Flying against the headwinds - Tracking employees' whereabouts and monitoring their health

1. To what extent can employers track and monitor employee movements and ask for the production of medical information?

   In the employment context, an employee is frequently asked to provide their personal data to his or her employer, and it is often necessary to do this for employment and HR management purposes. In many countries there are exemptions afforded to employers under local data protection legislation with regards to obtaining data for employment reasons and often only a notice to the employee that their personal data is being obtained is required.
   
   There are however, special situations and specific kinds of personal data that are afforded greater protection; and in some countries this distinction is built into data protection legislation (e.g. sensitive personal data as under the EU General Data Protection Regulations). This includes biometric data (fingerprints, facial recognition data, blood samples) and sometimes, data generated from location tracking and medical records.
   
   

2. Can an employer collect any data they wish on an employee?

   The underlying principal in much of the data privacy legislation in place is whether the personal data is being obtained for a legitimate purpose and whether the information is necessary to achieve that purpose. Herein lies the challenge; exactly what data is required will greatly depend on the circumstances and the purpose, and how that balance is arrived at takes careful consideration and planning. Without doing so, the employer may be at risk of contravening data privacy laws, albeit unintentionally. Examples of breaches of employers' obligations to employees' data privacy include:
   
   - Excessive collection of personal data by asking overly intrusive questions;
   - Disclosing employees' personal data to third party vendors without consent (or with consent but failure to impose the data processors with obligations to protect employees' data privacy); and
   - Insecure storage of employees' data.
   
   

3. Can an employer monitor their employees' whereabouts at all times and request that they provide medical data?

   Employee monitoring is a particularly contentious issue. Employers often feel the need to take steps to protect their customers / clients and staff, and to ensure that staff are performing their duties. But this creates an immediate tension with the privacy and data protection rights of employees.
   
   Before an organisation does undertake employee monitoring and tracking, it is important to go back to the core reasons for such monitoring and whether it is absolutely necessary to achieve the legitimate purpose in doing so. Taking an example scenario, if an employee has been certified as having contracted a contagious illness, then it will be for public health and safety purposes to track the person's movements, as well as reviewing the employee's medical records to ensure they are fit to return to work. It will be much more difficult to justify asking to track the movements of every employee and review every employee's medical records if the employees' have shown no sign of being ill; there are other ways of tracking productivity (such as implementing time sheets, regular performance reviews, daily video conference check-ins etc) that can be implemented without taking the potentially excessive stance of tracking and monitoring all employee activity and movement.

To view the rest of the webinars in the series and look at the commonly asked questions we address, please click here.