Christine:  So working or shirking, Seamus. Basically, the world is divided into two different sectors. We've got kind of our Alan Sugars, our Elon Musks that think if you're not sitting in front of me at your desk, slaving away, then you're not really working.

There was a CEO who put a comment on LinkedIn that he thought his employees were sitting about in their onesies watching loose women and feeding the squirrels.

So I think there are a lot of people that do think that. The other side of the coin is employees are more engaged, they have more time with their families, they're not wasting time sitting in traffic or in trains and buses getting into work. They've got better work-life balance, so you're getting more out of them.

So that's really what we're going to be talking about today, and how you can be sure that they are working, and what you can do to be sure.

I suppose we do have some monitoring that goes on just naturally in the workplace. You need to look after employees' health and safety. So there's a certain amount of monitoring that needs to go on there. You need to check for burnout, and when people are working from home, that's all the more important because you can't see them.

But I think the data that's collected . . . You alluded to the fact that there's a lot of data that, really, employers have access to, and they collect it for a certain purpose. But then that leaks into, "Oh, well, I've seen Christine going off for a cup of tea one too many times in the CCTV camera. Will we do a performance management on that employee?"

So is it okay to use data that you're collecting for one purpose and use it for another purpose?

Seamus:  I mean, I think I did possibly put myself in a bad foot with some delegates because during my seminar at the Annual Review, I'd put up a picture and then I gave some of the quotes that the individual said. So I had Alan Sugar and Elon Musk, Liz Truss, saying that we all needed a bit more grit in our work, and the classic one of Jacob Rees-Mogg as well. So a bit of a terrifying picture for delegates at it.

But I think the simple truth is that if you are working off any kind of normal technology in your place of work, there is monitoring that is going on. Whether or not you're accessing the monitoring or not and the data that's produced out of that is a different matter, but there is monitoring going on.

And even if you think of all of the different systems that sit behind our tech in our computers that are looking for viruses, that are scanning our emails, and pulling back emails that we don't see because they are risk, all of that is already going on in the background.

And I suppose that, ultimately, there isn't any legal difficulty in relation to those normal processes that are on-going. The greater risk, of course, is where there is monitoring that is on-going and that there hasn't been notice given to employees about, and then all of a sudden, they are provided with information where they're shocked. A lot of the times, it can really damage the employee-employer relationship as well.

And then we've had the progression of all of that where the sort of worst-case scenarios seem to be where employers are requiring their employees to have their monitors on all day long so that they can be monitored to check from time to time if they're doing their work. There was an interesting case, a Dutch case, that I can touch on in a bit.

But the basic position is . . . And very helpfully, just at the outset of all of this, this is the guidance that has very recently been issued by the Information Commissioner's Office. It was issued on 12 October 2022. It's entitled "Employment Practices: Monitoring at Work," and it's draft guidance from ICO.

It has probably taken the ICO some time with the shock of the pandemic and the such huge increase in relation to working from home, but they have put this together. It's really informative. It's really helpful.

The gist of it is that there certainly isn't a position where you can say, "No, you cannot monitor what your employees are doing when they're working from home". That is not the position at all.

The clear position that we have, and certainly from the ICO guidance, is that the employer must strike a level of balance in relation to what would be intrusive, and then balancing it off of the needs of the business. And you have to balance off all of those matters when you come to giving consideration to how you would monitor employees.

But it certainly isn't a position where there's a simple, "No, you can't do it". Really, what you're looking at is the justification aspect. Is it necessary? Is it required? And if it is, then you're at the point where we're at with the poll question of, "Have you consulted with your employees about it? Have you notified them of it? Do you need to get consent in relation to the employees for certain aspects of monitoring? And what is the fallout if something happens in relation to it?"

So I think probably the two aspects that I would see . . . And a really interesting one as well is that the ICO guidance simply says that if you do this right, if you're an employer and if you monitor correctly, what you can do is build a really strong relationship with your employees.

You can be known as an employer and earn a reputation as an employer that respects privacy and respects the personal lives of their employees as well. I mean, that's the opening and starting point of the guidance that you get.

