Microchip implants for Employees?

Can Your Employer Monitor You When You Work from Home?

The idea of an employer implanting a microchip into its staff sounds like something from a science-fiction film: arrive at work, wave your hand at the door and hope nobody accidentally reprogrammes you during lunch.

Small electronic implants have been used voluntarily by a limited number of workers to open secure doors, access computers or replace identity cards. However, most employers do not need to place anything under an employee’s skin to monitor them. The laptop, phone, vehicle, security pass and software supplied for work can already provide a considerable amount of information.

Employers can monitor staff who work in an office, from home or while travelling, but they do not have an unrestricted right to watch everything an employee does. Monitoring must normally be necessary, justified, proportionate and carried out in accordance with data protection, privacy and employment law.

How Can an Employer Monitor Remote Workers?

Modern workplace systems can record far more than whether an employee has logged in. Depending on the equipment and software used, an employer may be able to monitor:

• Login and logout times
• Use of email and workplace messaging systems
• Websites visited through a work device or network
• Documents opened, edited, downloaded or deleted
• Files uploaded to cloud storage
• Applications used and how long they remain active
• Keyboard, mouse or screen activity
• Calls made, received or recorded
• Video meetings and attendance
• The location of phones, vehicles and other equipment
• Entry to buildings through security passes
• Productivity targets and the time taken to complete tasks

Some monitoring is routine and necessary. An employer may need security logs to prevent hacking, protect confidential information, investigate fraud or ensure that staff can access essential systems.

More intrusive monitoring, such as taking regular screenshots, recording every keystroke or continuously checking webcam activity, requires much stronger justification.

Monitoring Emails and Messages

An employer may be able to monitor messages sent through a company email account, workplace messaging platform or company-owned device. This may be done to protect confidential information, investigate misconduct, meet regulatory requirements or maintain cybersecurity.

Employers should normally tell staff that communications may be monitored, explain why monitoring takes place and describe the circumstances in which message content may be examined.

Seeing that an email was sent is less intrusive than reading its contents. Monitoring every message simply to check whether employees are working is unlikely to be justified where less intrusive methods could achieve the same purpose.

Employees should not assume that a message is private merely because it is marked “personal” or sent to a friend through a work account. Equally, an employer should avoid reading obviously private communications unless there is a clear and lawful reason to do so.

Monitoring Internet Use

Software installed on a company device or network may record websites visited, searches made, downloads and the time spent using online services.

An employer may use this information to protect its systems, prevent access to harmful websites, investigate excessive personal use or check compliance with an internet policy.

Monitoring should be relevant to the stated purpose. An employer that needs to identify unsafe websites will not necessarily be justified in compiling a detailed account of every page an employee reads.

Screen, Keyboard and Mouse Monitoring

Some monitoring systems record keyboard activity, mouse movement, application use or periodic screenshots. These products are sometimes marketed as productivity tools, although they can create misleading results.

An employee may be reading a complex document, speaking to a client or considering a problem while their keyboard remains untouched. A constantly moving mouse is not necessarily evidence of useful work, as the growing market for devices designed to keep computer cursors moving demonstrates.

Employers should therefore be cautious about relying on activity scores as evidence of performance or misconduct. Monitoring every keystroke or taking frequent screenshots is highly intrusive and may also capture passwords, medical information, family communications or other private material.

Webcams and Video Meetings

An employer may require staff to attend appropriate video meetings, but this does not normally give it the right to watch an employee continuously through their webcam.

Continuous or unexpected webcam monitoring in someone’s home would be particularly intrusive. It could capture family members, private conversations and details of the employee’s home life.

Employers should consider less intrusive alternatives, such as agreed check-ins, progress reports and measuring completed work. Where video is not necessary, employees may be permitted to use audio only or a virtual background.

Telephone Calls

Calls made through company telephone systems may be logged or recorded for training, quality control, regulatory compliance, security or dispute resolution.

