The UK privacy regulator, the Information Commissioner’s Office (ICO), has released guidance to employers on complying with data protection laws in the complex issue of employee monitoring.

According to the guidance, employers need to strike the right balance between data protection rights and the need to monitor employees. Before implementing any monitoring measures, employers should conduct a Data Protection Impact Assessment (DPIA) to ensure that their objectives align with data protection principles. Employees must be informed not only about the collection of the data itself but also about their rights.

Here are some of the rules the employees must follow:

1. Limit the purposes of collecting data, the type of data collected, and the duration of its retention.
2. Assess risks arising from monitoring efforts and implement measures to protect employees’ personal data.
3. Restrict data transfers to countries that don’t have robust data protection standards.
4. Maintain transparency regarding data collection and processing, and allow employees to voice objections, especially concerning sensitive data such as biometric data.
5. Comply with the elevated obligations applicable to collecting and handling biometric data, and document all decisions made based on this data.
6. Provide alternative means to verify or identify employees who choose not to consent to the processing of biometric data.
7. Avoid automatic decision-making and profiling by implementing genuine human supervision in the process.

Click here to read the “Employment Practices and Data Protection − Monitoring Workers Guidance”.