The Right to Privacy, Surveillance-by-Software and the “Home-Workplace” – Philippa Collins

8 September 2020 by Guest Contributor

This article was first published on the UK Labour Law Blog ( @labour_blog). We repost it with the kind permission of Dr Philippa Collins (@DrPMCollins at Exeter University) and the editors of the Labour Law Blog

One of the lasting impacts of the COVID-19 pandemic upon the world of work is likely to be a move away from the traditional workplace. In some sectors, such as academia, IT, and administration, remote work or home working is an established working pattern, although a rare one given national statistics from 2019 which indicated only 5% of the workforce worked mainly from home. The need to prevent the spread of the coronavirus through contact in the workplace precipitated a rapid and widespread move to homeworking. In an ONS survey in early May, 44% of adults surveyed were working from home. As some businesses begin to transition back into their previous working patterns, several high-profile companies have announced that they will not expect their staff to return to the workplace and will support homeworking as a permanent option in the future.

Prior to the pandemic, the inability to engage in immediate supervision and control of the workforce may have rendered businesses reluctant to permit homeworking. Lockdowns proved to be an opportunity for the technology sector to demonstrate that their products can fill this gap, providing employers with the capacity to monitor closely their workers – wherever they may be working. Whilst these tools have existed and been deployed for a number of years, in traditional and remote working environments alike, there has been a massive surge in interest in their use during the months of lockdown. One site reports that, in May 2020, demand for such programmes remained 71% above the pre-pandemic average. Packages such as Hubstaff, ActivTrack and the concerningly-named Sneek offer employers the ability to monitor your minute-by-minute activity, see what websites you access (and even what you typed on them, via regular screenshots), and watch you as you work through webcam surveillance. These standard options can be complemented in some instances with GPS tracking, audio recording of the employee and covert monitoring capacities. This raft of measures allows employers to keep a close eye on their employees’ productivity, even though they are working from their own home. But what are the implications for the employee subjected to these measures? How should we conceive of their right to a private life and a home life whilst work is at home and employer monitoring has entered via the back door?

A New Challenge for Article 8

The sudden proliferation of working from home and the associated increase in interest in online surveillance tools present a new challenge for the right to privacy. When the right to a private life under Article 8 of the European Convention on Human Rights (ECHR) was first cited in a case relating to the workplace, Niemitz v Germany, the challenge for the European Court of Human Rights (ECtHR) and the litigants was to conceptualise the right to privacy existing in an office or place of work. Despite the clear authority that has developed at the European level, in cases such as the Von Hannover v Germanylitigation and Pay v UK, the judiciary in the UK still struggle to appreciate fully that an individual enjoys a right to their private life even in public spaces shared with others.

The use of electronic surveillance of workers in the home thrusts the previously public life of the workplace deep into the private sphere of the individual. Boundaries, previously blurred by weekend working or answering emails in the evenings, begin to disappear altogether. Imagine, for example, that an employee – during the pandemic particularly – uses the flexibility of working from home to balance their duties at work with their need to care for their family. They might work unusual or variable hours to complete their tasks, whilst spending time with their family during what would previously have been considered ‘working time’. The employer may consider, therefore, that they have the right to monitor the individual during all of these hours of the day, both the tradition “9-to-5” as well as the early mornings and evenings when the employee might be prioritising their work. For example, Adam Satariano – a New York Times journalist who documented his (and his boss’s) experiment with productivity monitoring software Hubstaff – noted that the software captured his online exercise class mid-morning one day and his GPS co-ordinates during a family bike ride on another. But the software was also capturing his activities whenever his laptop was open, often between nine and 14 hours per day. The extent of this monitoring goes well beyond the eight-hour working day, which we might consider as a standard under the relevant International Labour Organisation Conventions. Whilst the increasingly porous boundaries of work are likely to put pressure on the very concepts that regulate our working time, how might these concerns be reflected in the discourse regarding Article 8 of the ECHR?

