Spying on Your Employees? Better Understand the Law First

What is monitoring in the workplace?

Employee monitoring refers to the methods employers use to surveil their workplaces, including staff members’ whereabouts and activities. With employee monitoring, businesses aim to accomplish the following goals:

• Prevent internal theft
• Examine employee productivity
• Ensure company resources are being used appropriately
• Provide evidence for potential litigation

Employee monitoring methods utilize various forms of technology, including:

• Activity tracking applications: The best employee monitoring software shows managers how staff members spend their work time. Functionality can include browser and application tracking, user activity screenshots , idle time reports and keystroke logging.
• Digital attendance systems: The best time and attendance software gives your business a record of when employees work and take paid time off. These records are valuable for payment calculations and as evidence if there’s a dispute over hours or vacation time. These digital systems also provide an accurate record of when employees start and end their days, helping you determine productivity levels.
• Video security: Video surveillance systems can strengthen your business’s security and productivity. Catching a thief on camera certainly reduces shrinkage costs.
• Location tracking: If a team’s duties revolve around driving, businesses can install one of the best GPS fleet management systems to monitor driver safety, fuel efficiency and accountability.
• Biometric scanners: Biometric time and attendance systems use fingerprint, facial, palm or iris scans to record work time. However, biometric system laws govern how biometric information is recorded, stored and used.

Regardless of the technology, some business owners may not know how far they can or should extend their authority to monitor employee activity. It’s always best to turn to federal and state employee monitoring laws and regulations to establish limits.

What employee monitoring laws and regulations should you know?

Federal privacy laws, as well as most state privacy laws, give discretion to employers regarding how far they can go with employee monitoring programs. In some cases, depending on state and local laws, employers don’t have to inform employees they’re being monitored. However, some regulations do require employee consent.

“As a general rule, employees have little expectation of privacy while on company grounds or using company equipment, including company computers or vehicles,” said Matt C. Pinsker, a former adjunct professor of homeland security and criminal justice at Virginia Commonwealth University.

Here’s a deeper look at federal and state workplace privacy and employee monitoring laws.

Federal workplace privacy and employee monitoring laws

Federal workplace privacy and employee monitoring regulations stem primarily from the Electronic Communications Privacy Act of 1986 (ECPA). Here’s what you should know about the ECPA:

• The “Business Purpose Exception” applies. The ECPA allows business owners to monitor all employee verbal and written communication as long as the company can present a legitimate business reason for doing so.
• Consent expands monitoring capabilities. The ECPA also allows for additional monitoring if employees give consent. However, the ECPA consent provision can be tricky, as it might be inferred to allow monitoring of employees’ personal and business communications.
• Stored communications have less protection. Federal court cases have determined that employers may legally look through employees’ emails after they’re sent. Electronic communications are typically defined as messages currently in transit. Upon being sent, these transmissions become “electronic storage,” which courts have determined employers can monitor.
• Surveillance limits exist. In general, monitoring must be within reason. For example, video surveillance can be conducted in common areas and entrances, but surveillance in bathrooms or locker rooms is strictly prohibited and exposes a company to legal repercussions.
• Data retention may be required. Another issue arises when you retain recordings, especially of meetings. If you record meetings with employees, especially ones dealing with disciplinary actions or HR-related issues, you may be legally obligated to keep those recordings and turn them over to a court if litigation arises.

Monitoring computer web activity is separate and can fall under different legal precedents. Here’s what you should know:

• Company hardware implies company oversight. Computer monitoring software solutions have various features. Some can show you precisely what employees are doing on their computers. You can monitor activities such as which websites employees browse on the business’s Wi-Fi and what keystrokes they make on their company laptops. There is practically no reasonable expectation of privacy for an employee using a company device, so a safe rule of thumb is to assume that anything employees do on their company-owned computer is visible to their employer.
• Data privacy risks are real. While it’s OK to monitor employees’ computer usage to ensure they’re not wasting time on social media and frivolous browsing, employers should know they risk acquiring too much information. Employers already have employees’ personal data, and they can run afoul of privacy laws, like HIPAA, if they disclose private information to anyone.
• Protection of sensitive data is mandatory. Employers have the burden of protecting sensitive employee information, even if it comes from an employee’s personal browsing history or private data stored on a company computer. If a data breach occurs and exposes certain sensitive information, it leaves the company vulnerable to litigation by the employee.