Workers should normally be told when calls are recorded and why. Customers or other callers may also need to be informed.

An employer should not routinely listen to private calls simply because they were made using a company phone. Workplace policies should explain whether limited personal use is permitted.

Can an Employer Track Your Location?

Employers may use GPS technology to locate company vehicles, phones, tablets, delivery equipment or lone workers. Legitimate reasons can include:

• Protecting lone workers
• Planning routes and deliveries
• Recovering stolen property
• Providing evidence of attendance at a site
• Managing emergency responses
• Checking compliance with working-time or driving requirements

Location monitoring should not continue unnecessarily when the employee is off duty. Tracking a company vehicle during working hours may be justified; tracking where an employee goes at weekends is much harder to justify.

Where a tracking device remains active outside working hours, the employer should consider whether it can be disabled, limited to specified times or placed into a privacy mode.

Tracking Personal Phones

An employer may ask an employee to install a work application on a personal phone, particularly where staff work remotely or visit customers. The application could potentially collect location, device or usage information.

Employees should be told what data the application collects, when collection takes place and whether the employer can access any personal information stored on the device.

Using a personal phone for work does not give an employer a general right to inspect the employee’s photographs, private messages, contacts or internet use.

Company Vehicles

A company vehicle may contain GPS tracking, telematics, cameras and systems recording speed, braking, mileage and driving behaviour.

Monitoring may be justified for safety, insurance, route planning and fleet management. Employees should be informed about the equipment and whether it continues to operate during permitted private use of the vehicle.

Can an Employer Monitor Your Home?

Working from home does not turn a private residence into an extension of the employer’s premises. An employer may monitor its systems and equipment, but it must take additional care because monitoring may capture information about the employee’s private and family life.

An employer should not normally use workplace monitoring to:

• Record family members
• Listen to private conversations
• Inspect the employee’s home without agreement
• Monitor activity outside working hours without good reason
• Access unrelated information on a personal device
• Use a webcam to check continuously whether the employee is at their desk

Employers remain responsible for health and safety when staff work remotely and may ask reasonable questions about the homeworking environment. This does not automatically entitle them to film or inspect the employee’s home.

Must an Employer Tell You About Monitoring?

In most circumstances, workers should be clearly informed that monitoring is taking place. The employer should explain:

• What information is collected
• Why it is collected
• How monitoring is carried out
• Who can access the information
• How long the information will be kept
• Whether it may be used in disciplinary or performance proceedings
• Whether it will be shared with another organisation

This information may appear in an employment contract, staff handbook, privacy notice, IT policy, vehicle policy or homeworking agreement.

A clause stating that the employer may monitor “anything at any time” will not necessarily make excessive monitoring lawful. Data protection obligations still apply.

Covert Monitoring

Covert monitoring means monitoring workers without telling them. It should be used only in exceptional circumstances, such as where an employer reasonably suspects serious criminal activity or serious misconduct and telling the employee would prejudice the investigation.

Covert monitoring should normally be:

• Authorised at a senior level
• Limited to a specific investigation
• Used for the shortest possible period
• Targeted rather than applied to the entire workforce
• Stopped once the investigation is complete

Covert monitoring should not normally take place in areas where workers have a high expectation of privacy, such as toilets or changing rooms.

What Must an Employer Consider Before Monitoring?

An employer should identify a clear purpose for monitoring and consider whether the same result could be achieved in a less intrusive way.

Before introducing significant monitoring, it should consider:

• Whether the monitoring is genuinely necessary
• Whether it is proportionate to the problem being addressed
• What effect it may have on workers
• Whether less intrusive alternatives are available
• How personal information will be protected
• Whether monitoring could unfairly affect disabled workers or other groups
• How inaccurate conclusions can be challenged

A data protection impact assessment may be required where monitoring is likely to create a high risk to workers’ rights, particularly where it is systematic, continuous or uses new technology.

Does an Employee Have to Consent?

