Workplace Monitoring: What’s Allowed, What’s Off Limits?

Employers may want to monitor employee communications and activities to help promote a safe, secure and productive work environment. However, several laws, such as the Electronic Communications Privacy Act (ECPA) and the National Labor Relations Act (NLRA), govern whether and how you can monitor phone calls and computer use, or when you may conduct video surveillance. Below, we cover some workplace privacy rules and best practices.

What is the ECPA?

The ECPA is a federal law that protects email, phone conversations, and data stored electronically while those communications are being made, are in transit, and when they are stored on computers. The law generally restricts the interception and monitoring of oral, wire and electronic communications, unless certain conditions, such as a legitimate business purpose and an employee's consent to monitor, are met.

State laws on workplace monitoring

In addition to the ECPA, several states have their own laws governing workplace monitoring. For example, New York requires private employers that monitor electronic communications to provide advance written notice on the types of electronic monitoring that may occur. Employees must acknowledge the notice, in writing or electronically, and employers should retain the acknowledgment to demonstrate compliance with the law.

Your employees may have additional rights under state law that may be triggered by electronic monitoring, such as keystroke trackers. For example. California recently expanded employers' obligations when it comes to collecting personal data belonging to their employees. Under the law (the California Privacy Rights Act), employees have the right to know about such activities, including how the data will be used, the right to opt out of the sale of their personal data, and certain other rights. The California Privacy Rights Act applies to organizations with at least one employee in California and who had over $25 million in revenue globally in the previous calendar year. 

Court rulings on common laws relating to the right to privacy may also impact how and whether workplace monitoring is allowed. Consult legal counsel to help determine the rules that apply to you.

Phone calls

Under the ECPA, employers must generally obtain consent from at least one of the parties to the communication before monitoring and recording company phone calls. However, several states require consent from all parties. For example, if the employer wishes to record on company equipment phone conversations between customer service representatives and clients, certain states require the employer to obtain consent from both the service representatives and clients.

Before instituting a phone call monitoring program, check your state law and keep in mind the consent requirements of the other states where parties to the call may be located during the conversation. Consult legal counsel to ensure you are complying with all relevant laws.

Computer use

For valid business purposes, employers may monitor employees' use of company-owned electronic communication systems. To help manage privacy expectations, communicate a written policy that explains that the purpose of monitoring is to gather information for legitimate business reasons. Additionally, inform employees they should have no expectation of privacy when using company-issued mobile devices and company-owned computers, email, or the internet (including Wi-Fi, if applicable).

Video surveillance

Employers generally have the right to conduct video surveillance in certain work areas for legitimate business purposes, provided they notify employees and visitors of the surveillance. Typically, this is done by posting a sign in a conspicuous location. Additionally, cameras should be visible to anyone who enters the area.

Some states have restrictions on video surveillance, such as prohibiting employers from recording audio and limiting where video surveillance may be conducted. Regardless of the state, employers should not install video surveillance in places where there is a reasonable expectation of privacy, such as restrooms, locker rooms or dressing rooms. Check your state's workplace privacy laws to ensure compliance.

NLRA-related activities

Under the National Labor Relations Act (NLRA), employees have the right to work together to improve wages or other terms and conditions of employment (with or without a union). Employers are prohibited from using workplace monitoring to interfere, restrain or intimidate employees who are exercising their rights protected by the law. For example, videotaping employees engaging in protected activity or setting up surveillance in break areas may violate the law.

Social media

Several states prohibit employers from asking employees or applicants for their log-in credentials to personal social media accounts. Some also expressly prohibit employers from requiring employees to log into their personal social media accounts in the employer's presence and/or requiring employees to "friend" their supervisor. Even in states that don't expressly prohibit these activities, it's a best practice to avoid requesting access to personal social media accounts.

Employee use of personal devices

Many employers allow employees to use their own mobile devices to perform work. Provided the employer complies with federal and state notice and consent requirements, the employer generally has the right to monitor work-related activities (such as work email) during work hours on such devices. These employers should make this clear in the notice and consent form. They should also implement safeguards to avoid monitoring employees during off-duty time.

With mobile devices now found everywhere, one of the challenges employers sometimes face is employees using their personal devices to record video and audio or to take photos in the workplace. Depending on the circumstances, this activity could be prohibited by several laws, including the ECPA and/or state law. While it may be tempting to implement a blanket ban on employees taking photos or recording in the workplace, employers should exercise caution and consult legal counsel when drafting policies. Overly broad restrictions may run the risk of infringing on employees' rights to engage in protected activity, such as the right to oppose discrimination and harassment or the right to work together to improve working conditions.

Oversight

If you conduct workplace monitoring, implement safeguards and training to prevent unauthorized access to employee activity logs and surveillance. Records should be kept in a secure location that is only accessible by authorized personnel. Maintain a log of the individuals that access electronic monitoring records along with the date and time in which they are accessed.

Conclusion

When conducting workplace monitoring, comply with federal and state laws and aim to strike a balance between business goals and employees' privacy rights.