Really, two aspects that I always think about when it comes to this is there's the data considerations that you have, and then there's the employee aspects of it as well.

And the data considerations, we know the legislation is GDPR and the 2018 Data Protection Act. I think we've all got to a place where we're much more comfortable with GDPR and what the requirements are for employers. But I think it's that aspect of saying that the standard monitoring that goes on is not going to be viewed as intrusive. There will be a level of understanding from your employees that that is necessary and required and, in a lot of cases, expected.

It's the more intrusive side of the monitoring. It's the covert monitoring that happens. It's the behind-the-scenes information that the employer is gathering. And there's no doubt that it is happening. We can read "Personnel Today", any of the HR guidance or media sources that you go to. I mean, this information around monitoring is coming from somewhere, and it's because the employers have it. But they're maybe just not so clear with their employees that they're doing it.

So you do need to have a reason. The underlying point is that you do need to have a specific reason in relation to why you're processing the data.

That's the fundamental point behind GDPR. You can't just do it willy-nilly. You can't just decide that you think that would be interesting information to have. There has to be a justifiable reason for that. And then it's about explaining that reason and giving an understanding to your employees as to why you're doing it.

And ultimately, as you said in the poll, best-case scenario is that you have a written policy and a procedure in place in relation to how data is monitored, captured, how it's used, how it's retained, when it will be disposed of, all of the things that we've come across.

And importantly, they also underline in the guidance that you should look to do a data privacy impact assessment. It's, strictly speaking, for general run-of-the-mill monitoring. Not necessarily required, but if it's the more intrusive aspect, if it's the biometrics that you're using . . .

PWC had produced a facial recognition element for their employees that were working in sort of banking and finance sectors. And their justification was that this was sort of a second or third factor, where you could authenticate users and employees. But it also brought along with it that there was a clear aspect where the monitor had to be on and your face had to be recognised. And employees didn't like that. It felt intrusive and they couldn't understand why it was necessary, and there was kickback in relation to it.

So, for the sort of biometric stuff, it's absolutely necessary to do the data privacy impact assessment. But the guidance underlines that it's always a good idea and it's good practice to do it in any event. It keeps you right in case that there are issues that arise.

I was just going to mention . . .

Christine:  Sorry to interrupt. Seamus, I just wanted clarify. So a good reason for monitoring people when they're working from home, is it enough to say productivity? Is that a good reason for monitoring?

Seamus:  No, I don't think that that is sufficient. In every contract of employment that you have, the pillars of the contract are always trust and confidence. And whenever I was preparing for the seminar, that was the real issue that was bouncing out at me across anything that I read, or that I was researching, or that I was thinking about.

A massive issue comes down to the trust that the employer and the employee have. The employer has to trust the employee to do the work, and the employee has to trust that the employer will allow them to do the work, and that there will be space for them to have all the usual things in relation to the progression and all those sorts of things. But ultimately, it is about trust.

There's a great piece that I read about it, and it's about, ultimately, productivity paranoia. For me, that's what I was able to break it down to. It's paranoia of employers saying, "Are employees being productive whenever they're not in the office, when they're working from home? When we can't see them, what are they doing?" That's the bottom line of it.

And it's simply the idea that employees are not putting in the hours because they're not in the office. If they're out of sight, they can't be doing the work, and that all does simply just boil down to trust.

And I was going to mention just as well about that employment aspect of it, that there are employment considerations that need to be given. And I'll just jump to the really interesting point I think on all of this, is that if you have an employee that refuses to be monitored, if you have somebody that refused to come onto your Teams call and wants to keep their monitor off, or you have somebody that . . .

We heard about these stories about . . . It was almost like a primary school class attendance roll at the start of every morning, where everybody had to put on their monitors on Teams and say, "Present", that they were there, and those sorts of things that were happening.

Where does it all take you to if an employee doesn't conform and comply? It takes you to a place where you might say, "Well, listen, we're going to discipline you. We are going to discipline, and we could end up in a place of dismissal".