State workplace privacy and employee monitoring laws

As with any issue that states regulate, workplace privacy and employee monitoring laws vary among states. Business owners must remain vigilant regarding local statutes, as demonstrated by regulations in the following states:

• Connecticut: Any company that monitors its employees in the workplace must inform them in writing and detail the tracking methods used ahead of time.
• California, Florida, Louisiana and South Carolina: All of these states’ constitutions explicitly state that residents have a right to privacy. As such, employers in these states may need to tread carefully when setting up employee monitoring systems.
• New York: Any private company that monitors employees in the workplace in New York must provide specific notice upon hire and in a “conspicuous place” all employees can see. An acknowledgment of monitoring must also be kept on file for each employee.

In addition to employee monitoring laws, some states have strict data privacy laws. For example, the California Privacy Rights Act (CPRA) substantially expands employee data protection requirements. To be safe, you may be best served by checking with your legal counsel to ensure your employee monitoring technology usage adheres to federal and state regulations.

What are the ethics of employee monitoring?

Surveillance in the modern workplace has reached unprecedented levels. According to a 2023 survey by ResumeBuilder.com, an overwhelming 96% of companies with primarily remote workers use some form of employee monitoring software. 

While these tools help manage workflow and secure data, they levy a significant psychological tax on the workforce. Data from the American Psychological Association’s 2023 Work in America Survey reveals that 51% of employees who are electronically monitored during the workday report feeling micromanaged. Furthermore, monitored employees are more likely to report negative impacts on their mental health. 

Monitoring can feel invasive and may make employees feel the company doesn’t foster a culture of ethical behavior. It can negatively impact employee turnover, productivity and employee happiness.

How can you communicate about employee monitoring to employees?

The best way to combat the negative side effects of employee monitoring is by clearly communicating its purpose to your employees. Consider the following tips:

• Post plain-language signage. Depending on the laws in your state, visible signage stating that security cameras monitor the premises may be enough to cover legal and ethical grounds. The knowledge that cameras monitor everything is often enough to prevent internal employee theft.
• Prioritize detailed transparency. Transparency is always a good practice. Because many employees feel uncomfortable being monitored, it’s important to be forthcoming about what you hope to accomplish and how surveillance aligns with your business’s goals. When employees understand that monitoring is intended to ensure fairness rather than punish individuals, acceptance rates typically improve.
• Establish an open dialogue. Employers can strengthen trust by communicating with employees openly and honestly. All monitoring policies and procedures should be clearly communicated to new employees. Current employees should receive notice if any changes are made. In addition, employees should have access to the data employers collect about them and the ability to challenge interpretations of it.
• Limit data collection to business needs. As mentioned, GPS tracking is another form of employee monitoring, generally as part of fleet tracking and telematics on company vehicles. With most fleet software, managers can track a company vehicle and where it’s been, even if the employee is off the clock. Business owners can do this, as they have the right to know where their property is. However, GPS tracking of company devices like laptops and phones is another murky area because employers can learn more than they need to about employees’ activities when they’re off the clock.
• Adapt to technological changes responsibly. Clearly, as technology continues to develop, organizations will have opportunities to track and monitor employees in new ways. As these new options arise, business leaders must listen to employees and review legal guidelines for employee monitoring. “Ultimately, a balance can be reached by thinking through legitimate business interests and weighing them against the expectation of privacy of employees while also taking into account regulatory limitations, which may differ state to state, country to country,” said Joseph Lazzarotti, a principal with Jackson Lewis who leads the law firm’s Privacy, Data, and Cybersecurity practice group.
• Weigh pros and cons before implementation. There are pros and cons to implementing employee monitoring solutions. Before launching new programs, employers should carefully consider their monitoring goals and the potential impacts on employee engagement and company culture. Additionally, employers must ensure any new monitoring efforts comply with federal and local laws.

Casey Conway and Andreas Rivera contributed to this article. Some source interviews were conducted for a previous version of this article.