With millions of American employees working remotely due to the coronavirus pandemic, employers are increasingly turning to monitoring software and other forms of surveillance to keep tabs on worker productivity. The idea of your employer peering over your shoulder while you work in your own home might seem disconcerting. But is it legal?
What Are Your Rights When Working From Home?
As a general rule, if you're using your employer's equipment while on your employer's network, your employer has the right to monitor everything you do, whether you're working remotely or in the workplace. Because your employer is providing the communications technology, they have the right to track your activities. This includes your internet browsing, how you are using your computer [including the number of keystrokes and the actual words you type], what you store on your computer, and the contents of your work email.
For many employees, working from home can mean a greater tendency to intermingle work and personal devices or networks. This can open an employee up to more employer monitoring of non-work activities. For example, if you're viewing your personal email account on your work computer, your employer can likely monitor your personal email. Similarly, if you're using a personal device, but are logged on to a work network, your employer can track your activity on that device. And if you're conducting personal business on a company-provided cell phone, your employer can monitor everything on the phone, including text messages, call logs, and photos.
On the other hand, if you're using your own device and your own internet connection, it's much less likely that your employer has the right—or the ability—to track what you do. You can help ensure the privacy of your personal communications by keeping your personal devices and networks separate from your work devices and networks.
From a privacy perspective, one difference between working from home and working in an office is that remote workers typically are not using a company phone network, so employers can't monitor their phone calls. In an office environment where employees use landlines, your employer can record or monitor calls on your work phone for quality control purposes, as long as they stop listening in as soon as they realize that a call is personal. But your employer generally doesn't have the ability to listen in on your calls when you're working from home.
Regardless of whether you're working remotely or in the workplace, the law doesn't provide much privacy protection for employees, but there are some limits on how far an employer can go.
Federal Privacy Laws in the Workplace
There are two federal laws governing invasion of privacy that are potentially applicable to the workplace: The Fourth Amendment to the U.S. Constitution, which prohibits unreasonable searches and seizures, and the Electronic Communications Privacy Act [ECPA], which bans third parties from intercepting or disclosing electronic communications without prior authorization.
However, the Fourth Amendment only applies to government actors—not private employers. So unless you're a government employee, the Fourth Amendment doesn't protect your privacy in the workplace. [And even if you're a government employee, the law still permits "reasonable" searches.]
The ECPA was designed primarily to modernize laws on government wiretapping by adding restrictions on electronic surveillance. Although it doesn't specifically exempt private employers, it contains three exceptions that are generally interpreted to have the same effect. The ECPA's prohibition on intercepting electronic communications doesn't apply if:
- there is a legitimate business reason for monitoring your communications
- you have consented to allowing your communications to be monitored, or
- the information being monitored is stored on the networks or equipment of the entity doing the monitoring.
Practically speaking, this means that the ECPA doesn't provide much privacy protection to employees. Most employers fall within at least one of these exceptions, if not all three: They are providing the communications service, there is a legitimate business reason for the monitoring, and their employees have consented to be monitored [often by signing an employment agreement or privacy policy].
The ECPA does provide some privacy protection with respect to telephone conversations. Under the ECPA, employers typically must obtain consent from at least one of the parties before monitoring and recording a company phone call. They also must stop monitoring when they realize that a call is personal in nature.
State Laws Governing Workplace Privacy
Some states have passed laws that make it harder for employers to monitor their employees. For example, California, Florida, and Maryland have laws that require everyone involved in an electronic communication or telephone call to consent to the monitoring. And a few states, such as Connecticut and Delaware, require employers to give notice to employees before monitoring can take place.
Some state constitutions include a right to privacy, and some states also have general invasion of privacy laws. Courts interpreting these laws will typically weigh the reasonableness of the employee's expectation of privacy against the business interest of the employer in monitoring the communication. But for the most part, state courts have found that employers do have a legitimate business interest in monitoring their employees' communications.
Contact an Attorney
If you think your employer has illegally violated your privacy while you are working remotely, contact an experienced employment lawyer to explore your legal options.
©daviles - stock.adobe.com
When working from home, there may be a new concern for workers other than going without pants.
To ensure employees do what they’re supposed to, some employers have begun using surveillance apps and programs to monitor worker productivity.
This has raised some worker privacy concerns and the questions of whether this is legal or proper.
The short answer is that yes, it can be legal if done right. As for whether it’s proper or not, that’s up to debate. In this article, I’ll discuss what can or cannot be done when it comes to employers remotely supervising their employees.
Why Would an Employer Want to Monitor an Employee?
Traditionally, there have been five primary reasons why employers seek to watch or monitor employees.
First, the employer may want to protect itself in the case of possible lawsuits. This can include documenting what a worker does in case litigation, or an internal investigation ensues.
Second, the employer may want to maintain the integrity of its hardware and software from malicious cyber activity. Social media and rogue cloud accounts can be sources of harmful software, including viruses and malware.
Third, the employer might seek to protect intellectual property, such as trade secrets or client lists.
Fourth, all employers want to make sure workers do what they’re supposed to do. This means not downloading pornographic material or engaging in any activities that the employer might have a particular reason to discourage.
Finally, we have the employer who wants to ensure productivity levels. This is likely one of the biggest reasons employers monitor their employees, especially with the rise in the number of people working from home.