We are thus facing, in privacy terms, a convergence of two usually distinct spaces which have previously entailed differing frameworks and priorities. Only rarely, such as in the case of domestic workers, do these spheres come into such close contact. Article 8 ECHR guarantees the individual the right to respect for their private and family life, their home and their correspondence. FNASS & others v France establishes that an individual is entitled to a space in which to develop relationships with others, a right to personal development, and a right to live privately, away from unwanted attention or publicity. The right to a private life incorporates the right to the protection of the physical and psychological integrity of an individual from other persons, as well as their social life and intimate life. One’s home is also protected from unnecessary or disproportionate searches by state authorities (McLeod v United Kingdom), and one is entitled to the peaceful enjoyment of one’s home and property (Giacomelli v Italy). The protection of the individual, their development and identity and their protection from intrusions by others, particularly whilst in their own home, is at the centre of this group of cases under Article 8 ECHR. Any interference with those interests must be justified in accordance with the standard of necessity and answer a pressing social need as identified by the ECtHR.

In the workplace, although the employee maintains some rights under Article 8, the employer’s managerial authority and the protection of their business interests tend to play a significant role. The employee’s rights focus around the right to privacy in their correspondence or data, such as emails or images stored as a result of monitoring, and the right to develop relationships with others. Even within the workplace, these rights have been found to have been infringed upon through monitoring of email and internet usage (Bărbulescu v Romania), CCTV (Köpke v Germany), and  storage of personal data about the employee (Leander v Sweden). The employer can justify an interference as taking measures to protect a range of their interests, including their right to protect their property from theft and a residual right ‘to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company’ (Bărbulescu v Romania, Application no. 61496/08, at §124). The ECtHR is willing to accept substantial monitoring or use of information about employees by their employer in pursuit of these aims, leading to a perception that the employee’s and the employer’s interests in this context receive a more equal weighting.

Surveillance whilst working from home therefore presents almost a reversal of the original conceptual problem with workplace privacy. Where the initial struggle was often thinking of privacy rights persisting in a public space, the most private sphere is now to be subject to a systemic intrusion by an outside party and rendered quasi-public through screenshots and constant tracking. The primary way that the ECtHR could reconcile the clashing priorities and mediate between the need for privacy at home with the employer’s business needs would be through their discussions of the employee’s ‘reasonable expectations of privacy’. Whilst it has been observedthat this concept has difficulties when applied to contexts such as work, one’s reasonable expectations of privacy often remain central to analysing whether Article 8 ECHR is engaged upon the particular facts of the case.

On one hand, the employee is being monitored in their private sphere, through potentially invasive mechanisms such as webcam pictures or audio recording. Viewed from this angle, the former set of concerns outlined above should more appropriately be at the centre of the case and the monitoring measures viewed as a serious infringement upon Article 8. In one’s own home, it is legitimate to argue that there are strong expectations of privacy which are only rarely displaced, such as in the case of the investigation of a crime. In the example described above, the individual would not expect their reliance on the flexibility of working from home to extend their employer’s surveillance even further.

On the other hand, the employee’s home – during their hours of work at least – is also their workplace. The employer thus has a legitimate interest in their activities and ensuring their productivity and the application of monitoring software is a viable alternative to more direct methods used in a traditional shared office. Just as an employee cannot reasonably expect complete freedom from any monitoring in the workplace, the expectations of privacy during working hours at home must be adjusted to take into account the business needs of the employer. As long as the monitoring is limited to contracted hours of work, an employer could argue that the individual’s expectations of privacy must include the possibility of surveillance in order to be reasonable. This argument would undoubtedly be reinforced by reference to notice or information given to employees regarding any electronic monitoring, a topic that will be discussed further below.

Given that homeworking seems to be accepted as a longer-term solution by many businesses, it may not be long before the ECtHR is asked to resolve this kind of dispute. Both sides have substantial lines of cases upon which to build their arguments. I would argue that the most probable resolution would be a finding of an infringement of Article 8, either as a result of the storage and analysis of data, such as the individual’s correspondence or image, or the use of such data in disciplinary action for example. A reasonable expectation of privacy would be established, although not of the same strength as one that might have been established if the employer’s interest were absent from the case. Even with contractual terms or employee handbooks that give advanced warning to the individual, it is unlikely that the employee’s expectations could be demolished completely. As the Court said in Bărbulescu at §80,

It is open to question whether – and if so, to what extent – the employer’s restrictive regulations left the applicant with a reasonable expectation of privacy. Be that as it may, an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.

