Managing Workplace Monitoring and Surveillance 26.09.

2021, 18:45

Managing Workplace Monitoring and

Surveillance
March 13, 2019

Scope—The topic of managing workplace monitoring and surveillance covers the

practical and legal implications of managing and balancing the legitimate needs of
an organization to protect its assets and safeguard the workplace with the
reasonable expectations of privacy held by its employees. This article focuses on
the employee-relations and legal consequences of workplace monitoring, and
concludes with recommendations for establishing a companywide policy for
employees.

Overview

Employers are increasingly concerned about issues related to violence in the workplace, identity and property theft,

lowered productivity, and on-the-job accidents and injuries. Coupled with the ever-increasing costs of litigation, employers

must find appropriate ways to minimize these risks. As a result, many employers now monitor employees at work to
prevent injuries, misconduct and other types of loss.

Feedback
While guarding against these risks, companies also must balance the business interests of the company with the

reasonable expectations of privacy of its employees. Magnifying this challenge is the availability of technology making it

possible for employers to track all employee e-mail, Internet and telephone use without employees even knowing that
they are being monitored.

HR's Role

Employers are obligated by law to provide a safe workplace for their employees and must also take reasonable measures
to protect their business assets. In adopting measures to accomplish these various objectives, employers must be guided

by legitimate business interests and common sense.

The role of the human resource professional in managing workplace privacy is to facilitate the adoption of reasonable and
effective practices that protect employees while minimizing the risk of employer liability.

Working with legal, risk management and security professionals, the HR function plays a key role in the development and
use of monitoring systems to curb the everyday problems of theft, security breach and other employee misconduct. In
particular, HR should ensure that the monitoring is narrowly tailored, that the need for the monitoring is supported by a

legitimate business justification and that employees understand they have no reasonable expectation of privacy when

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 1 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

they are using employer-provided equipment and systems, such as computer networks, telephones and pagers. HR
should also assist the employer in making certain that monitoring programs do not violate collective bargaining

agreements or create an atmosphere of surveillance in the middle of a union-organizing campaign.

Moreover, employers should include HR and legal professionals at the earliest stage of considering and ultimately
implementing surveillance in the workplace and should work toward a companywide solution that does not lower morale

and is clear and understandable to employees. Finally, HR is instrumental in communicating the employer's policies and
procedures for workplace monitoring and protecting employee privacy, including why the monitoring is necessary and

how it will be implemented. The role of HR in this process is vital to ensuring the trust and cooperation of employees.

Legal Restrictions on Workplace Monitoring

Workplace monitoring is subject to a variety of federal and state constitutional provisions and laws regarding when

employees have a right to privacy and if and when they must be notified that they are being monitored. From a legal
perspective, disclosing surveillance is the smartest tactic. Letting employees know that they will be monitored removes
employees' reasonable expectation of privacy—the element that often forms the basis for invasion-of-privacy lawsuits

arising under common law.

While the basis of the privacy claim differs by jurisdiction, courts that have considered the question usually engage in a
fact-specific analysis. They weigh the reasonable expectation of privacy by the employee and whether the employer has a

legitimate business interest for conducting the surveillance. The fact that the reasonableness of employees' expectation of
privacy usually plays a large part in a court's analysis offers further support for the disclosure of monitoring activities. By
informing employees that their communications are not secure or that their activity will be monitored, the employer can
lessen employees' privacy expectation and in turn bolster the employer's defense in court, while also lessening the impact
on employee morale.

Federal and state laws

The two main restrictions on workplace monitoring are the Electronic Communications Privacy Act of 1986 (ECPA) (18
U.S.C. Section 2511 et seq.) and common-law protections against invasion of privacy. The ECPA is the only federal law that
directly governs the monitoring of electronic communications in the workplace. Congress passed it in 1986 as an
amendment to the federal Wiretap Act. Whereas the Wiretap Act restricted only the interception and monitoring of oral
and wire communications, the ECPA extended those restrictions to electronic communications such as e-mail.

