Human Rights. In Halford v United Kingdom, the European Court ruled that interception of phonecalls made by an employee on a private line in her office amounted to a breach of Article 8(1) as there was a ‘reasonable expectation of privacy’. It seems likely that a ‘reasonable expectation of privacy’ would preclude video surveillance in workplace toilets and canteens, at least unless employees are expressly told otherwise. It is quite conceivable that the European Court will in future go further in placing restrictions on the degree of surveillance permitted, even where employees have been warned that they are being observed. The HRA will no doubt add force to the Data Protection Registrar’s view that privacy is a legitimate employee interest for the purposes of the DPA. The Home Office has also stuck its oar in, requiring OFTEL to issue guidance to private employers on compliance with the HRA: employers are advised to ensure staff can make private calls without being overheard, while work-related calls should only be monitored where necessary and proportionate and with prior warning to staff. Courts and tribunals may well develop the duty of trust and confidence to cover rights to privacy (or develop a stand-alone implied duty to respect privacy) which would override the business purposes argument where the surveillance is disproportionate. Privacy rights could also be taken into account in determining whether an employer has acted within the “band of reasonable responses” for unfair dismissal purposes. A more radical development would be the creation of a new common law tort of privacy. Conclusion At the moment, private employers wishing to monitor employee activities are likely to be in the clear legally if they inform employees of the monitoring they are carrying out, however intrusive it may be. Even covert surveillance may not cause private employers many problems, provided they can put forward a convincing business reason for its use. However, when the Data Protection Act and Human Rights Act come into force, good practice may undergo a fundamental revision.