The Role of Notice under Article 8

The passage from Bărbulescu indicates not only that the employer cannot deliberately remove any expectations of privacy via notice but also how crucial the second stage of the ECtHR’s analysis is. Several elements are analysed, including the legitimacy of the aim, the legality of the measure and its necessity and proportionality. In cases involving monitoring of employees, the Court has built up a set of principles and factors that influence the assessment of the necessity of the infringing measure which it stated in Bărbulescu. Key within these factors are the extensiveness of the monitoring, whether less intrusive measures could have been used, the adequacy of any safeguards and whether the employee has been notified of the possibility of monitoring.

It is the notification factor that is troubling. We should investigate the treatment of notification in two recent cases regarding the monitoring of employees, which have been discussed previously on this blog – Bărbulescu and Lopez Ribalda v Spain. In the first case, Mr Bărbulescu’s private emails were accessed by his employer during a dispute about his alleged private use of the company’s computer system. Finding that the state had failed in its positive obligation to protect Mr Bărbulescu’s rights under Article 8, the Court emphasised that there was insufficient evidence that the complainant had been notified in advance of the possibility that emails might be monitored. In addition, the national tribunal had failed to consider whether the emails had been accessed without his knowledge and whether there were less intrusive options available to the employer.

Whilst the lack of notification assisted Mr Bărbulescu in his case, it has the potential to be a double-edged sword for employees. If lack of notice leads to a rights violation, the opposite could also be true. An employer intending to implement employee monitoring could use this kind of logic to comply with Article 8 ECHR. Before installing the Hubstaff or ActivTrack packages, for example, the business must simply issue a clear warning of the details of the monitoring software and its capacities. The discussion in Bărbulescu may lead to the perception that, provided that there is a legitimate aim for the monitoring and employees have been given advanced warning, a finding that the infringing measure was proportionate and justified is sure to follow. Whilst it is clearly desirable that employees should receive advanced notice, the remaining criteria listed by the Court were important concerns and should not be side-lined simply by the presence of notice.

I would argue that notification of this kind should certainly be a threshold before monitoring is considered justified. Notification as a threshold would play a similar role to the one that would be played by genuine consent to a monitoring programme in other contexts. For example, when a consumer buys a smartwatch, they opt to allow the company to collect and record their data, with the ability to withdraw their consent at any time. As labour scholarship has demonstrated, we should be sceptical of any reliance on an employee’s consent due to the imbalance of power between the parties and the reality that in many cases the employee has very few options but to accept and continue in their role. Fortunately, this scepticism is matched by the ECtHR’s approach towards arguments that an employee has waived one of their human rights, as demonstrated in Markin v Russia for example. If we rule out genuine consent as an option, a notice would play a comparable role in terms of the provision of information. Giving notice in advance would ensure that the employee has sufficient information about the employer’s monitoring activities to make an informed choice, for example to seek alternative employment or modify their behaviour. They may wish to ensure, for instance, that that they do not use the same device for personal and work purposes in the future to reduce the risk of giving away private information to their employer. Once the threshold of notification has been surpassed, then the other factors listed by the Court – extent, level of intrusion, consequence for the employee and the safeguards in place – should be seriously analysed in order to ensure the individual’s Article 8 rights receive adequate protection.  

The second case of Lopez Ribalda v Spain, however, has undermined the chance that the ECtHR will move in the suggested direction of requiring notification before monitoring can potentially be accepted as justified. The complainants worked in a supermarket which was suffering substantial losses as a result of potential staff theft. The company installed hidden CCTV cameras directed at the tills, regarding which the staff were not informed. The complainants were dismissed as a result of the evidence gathered by the CCTV footage. Their dismissals were held to be lawful in the national courts, despite the complainants contesting the covert recordings. The Strasbourg Court found the positive obligations of the state to be engaged under Article 8 on the facts. At the heart of the Court’s decision was a contradiction. They interpreted Bărbulescu (incorrectly in my view) as requiring compliance with all the factors set out, rather than simply consideration of them by the national courts. Despite this interpretation, the Court found no violation of Article even in the absence of notification of the employees. It simply claimed that the other factors were all the more crucial if no notification had taken place. Whilst the conclusion may have been justified in the particular circumstances that occurred in Lopez Ribalda, it establishes a worrying precedent, which may dilute the requirement of notice in other, more everyday monitoring contexts.

