Workforce surveillance: How to find the right balance

While much has been reported about workplaces being more flexible than ever, far less has been revealed about the other reality — the fact that we’ve never been more closely watched.

Workforce surveillance in a post-pandemic world has made the concept of flexible working surprisingly inflexible, and governments are falling behind with regulation.

Professor Alysia Blackham from Melbourne Law School at the University of Melbourne discusses several case studies in her paper on surveillance and data privacy at work.

Employees at a major bank, she reports, have to download an app to perform standard workplace tasks such as enter buildings and book workstations. At all times, whether they are actively using the app or not, their location data is collected.

“As one Google user noted in 2018: ‘I’m really uncomfortable with the idea that this application requires 24/7 access to my location. A major privacy concern in my opinion’,” Blackham writes.

“The app is being used to track staff movements,” she continues, “and human resources are forcing workers to apply for leave when they appear ‘unproductive’ or are absent from their allocated workstation.

“Collecting and relying on this data, including for performance processes, is therefore highly problematic, as it is potentially an invasion of employee privacy, and likely inaccurate.”

Workforce surveillance can take countless other forms. Technology from organisations such as Seeing Machines monitors truck drivers’ faces throughout journeys to warn them when they’re distracted or becoming drowsy.

Insurer IAG used keystroke logging in the termination of the employment of a long-time staff member, with the ex-employee unsuccessful in an attempt to have the dismissal overturned.

Software such as Teramind and Hubstaff are increasingly being used as monitoring tools behind the scenes.

“The tension between flexibility and surveillance is very real,” says principal lawyer at Stefanie Costi & Associates, Stefanie Costi. “While remote and hybrid work arrangements have empowered many employees, they have also triggered a wave of digital surveillance by employers trying to regain a sense of control.

We are seeing employers turning to monitoring software, keystroke tracking, webcam checks and even productivity scoring tools.” 

The irony, Costi says, is that while workers are being trusted to do their jobs from anywhere, they are also being watched more than ever.

In some cases, this has positive outcomes for both employees and employers. She notes that in transport and logistics “surveillance technology has undoubtedly saved lives”, and the monitoring of access to sensitive financial, legal or otherwise personal information to stop inappropriate conduct has a net positive outcome.

“But poorly implemented surveillance can backfire in spectacular ways,” Costi says. “It can damage morale, erode trust and cause employees to become disengaged and cynical.

 

"While remote and hybrid work arrangements have empowered many employees, they have also triggered a wave of digital surveillance by employers trying to regain a sense of control. We are seeing employers turning to monitoring software, keystroke tracking, webcam checks and even productivity scoring tools."

 

“It also creates a culture of fear. It stifles creativity, risk-taking and innovation, and undermines the psychological safety that is essential for a thriving, high-performing team. It can also have huge mental health implications.”

Blackham agrees, saying research shows that individuals who already experience exclusion or discrimination in the workplace will feel the force of surveillance more keenly. “There are also cases where a worker’s data has been misused by their manager,” Blackham says.

“So, for example, people are being stalked by their boss because the boss has access to their personal information.”

Surveillance can come with a reputational cost, Costi says, particularly among younger generations for whom there is a “growing expectation that work is built on mutual respect — not surveillance”. The concept of surveillance can result in talented candidates actively rejecting employers who use such tools, she adds.

Legalities in Australia

Globally, policymakers look to the European Union for examples of best practice around privacy and workplace surveillance, Blackham says.

In Australia, workplace privacy is governed by a patchwork of local and state laws. “It is mainly state legislation that governs the use of surveillance devices,” says Charles Power, managing partner at Holding Redlich.

“But there is some scope for the federal Privacy Act 1988 as well. And of course, the Privacy Act is replicated in many jurisdictions by state legislation that applies to the public sector.”

New South Wales and the Australian Capital Territory have specific workplace surveillance laws. In the Northern Territory, the issue is governed mainly by the Surveillance Devices Act 2007, which covers the types of devices allowed to be used and the types of information to be collected. However, this is mainly focused on law enforcement.

In other Australian states, there are various iterations of the federal Privacy Act. No state or territory is currently doing a convincing job of protecting the rights and privacy of employees, Blackham says, particularly when small business exemptions release over 90 per cent of businesses from most federal responsibilities.

Recently, a Parliament of Victoria inquiry reviewed the impact and effectiveness of current surveillance laws. The final report contains 18 recommendations on should be modernised.

These laws should be “technology neutral and require employers to show that any surveillance they conduct is reasonable, necessary and proportionate to achieve a stated legitimate objective,” the report says.

The committee also recommends that “employers should be required to notify and consult with workers about workplace surveillance practices and disclose how workers’ data will be collected, used and stored”.

This inquiry is seeing Victoria potentially emerging as a leader in the field of government regulations on employee monitoring.

“There is a growing convergence of political inquiries and an emerging consensus that there needs to be better regulation — as opposed to the patchwork of regulation that exists now,” Power says.

Costi puts it more bluntly. “Legally, it is a bit of a mess between states.”

The landscape in Asia

While legislation and attitudes vary across Asia, the strength of employee rights and privacy laws tend to correlate with the level of monitoring employers are allowed to practise.

In Singapore, for example, employers must comply with data privacy regulations. Under the Personal Data Protection Act 2012, businesses can only collect or use personal data with an individual’s consent to do so. However, there are exemptions, including if the personal data is to be used for evaluative purposes.

 

"There is a growing convergence of political inquiries and an emerging consensus that there needs to be better regulation — as opposed to the patchwork of regulation that exists now."

 

No matter where businesses are based, Blackham says, best practice should be modelled on a human approach that revolves around a specific business case that only collects and holds information that is relevant — and only for the time it remains relevant.

“That means establishing a clear business case for surveillance, ensuring it is proportionate to the risk, consulting with workers and representatives, and putting in place data safeguards and audit processes,” she says.

The future of surveillance

There are some useful tools to guide the implementation of workforce surveillance, Blackham says. They include the EU’s General Data Protection Regulation legislation and the recommendations from the Victorian inquiry.

Policymakers will strive to balance the rights of employers with the need to protect the privacy of workers. Power believes that there will be a shift in the direction of principles-based regulation overseen by a central, independent authority. 

“The regulator will have powers and could receive privacy complaints,” he says. “When complaints are received, there will be an assessment as to whether the surveillance scheme meets certain principles.

“Then, there will be other things, like where the information is going, how it is being used, how it is secured, whether individuals can access it and, if artificial intelligence is involved, how it is validated. Importantly, there should also be strict rules around getting rid of the data when it is no longer needed.”