At first glance, the ECPA appears to prohibit an employer from intentionally intercepting its employees' oral, wire and
electronic communications. However, the ECPA contains several exceptions to this prohibition, and two of these
exceptions are of particular importance to employers. The first is commonly known as the business purpose exception,

which permits employers to monitor oral and electronic communications as long as the company can show a legitimate
business purpose for doing so. The second is the consent exception, which allows employers to monitor employee
communications provided that they have their employees' consent to do so. An important and often overlooked distinction
between the two exceptions is that the consent exception is not limited to business communications, and, therefore, a
company arguably can monitor personal electronic communications if it can show employee consent. See May an

employee secretly record conversations with management and other employees without informing them?
(www.shrm.org/ResourcesAndTools/tools-and-samples/hr-qa/Pages/recordingconversations.aspx)

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 2 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

In addition to these two exceptions, the ECPA contains a loophole that may limit employer liability for certain methods of
monitoring. The act's definition of "electronic communications" expressly applies to the transmission of such

communications and does not include the electronic storage of such communications. Therefore, courts have
distinguished between monitoring electronic communications such as e-mail messages while they are being transmitted
versus viewing e-mails while they are in storage. Viewing stored e-mail is similar to searching through an employee's
papers and files. Several courts confronting this issue have found that monitoring electronic communications after
transmission does not run afoul of the ECPA.

The Stored Communications Act (SCA) is part of the ECPA and prohibits an entity providing an electronic communication
service to the public from knowingly divulging the contents of an electronic communication. It applies only to
communications in which the employee had a reasonable expectation of privacy. When an employer makes it clear that
certain communications are not protected, the SCA likely will not apply.

The ECPA merely sets the minimum restrictions on employee monitoring; individual states are free to impose greater

limitations, and many have done so. For instance, in Connecticut, employers that monitor must provide employees
advance written notice that specifies the specific types or methods of monitoring. In addition, several state constitutions,
including those of California, Florida, Louisiana and South Carolina, expressly guarantee citizens a right to privacy. An
explicit declaration of privacy in a state constitution may give employees heightened expectations of privacy, and
employers in such states are wise to take additional steps to diminish employees' privacy expectations with respect to
electronic information and communication in the workplace. See 5 Workplace Privacy Rules California Employers Must
Follow (www.shrm.org/resourcesandtools/legal-and-compliance/state-and-local-updates/pages/california-employee-
privacy-rights.aspx).

Common-law claims

In addition to the ECPA and the various state laws governing workplace monitoring, employees also have brought
common-law privacy claims to challenge employer monitoring. These claims are not based on statutory rights but on the

precedent of prior court rulings. To prevail on a common-law claim of invasion of privacy, the employee must assert a right
to privacy with respect to the information being monitored. Managers and supervisors should be reminded not to disclose
personal employee information to staff and co-workers, even with the best of intentions.

Labor relations issues

Unionized companies face additional complications. The National Labor Relations Board has held that the video
surveillance of any portion of the workplace is a condition of employment that typically must be the subject of collective
bargaining and agreed to by the union prior to implementation. An exception does exist when the use of surveillance
cameras has been addressed and waived in the management rights clause or another provision of the collective
bargaining agreement. Even in that circumstance, communication and buy-in from the union representative will go a long
way toward helping operate such a program.

Covert surveillance without bargaining can cause significant problems for the unionized employer, but even employers
that are not unionized may find themselves having to deal with the labor board on this issue if the employer decides to
implement a surveillance system in the middle of a union-organizing campaign. Unless the employer can show that
property destruction, break-ins or other security issues have increased with the onset of the union-organizing campaign, it
will likely be the recipient of an unfair labor practice charge.