The direction of travel taken in Lopez Ribalda in relation to notification is unfortunate and has been criticised elsewhere. I have argued that employers at the very least should be bound by an element of transparency if they wish to monitor their workforce in the manner outlined above. If an employer feels that targeted surveillance is required due a suspicion of wrongdoing, it should be preceded by a generic notice regarding the possibility of monitoring. In the Court’s considerations, this requirement should be a preliminary step before the consideration of its necessity, intrusiveness and so forth. In the absence of any practical ability for employees to choose to opt-out, the minimum they should be able to expect from human rights law is that they are informed in advance of monitoring being undertaken by their employer.

Lost in Translation: the Position of UK Workers

To conclude, I’d like to consider how these principles and possibilities might affect the position of workers in the UK. The Human Rights Act 1998 presents workers with the opportunity to require a tribunal to take into account their ECHR rights, such as the right to privacy, in domestic litigation. In some cases, the employee may face a disciplinary charge based on evidence gleaned from electronic surveillance whilst working from home. They could bring an unfair dismissal case to the tribunal, alleging specifically that the decision was procedurally unfair as it failed to respect their right to privacy. Other claimants who object to their employer’s practices, however, may not be dismissed. If they wish to resign in protest (often one of an employee’s narrow range of options), they face the initial hurdle of proving a constructive dismissal. In this situation, it is questionable whether – given the discussion below – the Tribunal would perceive technological monitoring as sufficient to constitute a repudiatory breach of contract. If they were able to surpass this hurdle, would the tribunals have regard to the details of the ECHR’s jurisprudence? 

I foresee that the nuances of the ECHR’s balancing act would be lost in translation into the UK context. Virginia Mantouvalou has argued that the domestic tribunals struggle to conceptualise privacy in the relationship between employee and employer, to the detriment of the employee before them. Elsewhere I have observed that, in cases of privacy and surveillance, the courts struggle to recognise the true challenge that an employee’s right to privacy poses for the employer’s long-established rights to managerial control. Where the right would contradict or reign in an aspect of the employer’s prerogative, such as the right to monitor and discipline one’s staff, the tribunals are ready to push aside the employee’s fundamental right in favour of reasserting the employer’s authority.

The perspective most apparent among the judiciary on this theme is expressed clearly by Langstaff J in City and County of Swansea v Gayle:

It is a feature of an employment contract that an employee is subject to the reasonable direction of his employer. An employer is thus entitled to know where someone is and what they are doing in the employer’s time. An employee can have no reasonable expectation that he can keep those matters private and secret from his employer at such a time. To do so would be to run contrary to the contract he had entered with his employer. (§15)

The obligations of the contract – to perform work, to remain obedient and to follow the employer’s instructions – appear to negate the existence of any expectation of privacy during working time. This places the domestic judges at odds with the view of the Strasbourg Court that even express instructions that appear to negate privacy rights at work cannot reduce those rights to nothing. If there is any question between the preservation of contractual authority or the vindication of a worker’s fundamental rights, I would expect that the UK courts will err on the side of the former.

Might the additional contextual factor that the surveillance, in the case that I consider here, is taking place in the employee’s home change the picture? It is doubtful. There is limited evidence, but in one previous case, the court was not squeamish in accepting that an employer’s surveillance of an employee’s movements around their home could be justified. In McGowan v Scottish Water,Mr McGowan was suspected of drawing up false time sheets showing unnecessary or lengthened call-outs to the water treatment plant for which he was responsible. He was the subject of covert surveillance by a private investigation firm for a period of a week, observing his movements at his house and between the house and the plant. Although the tribunal expressed discomfort at the idea of covert surveillance, and although the employer admitted that the same aim could have been accomplished by simply installing CCTV within the treatment plant, no breach of Article 8 was found.

