This article describes general positions in several jurisdictions in order to show what the recurring questions are. It is not legal advice, rules change, and the applicable law is the one where the people being monitored are, which is frequently not where the company is.
The recurring test
Regimes differ in structure and converge on one question: is this monitoring proportionate to a purpose that has been written down?
Purpose first, then the least intrusive means that achieves it, then transparency about what is happening. A deployment that cannot state its purpose in a sentence fails the test everywhere, regardless of which statute applies.
The European approach
Under the European regime and its United Kingdom counterpart, personal data requires a lawful basis, and monitoring employees is processing personal data throughout.
The point that surprises employers most is that consent is a weak basis at work. European data protection authorities have taken the position that consent given by an employee is rarely freely given, because the relationship is unequal and refusal carries consequences. A signature on an onboarding form is therefore not the protection it looks like, and the usual basis is a legitimate interest that has been assessed and documented against the rights of the people affected.
Systematic monitoring generally triggers a formal assessment before deployment rather than after. Transparency obligations require telling people what is collected, why, on what basis and for how long, in terms they can understand. Where decisions with significant effects are made by automated means, additional constraints apply.
Two further features catch companies out. In several countries, worker representative bodies have genuine decision rights over the introduction of monitoring technology, which means the works council is not a stakeholder to inform but a party whose agreement is required. And the European Court of Human Rights has addressed workplace monitoring directly, establishing that private life extends into the workplace and that employers must weigh proportionality and give prior notice; the leading judgments are worth reading rather than paraphrasing.
The United States, which is several answers
There is no single federal statute governing workplace monitoring. Federal law addresses interception of communications with exceptions that employers commonly rely on, and the substantive requirements arrive at state level, where they differ.
Several states require written notice of electronic monitoring, one of them requiring it at hiring, with the obligation applying to essentially all private employers in that state. Recording of audio is governed by separate state rules on how many parties must consent, and those rules are the reason a call recording policy legal in one state is not in another. At least one state's consumer privacy statute now extends individual rights to employees, which brings access and deletion requests into scope.
The practical consequence for any company with remote staff is that the analysis is per state, not per company.
Canada
Federal and provincial privacy statutes apply depending on sector and province, and the recurring standard is reasonableness in the circumstances. One province requires employers above a size threshold to have a written policy on electronic monitoring and to give it to employees, which is a disclosure obligation rather than a restriction on monitoring itself, and it has the useful effect of forcing the purpose to be written down.
What good practice looks like under all of them
Write the purpose before choosing a product, because the product will otherwise define the purpose.
Choose the least intrusive capture that serves it. The ladder in the previous article is the relevant scale, and most stated purposes are served several rungs below where deployments land.
Tell people plainly: what is collected, when it runs, what it is used for, who can see it, how long it is kept. Notice at hiring and again whenever the configuration changes materially.
Give people access to their own data, which most regimes require in some form and which independently improves the data, since a person who can see a misclassification will report it.
Document the assessment. In a dispute, the record of having weighed proportionality is the difference between a defensible decision and an assertion.
The limit of this article
We describe obligations. We do not describe how to work around them, how to monitor without notice where notice is required, or how to structure a deployment to avoid a jurisdiction's rules. That applies however the question is framed.
What we cannot verify
Everything above is a general summary of moving law across several jurisdictions, simplified to show structure, and it will be out of date at some point after publication. Sector-specific rules, collective agreements and contractual terms can impose stricter requirements than the statute. Nothing here is advice, no specific deployment can be judged from it, and the competent source is a lawyer instructed on the actual facts in the actual places.
The short version
- The recurring test everywhere is proportionality to a written-down purpose.
- In Europe, consent from an employee is a weak basis because refusal has consequences.
- Systematic monitoring generally requires an assessment before deployment, not after.
- In some countries worker representatives hold decision rights, not just consultation.
- In the United States the analysis is per state, and remote staff make that several states.
- Write the purpose before choosing a product, or the product defines the purpose.