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 3 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

Monitoring Telephone Calls and Voice Mail

The federal Wiretap Act prohibits the interception of stored voice mail messages as well as live telephone calls. However,

employers may engage in legal surveillance of oral telephone communications if they do so in the ordinary course of
business. This exception is particularly important to employers who maintain telemarketing or customer service operations
because of their particular interest in ensuring quality control. Other legitimate business reasons to monitor calls include
protection of trade secrets and ensuring compliance with noncompete agreements. In all cases in which the employer
feels a compelling business need to monitor calls, the best practice is to obtain the employee's advance written consent.

The ECPA provides that the moment an employer realizes that a telephone conversation is personal in nature, the
employer must stop listening. Even employee consent probably will not suffice to protect the employer, unless the
employee specifically consents to unlimited monitoring of both business and personal calls. Employers may have more
leeway to monitor employee calls from telephones designated for business use only. For example, when an employer
informs its employees that the company's main reception line cannot be tied up with personal calls, the employer could

use technology known as a pen register to record the telephone numbers and the length of the call but not the contents
of specific conversations. Employers should attempt to narrowly tailor any intrusion on employee privacy to the specific
objective it seeks to achieve. Use of less intrusive technology can further that goal.

Telephone monitoring is the mode of workplace communication most likely to be affected by the laws of the state where
the communications occur. California law, for example, requires parties to a conversation to be informed—either by a
recorded message or a beep—that the conversation is being recorded or may be monitored. Several states, including
Maryland, New Hampshire and Pennsylvania, require the consent of all parties to the interception of a telephone
conversation.

Monitoring E-Mail and Text Communications

The advantages of using electronic communications in the workplace are obvious. Electronic media are often the most
efficient method of communication among employees and between a company and its customers. Maintaining an

electronic information network allows employers to monitor employee productivity, quality and efficiency; however,
employee use of e-mail, voice mail and the Internet has brought with it a multitude of workplace problems.

For example, an employee's personal use of e-mail and the Internet during business hours can affect the employer's
productivity and profitability. Even more importantly, however, employee misuse of electronic communication media can
place organizations at risk for legal liability and breaches of data security. Employers can face claims of sexual harassment,
discrimination, defamation, copyright infringement and other improper conduct arising from employee misuse of
computerized communications. Also, employers must be concerned with protecting trade secrets and proprietary
information.

Employers must consider employees' expectations of privacy in the use of electronic media. In the context of litigation
relating to any of these issues, organizations must be mindful of the discoverability of electronic communications;

however, employees who have sued their employers for invasion of privacy based on e-mail monitoring generally have not
enjoyed much success.

Individual states may extend privacy protection to employees' personal use of company e-mail systems, depending on the
nature of the communication. In 2009, the New Jersey Supreme Court ruled, in Stengart v. Loving Care Agency Inc., 990
A.2d 650 (2010), that an employee could reasonably expect that e-mail communication with her lawyer through her

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 4 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

personal, password-protected, web-based e-mail account would remain private, even though she used a company laptop
to send and receive those messages. The court found that the use of the company computer did not remove the

protection of the attorney-client privilege and that her employer's legal counsel had violated the rules of professional
conduct by reading her e-mails. Further, the court said that no policy concerning the employer's right to retrieve and read
personal communications through company computers could overcome the employee's expectation of privacy to defeat
the attorney-client privilege.

Monitoring Internet Use

Some observers have argued that the ECPA's electronic monitoring restrictions do not apply to Internet use because
viewing websites does not involve a "communication." However, employers should not risk running afoul of that law when
the safest route is to establish and implement a clear policy governing appropriate workplace Internet use, expressly
reserving the right to monitor such use without further notice. In addition to this separate monitoring policy, companies
should incorporate prohibited Internet use into their sexual harassment and equal employment opportunity policies.

Beyond that, employers have at their disposal a plethora of filtering and blocking devices designed to restrict access to
inappropriate Internet sources.

Some states have imposed an obligation on employers requiring information technology workers to report the discovery
of child pornography on company computers to law enforcement officials.