Employers do not always rely on employee consent to process workplace information. Consent can be difficult to treat as freely given because of the imbalance of power between an employer and employee.

An employer will usually need to identify another lawful basis for monitoring and must still show that the monitoring is fair, necessary and proportionate.

Consent would become far more significant where something as intrusive as an implanted device was proposed. An employer should not pressure a worker to undergo a bodily procedure merely for administrative convenience, particularly where an identity card, phone or security token could perform the same function.

Implanting Employees: Convenience or Corporate Science Fiction?

Electronic implants can be placed beneath the skin and used in a similar way to a contactless card. They may allow a person to open a door, confirm their identity or access a computer system.

The technology itself is not necessarily capable of following someone around the country like a satellite tracker. Many simple implants operate only when placed very close to a reader. Nevertheless, they raise serious questions about bodily autonomy, security and what happens when a worker changes jobs.

Before accepting an implant, a worker would reasonably want to know:

• Exactly what information it stores
• Whether the information can be changed or copied
• Who owns the device and its data
• Whether it can be used for another purpose later
• Who will pay for its removal
• What happens if the employee leaves
• Whether refusing it will affect their employment

If the only benefit is that the employee no longer needs to carry a security pass, keeping the pass may be the easier option. It is less dramatic, but it can be left in a drawer when employment ends.

Can Monitoring Evidence Be Used in Disciplinary Proceedings?

Information obtained through lawful workplace monitoring may be used to investigate misconduct, poor performance, data breaches, unauthorised absence or breaches of company policies.

The employer should investigate fairly and should not rely blindly on automated activity reports. The employee should normally be told the allegation, shown the relevant evidence and given an opportunity to explain it.

Monitoring information may be incomplete or misleading. For example:

• A period of inactivity may involve reading or thinking
• A location record may be inaccurate
• A device may have been used by another authorised person
• A messaging status may not show whether someone is working
• Software may fail to record work carried out offline

An employer should consider the quality and context of the evidence before reaching a disciplinary decision.

What Rights Do Employees Have?

Employees and workers have data protection and privacy rights in relation to information collected about them. Depending on the circumstances, they may be entitled to:

• Be informed about monitoring
• Ask what information is held about them
• Request a copy of their personal information
• Challenge inaccurate information
• Object to certain uses of their information
• Raise a grievance about excessive monitoring
• Complain to the Information Commissioner’s Office

An employee may also have an employment claim if monitoring is discriminatory, breaches the employment contract, contributes to an unfair dismissal or is so intrusive that it destroys trust and confidence.

What Should You Do If You Are Concerned?

Start by checking your employment contract, staff handbook, homeworking policy, privacy notice and policies covering IT, communications and company vehicles.

Ask the employer to explain what is being collected, why it is necessary and whether monitoring continues outside working hours.

Keep copies of relevant policies and correspondence. Where appropriate, raise the matter informally with a manager, data protection officer or human resources department before submitting a formal grievance.

Seek advice from a trade union, Acas, the Information Commissioner’s Office or an employment solicitor if you believe that monitoring is excessive, secret, discriminatory or being used unfairly.

Trust or Technology?

Employers have legitimate reasons to protect information, safeguard workers and assess performance. Remote working does not mean that employees are beyond management or accountability.

However, effective management should normally focus on the quality of work, agreed objectives and genuine security risks rather than how often someone moves their mouse.

The technology to monitor almost everything may exist. That does not mean an employer should use all of it. And until the office security pass becomes impossibly heavy, most workers will probably prefer to keep the microchip outside their hand.

Disclaimer: Solicitors.com is not a firm of solicitors. Content on this site is provided for general information only and is not legal advice. It should not replace advice from a regulated solicitor who has considered the circumstances of your case. Although we aim to keep information accurate and up to date, employment and data protection law can change. Use of this site does not establish a solicitor-client relationship.

Feedback: Is anything on this page incorrect or incomplete? Suggested amendments may be credited. Please email us.