Workplace surveillance

Which new laws have come into force?
Since March 2000 a raft of legislation has been introduced that could make scrutinising staff behaviour by monitoring emails, recording telephone conversations and using covert cameras illegal. And some practices could attract criminal liability. The new laws affecting surveillance in the workplace are:

• the Regulation of Investigatory Powers Act 2000
  
• the Human Rights Act 1998
  
• the Data Protection Act 1998

The Regulation of Investigatory Powers Act 2000
This Act makes it illegal for an employer to intercept telephone calls and emails unless the employer is authorised under the Act (or the accompanying regulations) or where the sender and recipient consent to the interception. Breaching this Act could result in civil and criminal liabilities. The Act covers all private and public telecommunication systems but not surveillance by camera.

The Human Rights Act
This Act incorporates the European Convention on Human Rights and gives a 'right to respect for private and family life, home and correspondence'. This provision is directly enforceable against public employers, and will be considered in cases involving private businesses for unfair dismissal or breach of the implied terms of trust and confidence. Case law suggests employees have a reasonable expectation of privacy in the workplace.

Employers should make sure employees know of, and ideally give their consent to, the monitoring or recording of correspondence. Employers would also be wise to establish sound email, internet, surveillance and telephone policies.

The Data Protection Act
Under the Act, any evidence collected from the interception of emails, telephone calls and hidden cameras is likely to be classified as personal data. Employees have a right to see their personnel files and personal data heldin 'relevant filing systems', which can include email systems.

'Sensitive personal data'
Sensitive personal data could be film revealing an individual's ethnic origin or medical condition. The employee must consent to its use for any purpose (such as a disciplinary hearing). Film that identifies individuals but does not contain sensitive personal data should be used only in accordance with principles laid down in the DPA.

What if consent cannot be obtained?
Where an employee's consent cannot be obtained, the employer can use non-sensitive data where this is necessary for its legitimate business interests. An employer may, for example, require cameras to enforce health and safety, prevent misconduct or crime, or protect clients or the public. There is guidance on the Information Commissioner's Office website (formerly the Data Protection Commission) regarding the use of CCTV — to which employers should refer before installing cameras — and on using data in employment relationships.