Several states have enacted legislation. In a 2005 New Jersey case, the state appellate court held that an employer on
notice that an employee was using a company computer to access child pornography had a duty to investigate the
employee's activities and take "prompt and effective action to stop the unauthorized activity." The employer had a duty to
report to law enforcement the viewing of websites that possibly contained child pornography, the court said, and an
employer could be held liable to the victims for the failure to do so. See What Employers Need to Know About the Dark
Web (www.shrm.org/resourcesandtools/hr-topics/technology/pages/employers-need-to-know-about-dark-web.aspx).

Video Monitoring/Surveillance

Video surveillance is a common technique employers use to monitor employee activities in the workplace. Many
employers use video surveillance to minimize employee misconduct. Video monitoring can also provide evidence of a
crime if one were to occur at the worksite. Employers must consider the state laws for the state in which the surveillance
occurs, whether the surveillance area is a public or private area, whether sound is captured in addition to the visual
monitoring, and whether the camera is in open view or hidden. Employers should not use video surveillance in areas
where employees have an expectation of privacy. See Surveillance: Cameras in the Workplace
(www.shrm.org/ResourcesAndTools/tools-and-samples/policies/Pages/cms_015088.aspx).

Some suggestions to avoid legal challenges in employee monitoring from Employer's Guide to Workplace Privacy (Aspen
Publishing, 2004) by Amy L. Greenspan include:

Use video surveillance only when justified by a legitimate business purpose (e.g., preventing theft or workplace
violence, investigating illegal or improper conduct, monitoring employee performance).

Limit video surveillance to the least intrusive time, place and method that will serve the business purpose.
Use only visible cameras or inform employees in writing that hidden cameras may be used.
Obtain written employee consent to video surveillance for legitimate business purposes.
Do not use video surveillance in areas where employees have a reasonable expectation of

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 5 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

privacy (e.g., bathrooms, locker rooms, dressing rooms, lounges, employees' homes, or other places outside the
workplace where employees are not in public view).

Do not use video surveillance devices that capture or record sound without complying with federal and state
wiretap and recording laws.
If the workplace is unionized, comply with any provisions in the collective bargaining agreement concerning video
surveillance; if there are no such provisions, negotiate with the union before implementing video surveillance.
Do not use video surveillance in connection with union activities (or other "concerted activity" by employees
concerning terms or conditions of employment).
Do not select employees for video surveillance in a manner that might be considered discriminatory under federal
or state discrimination laws (e.g., do not videotape only women or only Muslims or only people with disabilities).
Do not select employees for video surveillance in retaliation for exercising rights under any law.

Understand and comply with state or local laws dealing with video surveillance.
Train supervisors in the legal issues involved in video surveillance.
Treat information obtained through video surveillance as confidential, and limit access to video recordings to
security personnel or management personnel with a need to know.
Adopt procedural safeguards to avoid unintended or improper use of work-related video recordings.

Monitoring Location of Employees

Location monitoring involves employers checking the location and movements of employees using the Global Positioning
System (GPS), which was originally designed by the military. The system uses satellites to transmit signals to GPS receivers
on the ground that can pinpoint location. Employee locations can be determined within company buildings and along city
streets and highways. The speed with which employees move in their cars and trucks can also be determined. Employers
can use these technologies to help increase productivity and provide a more secure and safe workplace.

While the ECPA excludes "any communication from a tracking device" and won't likely apply to GPS tracking, state right-to-
privacy laws need to be considered. As in most privacy issues, a notice to employees that a GPS device may monitor them
while working greatly reduces an employee's ability to claim that he or she had a reasonable expectation of privacy and to
prevail in a claim.

Additionally, using GPS in an employee-owned vehicle runs the risk of common-law action for trespass and violating state
restrictions with monitoring off-duty employee conduct. Using location tracking in employer-owned vehicles would reduce
that risk, especially when policies address how monitoring will be handled for work breaks, and if the employee regularly
takes the vehicle home, how any nonworking hours will be monitored, if at all.

