PHR2006 - Privacy Topics - Workplace Privacy
Total Page:16
File Type:pdf, Size:1020Kb
PHR2006 - Privacy Topics - Workplace Privacy Privacy International PHR2006 - Privacy Topics - Workplace Privacy 18/12/2007 Workplace Privacy Workers around the world are frequently subject to some kind of monitoring by their employers. [1] Employers supervise work processes for quality control and performance purposes. They collect personal information from employees for a variety of reasons, such as health care, tax, and background checks. Traditionally, this monitoring and information gathering in the workplace involved some form of human intervention and either the consent, or at least the knowledge, of employees. The changing structure and nature of the workplace, however, has led to more invasive and often covert monitoring practices which call into question employees' most basic right to privacy and dignity within the workplace. Progress in technology has facilitated an increasing level of automated surveillance. Now the supervision of employee performance, behavior, and communications can be carried out by technological means, with increased ease and efficiency. The technology currently being developed is extremely powerful and can extend to every aspect of a worker's life. Software programs can record keystrokes on computers and monitor exact screen images, telephone management systems can analyze the pattern of telephone use and the destination of calls, and miniature cameras and "Smart" ID badges can monitor an employee's behavior, movements, and even physical orientation. Advances in science have also pushed the boundaries of what personal details and information an employer can acquire from an employee. Psychological tests, general intelligence tests, performance tests, personality tests, honesty and background checks, drug tests, and medical tests are routinely used in workplace recruitment and evaluation methods. Since the discovery of DNA there has also been an increased use of genetic testing, allowing employers to access the most intimate details of a person's body in order to predict susceptibility to diseases, medical, or even behavioral conditions. The completion of the Human Genome Project has made this testing more prevalent. Currently, genetic testing is prohibitively expensive for many employers, and not used as frequently as other forms of medical or drug testing.[2] Article 21 of the European Union Charter of Fundamental Rights provides explicitly that "any discrimination based on . genetic features . shall be prohibited."[3] Employers' collection of personal information and use of surveillance technology is often justified on the grounds of health and safety, customer relations, or legal obligation. However, according to a recent study by the Privacy Foundation, it is actually the low cost of surveillance http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-559090 (1 of 15) [4/29/2009 8:23:47 PM] PHR2006 - Privacy Topics - Workplace Privacy technologies more than anything else that contributes to the increased monitoring.[4] In many cases, workplace monitoring can seriously compromise the privacy and dignity of employees. Surveillance techniques can be used to harass, to discriminate, and to create unhealthy dynamics in the workplace. Legal Background Privacy advocates have long maintained that providing notice of a monitoring or surveillance policy should, at a bare minimum, be required before employers can engage in such invasive activities. Advocates support strong privacy principles in the workplace such as the International Labor Office's "Code of Practice on the Protection of Workers' Personal Data," which protects employees' personal data and fundamental right to privacy in the technological era.[5] These guidelines were issued by the International Labor Office in 1997, following three comprehensive studies on international workers' privacy laws.[6] The general principles of the code are: ● personal data should be used lawfully and fairly; only for reasons directly relevant to the employment of the worker and only for the purposes for which they were originally collected; ● employers should not collect sensitive personal data (e.g., concerning a worker's sex life; political, religious, or other beliefs; or trade union membership or criminal convictions) unless that information is directly relevant to an employment decision and is collected in conformity with national legislation; ● polygraphs, truth-verification equipment or any other similar testing procedure should not be used; ● medical data should only be collected in conformity with national legislation and principles of medical confidentiality; genetic screening should be prohibited or limited to cases explicitly authorized by national legislation; and drug testing should only be undertaken in conformity with national law and practice or international standards; ● workers should be informed in advance of any monitoring, and any data collected by such monitoring should not be the only factors in evaluating performance; ● employers should ensure the security of personal data against loss, unauthorized access, use, alteration or disclosure; and ● employees should be informed regularly of any data held about them and be given access to that data.[7] The code does not form international law and is not of binding effect. It was intended to be used "in the development of legislation, regulations, collective agreements, work rules, policies and practical measures."[8] Unfortunately, however, the laws differ greatly from country to country, and in some countries there are few legal constraints on workplace surveillance. In the United States, for example, there remains a lack of a uniform determination as to the level of privacy employees are entitled to and how that privacy should be protected. Many believe that since employers have ownership or "control" over the working premises, and its contents and facilities, that employees give up all rights and expectations to privacy and freedom from invasion.[9] Others simply avoid the question by making employees consent to surveillance, monitoring, and testing as a condition of employment.[10] Several laws protect US public sector employees. The Fourth Amendment applies not only to law enforcement officers, but to government officials and employers as well. A constitutional right to http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-559090 (2 of 15) [4/29/2009 8:23:47 PM] PHR2006 - Privacy Topics - Workplace Privacy information privacy, recognized in Whalen v. Roe,[11] can protect against employer disclosures of employees' personal information. Other laws which may protect the privacy of public employees include relevant state constitutional provisions, federal and state wiretap laws, the Americans with Disabilities Act (ADA), the federal Privacy Act, and the common law privacy torts. In addition, depending on the type of employment contract governing the work agreement, public employees may have recourse under contractual remedies. However, most employment agreements are considered "at will," which means that employees may be dismissed for any or no reason, provided sufficient notice is given. One exception to this general rule is that employees may not be dismissed for a reason that violates public policy, such as for not complying with a privacy-invasive procedure. Should this occur, employees can sue for wrongful termination in violation of public policy. US private sector employees have some, but not all, of the protections afforded public sector employees. The Fourth Amendment and many state constitutions do not apply to private employers. However, the federal wiretap law applies to both public and private sector employers. Private sector employees may also establish recourse for invasions of privacy under the ADA, breach of contract theories, and privacy torts. Internationally, regulations governing the compilation and use of employees' personal data vary significantly.[12] In European countries, the EU Data Protection and the Telecommunication Privacy Directives protect the collection and processing of personal information.[13] That last Directive, however, provides for the confidentiality of communications for "public" systems and therefore would not cover privately owned systems in the workplace.[14] However, the principles laid out in these directives are general in scope and their application to workplace privacy issues is not always clear. Nonetheless, many European countries have strong labor codes and privacy laws that directly or indirectly prohibit or restrict this kind of surveillance.[15] The constitutions of Belgium, Finland, Germany, Greece, the Netherlands and Spain contain a general right to protection of privacy in private life. Denmark and Sweden have explicit constitutional rights to privacy protection related to electronic data processing.[16] In Finland, a new law on Data Protection in Working Life entered into force in October 2004. The new law includes the prohibition of routine drug tests, restrictions on the right to video surveillance, and the guarantee of limited e-mail privacy for workers.[17] Belgium has a national collective agreement that protects employee online privacy. [18] In June 2005, the United Kingdom Privacy Commissioner issued "The Employment Practices Data Protection Code," a practice guide for employer/employee relationships.[19] One significant provision requires that any sickness and accident records, detailing the medical cause of any absence be maintained separately from medical records that do not reveal