What can employers do with the information they collect?
[page 38]The law also sets limits on what employers can do with personal data they have obtained from monitoring their workers. The data protection principles require them to make sure that it is accurate and kept up to date. This means that they must correct or delete anything that is wrong or misleading as soon as possible.
The ICO guidance states that employers should have “appropriate organisational and technical measures in place” to meet their security obligations. This includes allowing access only to those people who really need to see it, who should be trained in handling data obtained from monitoring.
Employers remain responsible for compliance with the law even if they outsource monitoring to a third party. The third party has their own set of obligations to fulfil.