See Monitoring Employee Productivity: Proceed with Caution (www.shrm.org/hr-today/news/hr-magazine/pages/0615-

employee-monitoring.aspx) and How Will Workplace GPS Tracking and Biometric Data Collection Trends Affect HR?

(www.shrm.org/resourcesandtools/legal-and-compliance/state-and-local-updates/pages/workplace-gps-tracking-biometric-
data-collection.aspx)

Monitoring Off-Duty Conduct of Employees

Issues also abound when considering the employer's right to investigate or take adverse employment action in response
to an employee's off-duty conduct. Does the GPS in the employee's personal vehicle show that he or she goes to a bar
each night and stays late? Or that he or she is moonlighting with another employer? Will such knowledge adversely affect

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 6 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

the employee, causing him or her to sue under privacy laws?

As with other forms of monitoring, whether such monitoring is appropriate depends on whether the employer can

demonstrate good faith and a legitimate business reason for taking such action. See Monitoring Employees: How Far Can
You Go? (www.shrm.org/ResourcesAndTools/hr-topics/risk-management/Pages/Monitoring-Employees-GPS.aspx) and Can
Employees Be Fired for Off-Duty Conduct? (www.shrm.org/resourcesandtools/legal-and-compliance/state-and-local-
updates/pages/can-employees-be-fired-for-off-duty-conduct.aspx)

Employee Searches

Workplace-based searches raise a variety of questions and have numerous implications. What is to be searched on a
person or property? Whose property and why? Who will conduct the search? Is it a private or public employer? The
answers to these questions, along with additional considerations, determine the best way to proceed in any given
situation.

Public-sector employees

The Fourth Amendment to the U.S. Constitution guarantees that "the right of the people to be secure in their persons,
houses, papers, and effects against unreasonable searches and seizures, shall not be violated," thereby protecting the

privacy rights of U.S. citizens, including federal government employees. Those provisions are extended to state and local
governments through the Fourteenth Amendment. The constitutional right to privacy derived from the Fourth and
Fourteenth amendments does not apply to employees in the private sector.

While public employees can still be subjected to workplace searches, the scope of the search will be narrower than what
would be allowed in the private sector. Searches tend to be limited in scope and purpose, often arise from evidence of
misconduct, or are conducted in areas of diminished privacy expectations, such as searching a private office where
records are accessed frequently by others.

Private-sector employees

Private employers have more leeway in conducting searches of employees, although workplace privacy rights do exist
under both common and state law.

Several states have passed legislation granting specific privacy rights to employees and placing obligations on employers,

especially with regard to electronic monitoring. So, when may a private employer properly conduct a workplace search?
Answering this question is tied closely to whether the employee had a reasonable expectation of privacy for the item (e.g.,
locker, purse) that was searched and whether the employer had a legitimate business reason for conducting the search.
Consider, for example, an employee who is provided with a locker at work, is permitted to use his or her own lock and is
not required to provide the combination to that lock to his or her employer. There is no company policy regarding
searches. Does the employer violate the employee's privacy when it breaks the lock and searches the employee's locker
without his or her consent? One Texas jury answered "yes" to the tune of a $100,000 award to the employee.

Establishing a Companywide Policy

For their best protection, employers should establish and disseminate to employees a clear written policy that employee
e-mails, Internet use, telephone calls and company-owned vehicles are subject to monitoring, without any further warning.

Policy specifications

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 7 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

Even with a monitoring policy in place, an employer should expressly state that it is not obligated to monitor employee
communications. Otherwise, employees may claim that the organization failed to protect them if harmful or offensive

conduct occurs and the employer fails to catch it through monitoring.

Employers should consider the following key provisions when developing a companywide monitoring policy:

Specify what is governed by the monitoring policy (e.g., electronic communications, telephones, company
property and premises, etc.) and inform employees that monitoring and searches can occur at any time, for any
reason, with or without any further notice.
Establish that the organization's computer and telephone systems and other equipment are the property of the
employer, and employees should not maintain any expectation of privacy while using them or personal property to
conduct company business.
Specify that the organization's computers, telephones and other equipment generally are intended for business-
related use with a limited amount of personal use being acceptable.

