#Monitor privacy protector software#

Unless absolutely necessary, the recommended practice is to regularly cull data that is no longer necessary for meeting the stated objectives of the employee monitoring strategy.Įven with the quantity of data limited, employers are still expected to implement technical and administrative safeguards that adequately protect employee monitoring data. While the data collected through employee monitoring programs will provide valuable insights regarding productivity and technology usage in the workplace, the perpetual storage of this data may lead to conflicts with data privacy legislation if the employer cannot provide a legitimate business reason for storing the data long-term. Under these legislations, employers must be prepared to answer Data Subject Access Requests (DSARs) from employees in a timely manner. DSARs: CCPA and GDPR both have provisions that relate to the right for data subjects to request access to the data that is held by data controllers.The inherent unbalanced power dynamic present in such a relationship means that employers should not rely on consent as the legal basis for justifying their monitoring practices, however, explicit written consent is still a prudent measure for communicating and enforcing monitoring-related policies. Explicit consent: In the context of the employer/employee relationship, the concept of consent is murky at best.As monitoring-related policies are developed, the Article 29 Working Party ( “WP29” – now replaced by the European Data Protection Board) recommends that a representative sample of employees are involved in assessing the legitimacy of the proposed solutions. These policies should clearly outline the measures taken, the goals of the implemented measures, and the expectations the organization has of its employees.

Policy development: Detailed policies are effective for informing employees to the extent of the monitoring practices that will be implemented within the organization.

While the degree of transparency will differ by jurisdiction, there are key transparency principles that will greatly inform monitoring strategies. Ensure your monitoring is fully transparentĮven if your company is subject to less robust transparency requirements than is required by GDPR, 77% of Americans surveyed by Harris Poll indicated that they would be less concerned about having their digital activities monitored so long as their employer was fully transparent.Īttempting to monitor your employees without their prior knowledge will damage the reputation of your company and greatly increase employee turnover – 70% of employees in the Harris Poll survey indicated that they would consider quitting if they discovered that monitoring was performed without their prior knowledge. As part of implementing new employee monitoring technologies, you will be expected to conduct a Privacy Impact Assessment that clearly documents the potential privacy impacts the proposed technology will have on employees. GDPR in particular heavily emphasizes that the privacy rights of the data subject are paramount, strongly indicating that monitoring must be limited to the minimum extent required to achieve the objectives of your company. One of the core principles of leading data privacy mandates is proportionality – in the context of employee monitoring, this means that any monitoring activity taking place must have a legitimate business interest that definitively outweighs any potential harms to the privacy rights of employees. Should the data captured be insufficiently anonymized, a negligent breach of this data has the potential to lead to legal penalties under both GDPR and CCPA, depending on the location and citizenship of the employee.

Under the lens of GDPR’s sensitive categories, internet usage data that includes websites visited and search engine queries is likely to contain identifiers for these categories.

political opinionsreligious beliefs or other beliefs of a similar nature.

Sensitive categories of data include identifiers of:

Monitoring solutions that capture computer usage data have the potential to unknowingly track data that pertains to sensitive categories under GDPR and related data privacy regulations.

#Monitor privacy protector software#

While it is readily apparent that standard HR employment data (names, addresses, etc.) is sensitive in nature, the data captured by employee monitoring software is rarely addressed directly. Is employee monitoring data considered sensitive?