DATA PROTECTION IMPLICATIONS OF MODERN EMPLOYEE MONITORING SOFTWARE
| Author | Benjamin WONG1 LLB (Hons) (National University of Singapore), LLM (London School of Economics); Advocate and Solicitor (Singapore); Sheridan Fellow, Faculty of Law, National University of Singapore. |
| Publication year | 2021 |
| Citation | (2021) 33 SAcLJ 10101 |
| Published date | 01 December 2021 |
| Date | 01 December 2021 |
1 Employee monitoring has been a common feature of most workplaces for a long time. The closed-circuit television (“CCTV”) camera is perhaps the best known “traditional” technology used by employers to monitor their employees. CCTV cameras, and other technologies such as “clocking in” or card attendance systems, rely on specialised hardware. Today, however, software solutions in the form of employee monitoring software have entered the market, and are now widely available to employers. Employee monitoring software represents a new way by which employers can undertake surveillance over their employees.
2 Employee monitoring software may be deployed for a wide range of purposes.2 Employee monitoring software may be used for the purposes of data security, by preventing employees from engaging in activities that inadvertently introduce vulnerabilities to external threats, as well as by preventing deliberate malicious conduct by employees.3 Employee monitoring software may also be used to optimise employee productivity, by tracking what employees do throughout the course of the workday, enabling intervention by employers to discourage unproductive uses of workplace time and material, to encourage productive work practices, and to organise workplaces to facilitate higher employee performance.4 In essence, employee monitoring software aids the achievement of these and other purposes by allowing employers to know more about their employees, gaining insight into their behaviour and motivations. An additional possible advantage of using employee monitoring software is that it facilitates the gathering of evidence of employee misconduct, and such evidence may be useful in the event of litigation.
3 Whilst the benefits of using employee monitoring software are no doubt numerous, the use of this software brings into conflict two competing sets of interests: the interests of employers in managing their workplaces and workforces, and the privacy interests of employees. The use of employee monitoring software by employers almost inevitably attracts the application of data protection law. The primary objective of this article is to explore the application of Singapore data protection law to the use of employee monitoring software. It will study the existing employee monitoring software on the market, to identify their data collection capabilities. It will then look to the potential data protection implications that arise out of the collection (and subsequent use and disclosure) of personal data collected by the employee monitoring software.
4 The issue of employee surveillance through monitoring software is particularly salient in view of the present COVID-19 pandemic situation. The Singapore government has instituted a lockdown which has required a majority of the employed Singapore population to work from home. At the time of writing, the lockdown remains in effect, and even after the lockdown is lifted it may well be the case that it will have to be re-instituted in the event of a future outbreak. With more employees working remotely as a consequence of the lockdown, concerns have been raised about employers using employee monitoring software to keep track of their employees.5
5 To preface the discussion, it will be useful to provide some context about employee data protection.
6 Data protection law generally recognises that employees form a special class of individuals (or “data subjects”, to use the European parlance). Under the European Union (“EU”) General Data Protection Regulation6 (“GDPR”), for example, Art 88 confers upon EU Member States the freedom to create rules to govern employee personal data:
Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.
Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.
7 Similarly, as will be discussed below, employee personal data receives special treatment under Singapore data protection law. There are several possible reasons why employee personal data is, and should be, treated differently.
8 One possible reason to afford special treatment to employee personal data lies in the nature of the employer-employee relationship. As Collins explains, there are a number of “distinctive features of the employment relation that render it unlike other market transactions”.7 In particular:8
[T]he opportunity to work in return for a wage has greater significance for the employee than their other market transactions. Most people rely upon employment as their principle source of income. Pay serves as the major mechanism for the distribution of wealth in a market society. Work has to produce enough income to support an employee and his or her dependants, not only on a daily basis, but also for a lifetime. Beyond determining their material standard of living, work also provides people with a principle source of meaning in their lives. Through their work people seek personal fulfilment, and through participation in a workplace they obtain entry into a social community. Work can be exhausting, boring, and dangerous, but without it many people become socially excluded and lose any sense of personal worth.
These features tend to place employees in a position of subordination or dependence vis-à-vis their employers. As a consequence, not all of the standard mechanisms of data protection law provide effective protection to employees. In particular, the consent mechanism may offer limited protection, since employees may in practice feel compelled to give consent to their employers in spite of their personal misgivings about the practices to which they are giving consent.9
9 A second possible reason for treating employee personal data specially under data protection law is that the proper functioning of the employer-employee relationship often depends quite heavily on the employer's processing of employees' personal data. In the course of hiring, managing and terminating employees, an employer needs to collect, use and disclose a broad range of personal data about those employees, including for example their names, educational qualifications and prior work experience.10 Employers may often also need to process
10 Relatedly, a third possible reason for treating employee personal data differently is that employers frequently possess large amounts of personal data about their employees, some of which disclosing fairly intimate details about those employees. Much of this information is, of course, voluntarily provided by the employee before the commencement of the employment relationship — at the time when the employee applies for a position with the employer. Subsequently, throughout the course of the employment relationship, the employer has ample opportunity to further gather employee personal data, both by voluntary and involuntary means. One of those means, which this article will now proceed to discuss, is by the use of employee monitoring software.
11 In order to gather information about the operation of modern employee monitoring software and their data collection capabilities, a number of different employee monitoring software service providers were studied. These include: ActivTrak, ContentWatch, DeskTime, Ekran System, EmailAnalytics, Hubstaff, iMonitorSoft, InterGuard, Kickidler, SentryPC, SoftActivity, StaffCop, Teramind, Time Doctor, Track.ly, Veriato, VeriClock, Work Examiner and Workpuls.
12 This article proceeds to first discuss the mode of operation of these employee monitoring software, in general terms, before laying out the data collection capabilities of the employee monitoring software.
13 In relation to how employee monitoring software generally operate, two commonalities among the employee monitoring software studied may be identified: first, most employee monitoring software operate in stealth, either exclusively or by default. Most employee monitoring software, when deployed by an employer, generally do not disclose to the monitored employee that he is in fact being monitored.11 This means that employees may have their personal data collected by employee monitoring software surreptitiously. However, some employee monitoring software do provide the flexibility of running in a more transparent fashion, allowing employees to know when they are being...
To continue reading
Request your trial