Do we have the right to privacy and can we enjoy it as a right especially regarding our personal data when we are at our workplace? This is the fundamental question that we will be discussing here, from the perspective of the General Data Protection Regulation also known as #gdpr . 

Coming to the next important question as to what will come under the ambit of personal data?    

A personal data will include all the sensitive categories of data that are related to an identifiable natural person. The following are some examples of personal data- 

• Physical or mental health condition; 
• Sex life and sexual orientation; 
• Racial or ethnic origin; 
• Political opinions, religious beliefs; 
• Trade union membership; 
• Biometric data. 

When it comes to monitoring employees, businesses and organizations are not new to this concept, rather the concept of surveillance is decades old. In order to understand and analyze this question, it is important to first understand the employee-employer relation. Since, it is an undisputed fact that there will always remain an imbalance of power between the two, which is why the concept of consent cannot be a relevant ground on claiming that such monitoring was genuine or not arbitrary. 

How is monitoring done on employees? 

Monitoring of employees can be done easily through CCTVs, software-cum-spyware. But what exactly will constitute ‘monitoring’? It can be monitoring an employee’s internet history, emails, financial transactions, call logs, his private chats with employees and/or with other people.  

Monitoring of employees: Post-GDPR 

After May 25th, 2018, all the organizations and businesses had no choice but to comply with the GDPR requirements. If we talk about monitoring the employees through their consent, it will not be considered valid as discussed earlier that there will always remain an imbalance of power between an employee and an employer, hence claiming it valid will not be appropriate because of reasons such as- An employee working under the control and supervision of their employer will always be under a constant fear of losing their job.  

But it is quite surprising that the GDPR doesn’t expressly state anything regarding the monitoring of employees by an organization as ‘Illegal’. Instead, the GDPR mandates that collection, processing, and transfer of personal data should be done in consonance and in harmony with the 7 principles of the GDPR. 

The principles of the GDPR are as follows- 

1. Transparency, fairness and lawfulness 
2. Purpose limitation 
3. Data minimization 
4. Accuracy 
5. Storage limitation 
6. Security, integrity & confidentiality 
7. Accountability 

The GDPR further mandates as per Article 35 that any type of data processing activity which involves ‘high risk’ to the data subjects (employees in this case), the controller (employer in this case), prior to such processing, will have to conduct a Data Protection Impact Assessment (DPIA).  

After the implementation of the GDPR, now organizations and businesses cannot rely on implied consent in order to justify arbitrary and excessive monitoring. GDPR invalidates such consent where there is an unequal or imbalance of power in a relationship. 

Organizations and businesses will have to rely on- 

1. Legal requirement- Where the processing of data is mandated in order to comply with some regulations. 
2. Legitimate interests- This means that private-sector businesses and organizations have legitimate or genuine interest with respect to their employees’ data provided that such processing doesn’t cause harm to the employees and respects their privacy rights. That is why GDPR mandates organizations to conduct a DPIA in order to assess potential risks. 

Conclusion 

Hence, it is clear that monitoring of the employees in itself is not illegal provided that the businesses comply with the GDPR requirements. Organizations and businesses in the private sector need to keep this in mind and must ensure that if they are monitoring and processing the personal data of their employees, then it must be in accordance with the core principles of the GDPR as discussed above, failing to do so can lead to fines up to €20 million or 4% of their annual global turnover, whichever is higher (for severe violations). Whereas, for less severe violations, fines can go up to €10 million or 2% of their annual global turnover, whichever is higher.