How Do Employers Monitor Their Employees?
Employers have been monitoring employees since the dawn of the employer-employee relationship. In the Internet age, with the ubiquity of laptops, tablets and smartphones, what the employer can do has gone up a notch.
Depending on the device and motivation of the employer, employees can expect employers to monitor them by:
- Keeping track of what they type
- Recording Internet activity
- Taking screenshots
- Using a device’s webcam
- Noting which employees access what files and when
- Monitoring an employee’s physical location using GPS
- Measuring the employee’s productivity, such as noting a computer’s idle time or how long an app or piece of software remains open
That’s some pretty invasive stuff so it’s sometimes hard to believe that it’s mostly legal.
As a general rule, when using your employer’s equipment while on your employer’s network, your employer will have the right to monitor what you do. If you’re on your own device and using your own Internet connection, it’s less likely to be legal if your employer monitors you, although it still is often perfectly legal.
Also, it’s probably going to be legal if your employer has your permission or otherwise gives you notice of the monitoring. A good example is a company’s BOYD [bring-your-own-device] policy which will often allow employers a certain level of access to what an employee does on their personal device.
Employee Monitoring Pursuant to Federal Law
The main federal law that potentially covers employment monitoring is the Electronic Communications Privacy Act of 1986 [ECPA].
Title I of the ECPA is also known as the Wiretap Act. It makes it illegal to intentionally intercept, use, disclose or otherwise obtain any wire, oral or electronic communication.
Title II of the ECPA is more commonly referred to as the Stored Communications Act [SCA]. As the name implies, it exists to maintain the privacy of stored electronic information.
Title III of the ECPA covers pen registers and trap/trace devices. Pen registers and trap or trace devices do not record the substance of the communication, but they do record identifying information, such as the number dialed or from where a telephone call originated.
At first glance, it appears as if the ECPA would prevent some forms of employer monitoring, but the ECPA has some notable exceptions and caveats as they apply to the employment context.
First, there is the business use exception, which allows employers to monitor the oral and electronic communication of employees as long as the employer has a legitimate business reason for doing so.
Second, there is the consent exception. Employers may monitor their employees’ communication if they obtain the consent of the employee.
Third, for the most part, the SCA does not protect the privacy of stored information if the information exists on the employer’s own servers or equipment.
Fourth, the ECPA is silent as to many forms of employment monitoring, such as keystroke logging. In many respects, the ECPA is definitely behind the times due to advances in technology.
However, employees in some states may have slightly more employee privacy protections.
Employee Monitoring Pursuant to State Law
When it comes to certain types of employee activity, a few states make it more difficult for the employer to monitor employees.
For example, some states, like Maryland, Illinois and California have “all-consent” or “two-party consent” laws that require everyone involved in an electronic communication or telephone call to consent to the monitoring.
A few states require employers to give notice to employees before monitoring can take place. Connecticut and Delaware are two such states with specific laws on the books, although Connecticut’s law might not apply when the employee is working from home.
Other Laws Potentially Applicable to Employment Monitoring
The National Labor Relations Act [NLRA] protects the right of employees to collectively bargain. The National Labor Relations Board, or NLRB, enforces the NLRA and has concluded that surveillance of employees who are engaged in concerted activity can be an unfair labor practice.
There’s also attorney client privilege, which may protect an employee’s communication even if it takes place on the employer’s laptop or during work hours. How this privilege applies will be specific to the facts and jurisdiction, but the overarching principle will be an expectation of privacy.
For instance, if an employee emails her attorney from her personal web-based e-mail account using her laptop while working from home, then that’s very likely going to be protected from employer monitoring. But if that same employee were to use a work-issued laptop and her employer’s email account to send the email, then it’s far less likely for the attorney-client privilege to apply.
The Practical Realities of Employment Surveillance
Most laws, especially at the federal level, will not directly address the legality of the many different types of employment monitoring. So, the legal landscape is a little fuzzy, but regardless of what the law is, there are some principles or realities about workplace monitoring.
In many cases, much of the monitoring isn’t done in real time. It’s often just the gathering and archiving of employee behavior that will only become known if there’s a lawsuit, an internal complaint of improper behavior or poor job performance.
When overdone, employee monitoring can be bad for morale as employees won’t feel trusted and will feel micromanaged. This will be particularly true if the employee meets his or her productivity expectations when working in the office or in the home, but it’s only when working from home that the employer feels the need to snoop.
Then there’s the fact that the employee will probably feel the monitoring is unfair. They might ask themselves, “Why should everyone lose their privacy just because one or two employees acted inappropriately?” Or they might wonder why it’s not okay for them to step away from their laptop in the middle of the afternoon for 30 minutes to take care of a personal errand, but it’s perfectly okay for the boss to expect them to reply to an email late at night.
Finally, there’s the fact that workers are not robots. They won’t be working every single second of every single day, even when in the office. The practical reality is that workers will do non-work activities while on the job.
They will plan a birthday party for a co-worker, make a personal telephone call, text with family, surf the web for personal reasons and even spend a few minutes catching up on the latest office gossip. Employers who don’t accept this reality [to a reasonable extent] may find themselves with unhappy workers.
The Bottom Line
Most employers can legally monitor what you do while working as long as it’s for legitimate business purposes or they have your consent. If you decide to engage in personal activities during business hours, you will usually do so at your own risk.