Can we use covert monitoring?

Covert monitoring means carrying out monitoring in a way designed to ensure workers are unaware that it is taking place. It is unlikely that you would need to consider it as an option in most usual circumstances. There may, however, be exceptional circumstances where you would consider this. An example is where covert monitoring is necessary to enable the prevention or detection of suspected criminal activity or gross misconduct.

You should outline in your organisational policies the types of behaviours which are not acceptable and the circumstances in which covert monitoring might take place.

If you are considering monitoring workers covertly:

• This should only be authorised by the highest authority in your workplace. • You must carry out a DPIA. • You must be satisfied that there are grounds for suspecting criminal activity (or an equivalent, such as gross misconduct) and that informing workers about the monitoring would prejudice its prevention or detection. • The covert monitoring must be strictly targeted at obtaining evidence within a set timeframe which should be limited to the shortest time possible. • The covert monitoring must not continue after the investigation is complete. • You must not use covert audio or video monitoring in areas where workers would reasonably expect to be private, such as toilets or changing rooms. • You must not use covert monitoring to capture communications that workers would reasonably expect to be private, such as personal emails. • If you are considering using a private investigator to collect information on workers covertly, you must ensure there is a contract in place that requires them to only collect information in a way that satisfies your obligations under data protection legislation. See our guidance on controllers and processors for further detail. • You must only use information gathering through covert monitoring for the purpose intended. Disregard and destroy any other information unless it reveals something that no employer could reasonably be expected to ignore where there is no other way to achieve this purpose. • Limit the number of people involved in the investigation to only those who really need to be involved. • Set clear rules limiting disclosure and access to the information collected. • Remember workers’ individual rights. For example, if a worker submits an access request, you may have to disclose the monitoring information.

There are some exemptions, but these are not blanket. Requests must be dealt with on a case-by-case basis. Read our guidance on individual rights and subject access requests for further details.