The Data Protection Code


Reps need to be familiar with the Information Commissioner’s Employment Practices Data Protection Code — Monitoring at Work, available from the ICO website. There is also a code for CCTV. Here are the key points on covert monitoring, taken from Part 3 of the Code:


• covert monitoring should only be used if criminal activity or equivalent malpractice is suspected, that would be difficult to prevent or detect if staff were told about the monitoring. In an employment context, the usual justifications are suspected theft or fraud linked to time sheet manipulation, sick pay or health insurance;


• covert monitoring of workers can rarely be justified;


• it must be authorised at the highest level of the organisation;


• it must never be used in places like toilets or private offices “unless serious crime is suspected and there will be police involvement”; 


• it must only be used as part of a specific investigation;


• it should be time limited and must stop once the investigation is complete; and


• there should be clear rules to protect staff from unjustified covert surveillance and setting clear limits.


The Code is useful to help reps set clear boundaries and to back up objections to any covert monitoring. However, the Code is non-statutory guidance and this means that employers are not legally obliged to follow it. On its own, failing to follow it will not make a dismissal unfair (City and County of Swansea v Gayle [2013] UKEAT/0336/12/2106). 


https://ico.org.uk/media/for-organisations/documents/1064/the_employment_practices_code.pdf