Prohibit the transmittal or downloading of material that is offensive, pornographic, obscene, profane,
discriminatory, harassing, insulting, derogatory or otherwise unlawful.
Prohibit the transmittal or dissemination of the company's confidential information or trade secrets to any outside
source.
Explain to employees that all communications and files are subject to employer monitoring and that the employer
has access to all such files, even those files that the employee has deleted from the system.
Inform employees that any unauthorized use of the company's information systems can result in discipline, up to
and including termination.
Implement any disciplinary action taken pursuant to this policy fairly and consistently to avoid claims of
discrimination.

Require all new hires to sign a written acknowledgment that they have read and understand the policy and they
agree to abide by its terms as a condition of employment with the company. In addition, it is a good idea to
require employees to reaffirm their understanding of the policy at regular intervals.

Global Issues

For multinational organizations, employee privacy can be highly regulated, making employee monitoring much more
difficult to conduct legally. For example, e-mails are electronic communications that contain employee data and, therefore,
are subject to a host of international laws depending on the location of the workers involved. It is therefore recommended
to seek legal counsel before implementing any employee monitoring when communications cross international lines.

See

Israel Regulates Use of Cameras Installed in the Workplace (www.shrm.org/resourcesandtools/legal-and-

compliance/employment-law/pages/israel-workplace-cameras.aspx)

EU Covert Surveillance at Work Prohibited (www.shrm.org/resourcesandtools/legal-and-compliance/employment-

law/pages/global-eu-covert-surveillance-prohibited.aspx)

Germany: Employee Monitoring Ruled Unlawful (www.shrm.org/resourcesandtools/legal-and-compliance/employment-

law/pages/germany-employee-monitoring-unlawful.aspx)

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 8 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

Australia: Debate Over Use of Surveillance Shifts in Employers' Favor (www.shrm.org/resourcesandtools/legal-and-

compliance/employment-law/pages/global-australia-surveillance.aspx)

EU Court: Employee E-mail Monitoring May Not Breach Privacy Rights (www.shrm.org/ResourcesAndTools/hr-topics/global-
hr/Pages/EU-privacy.aspx)

Templates and Tools

Electronic Communication Policy Acknowledgement (www.shrm.org/ResourcesAndTools/tools-and-samples/hr-

forms/Pages/cms_002095.aspx)

Workplace Monitoring and Surveillance Policy Acknowledgement (www.shrm.org/ResourcesAndTools/tools-and-

samples/hr-forms/Pages/workplacesurveillancemonitoringconsentform.aspx)

Expectations of Privacy Policy (www.shrm.org/ResourcesAndTools/tools-and-

samples/policies/Pages/personalpropertyprivacy.aspx)

Telephone Monitoring Policy (www.shrm.org/ResourcesAndTools/tools-and-samples/policies/Pages/cms_000638.aspx)

Use of Company Property Policy (www.shrm.org/ResourcesAndTools/tools-and-

samples/policies/Pages/cms_000558.aspx)

HR DAILY
NEWSLETTER
Email Address
News, trends and analysis, as well as
breaking news alerts, to help HR
professionals do their jobs better each SUBSCRIBE
business day.

CONTACT US (WWW.SHRM.ORG/ABOUT-SHRM/PAGES/CONTACT-US.ASPX) |
800.283.SHRM (7476)

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 9 of 10
Managing Workplace Monitoring and Surveillance 26.09.2021, 18:45

© 2021 SHRM. All Rights Reserved

SHRM provides content as a service to its readers and members. It does not offer legal advice, and cannot guarantee the accuracy or
suitability of its content for a particular purpose.
Disclaimer (www.shrm.org/about-shrm/Pages/Terms-of-Use.aspx#Disclaimer)

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/workplaceprivacy.aspx Page 10 of 10