Whilst there is the possibility that, with the additional arguments based on one’s right to be alone, free from observation, in one’s own home, a claimant may receive more sympathetic treatment from the tribunals, I suspect this chance is small. The reality facing claimants is that the tribunal is unlikely to be persuaded by their arguments in all but the most extreme cases. A more fruitful avenue may be that of data privacy and the rights of a worker as a data subject. The potential of the rights and principles contained in the General Data Protection Regulation to resist employer practices is being put to the test by Uber drivers who seek access to data held by the company regarding their performance. Where a claimant wishes to challenge the collection of their personal data through programmes such as Hubstaff, the GDPR principles of lawfulness, transparency, fairness and purpose limitation may be useful tools in litigation. There is very limited case-law on the issue, but the fines for non-compliance are substantial and the Information Commissioner’s Office, which enforces data protection rules, recently confirmed that it has launched an inquiry into a productivity monitoring regime undertaken by Barclays Bank which shared many of the characteristics discussed here. The ICO’s action demonstrates the potency of data protection in providing an alternative avenue for enforcing an individual’s expectations regarding their privacy, albeit focused on the specific element of data collection, storage and use.

Some Reasonable Expectations for the Future of Article 8

As a number of scholars have argued in recent years, the domestic tribunals’ approach towards Article 8 in the employment relationship context leaves a great deal to be desired. In the working-from-home context, a judge must also grapple with the added complexities of surveillance through sophisticated electronic means and the unique dual role being played by the individual’s home. Although the approach taken by the ECtHR in cases such as Bărbulescu and Lopez Ribalda may be criticised on some grounds, Strasbourg’s influence and likely direction of future travel would nevertheless be a welcome influence in domestic proceedings. In particular, a recognition that the right to respect for one’s private life cannot be straightforwardly excluded or overridden by the employer’s right to direct and supervise their workforce is urgent in the domestic context. Similarly, Strasbourg’s approach to the relationship between contractual terms and the right to privacy whilst at or doing work is more nuanced than the UK’s. At the national level, an understanding of privacy better aligned with the ECtHR on this point would also be timely, in light of the sudden surge in monitoring that many UK workers may face in 2020.

Movement at the national level could be matched with a similar progress at the ECtHR level, to ensure that workers have the standard of protection that they need. Continued affirmation that an employee maintains their right to respective for their private life during working time is essential. If one’s reasonable expectations of privacy continue to be influential in the assessment of an Article 8 infringement, the Court could use that to recognise different levels of privacy risks that may be introduced via e-monitoring. For example, monitoring of one’s use of a business-issued laptop to access work emails during conventional office hours raises a lower expectation of privacy than regular screen and camera shots being taken at all hours of the day, regardless of the activity being undertaken. The latter would not only blur the divide between times when the employer has a legitimate interest in the employee’s activities and when they do not, but also give insights into the family life of the employee and a window into their private home space beyond that which is required in line with productivity monitoring. The concept of one’s ‘reasonable expectations of privacy’ could be used to distinguish between these different scenarios and feed into the question of justification.

Further, a clear understanding of the pervasiveness and intrusiveness of electronic monitoring practices would be important, particularly where the surveillance takes place in the employee’s own home or outside of working hours. A serious infringement should be matched with stricter scrutiny of the justification and proportionality of the measure. Such scrutiny must be in place where the employer has gleaned data regarding their employee’s use of their personal time or private life outside, which would indicate that great care should be taken in considering the twin factors of intrusiveness and extent of the surveillance, as listed in Bărbulescu. I would further argue that notification should be a threshold in all cases, even if it is in general terms. The workforce is then able to make choices based on a more complete set of information and covert surveillance should be acceptable in very few circumstances, where there is a strong legitimate aim underpinning it (for example the detection of serious misconduct that threatens the rights of others) and ensuring that its extent is as minimal as possible. Similarly, any arguments that seek to rely on an employee’s consent to contractual terms that enable invasive surveillance should continue to be treated with scepticism. As both the case-law regarding Article 8 and the integration between technology and work continue to evolve, these recommendations could form a foundation for a sensitive balance between the employer’s interest in supervising their staff and the individual’s right to respect for their private life.