The onus will always fall back on the employer. For that decision to be reasonable in the circumstances, it has to be within the bound of reasonable responses. And if you end up in a tribunal and you then are saying to your tribunal, "No, we needed to know whether or not they were present and doing their work", I think that that tribunal is going to have issues with that, saying, "The relationship is trust and confidence, and where does that take everybody?"

So I think, ultimately, where an employee doesn't comply, doesn't agree to have their monitor on, and says no during an appraisal or review or performance management, saying, "No, I'm not happy with the intrusiveness. I think it's overbearing", and the employer says, "Well, we have no choice but to dismiss you then, because you're refusing a reasonable instruction", or, "You're being insubordinate", or something like that, the employer is going to have to justify that at a tribunal hearing. And I think that's going to be difficult to do.

Christine:  Yeah. So I suppose you really need to be thinking about, "Okay, we want to monitor employees for a legitimate reason", but you need to think of what's the least intrusive way to go about doing that. So it's not just, "Oh, we need everyone to have their cameras on". You can't just have a blanket policy of that. Would that be fair to say?

Seamus:  Absolutely. I think that the four main things for me, really, just to sort of close that section off, is that GDPR and the Act do not prevent you from monitoring, but what they do is they set out that legal framework to allow you to do that. And it's balancing the intrusion of with the needs of the business.

You definitely need to make the employees aware of the nature, the extent, and the reasons for the monitoring, unless there's some sort of exceptional circumstances. And there could be maybe in banking and financing worlds and things like that, where you can't just be as open. But employees need to be aware, and they must be clear what the purpose of the monitoring is for. Why are you monitoring?

If you're going to say to an employee, "Well, I'm monitoring to make sure you're doing your job", I think that's a problem. If you say that every employee, could you imagine the damage that that will do to the relationship? That makes an employee feel that they're not trusted. Will they stay with that employer? Probably not.

And the last one is really looking to make sure that you carry out your data protection impact assessment. Basically, for any monitoring that is going to be high risk or where it's going to impact upon the rights of the workers, I think that that is a good way to manage it. You do it, you keep it, and you can refer back to it whenever you need to.

Christine:  Yeah. And I think you need to be aware that when you are collecting data, you may well be privy to data that is more sensitive than other data. So you may well find out an employee is ill and they disclosed something about their medical history, and you inadvertently find out about it. Or their religious beliefs, or something that becomes that very sensitive type of data. So you need to be alert to that, really, don't you?

Seamus:  Absolutely.

Christine:  Yeah. So other than using kind of snooping technology, cameras, keystroke, all of that, what would you recommend as an alternative to that?

Seamus:  I think that, ultimately, where your concerns are around productivity and wanting to know if your workforce is being productive, you do need to have some way to look at the input and the output of it all.

And I think for me, Christine, the start of that is really about a discussion and agreement with your employees about what their goal is, what the achievement is for their role, and that should be what you're monitoring, to see whether or not those goals have been achieved.

Those goals can be target-based. You can say, if you're working in a factory, "The target here is to produce 100 products a month, and that's your job to do that. They'll be counted and we'll know whether or not you've overdone it, or you haven't performed what the expectation is".

But again, that's about being very clear and giving a clear understanding of what's expected, what the role is, what the achievements are, and when that will be reviewed. I think that's in the simple format of it.

If I was to look at it from a target-based productivity, it's the input and the output and looking at the data that you have available based on real-time outputs, not necessarily on how many emails you've sent during the day or how many times that you have typed documents during the day.

All work is different and it doesn't fit into one box. If I take the example of solicitors and the types of things that you will look at, obviously everybody knows for solicitors, fee targets are one of the big factors for all law firms.

And you could sit and do your job in five hours a day and hit your target and more during the day in relation to your fees. Other people, they might have to work 10 hours a day just to hit theirs. It depends on the work, but that should be fed, obviously, and be part of that process.

But other things that you would look at, you'd be also looking at client feedback. You'd be looking at what maybe new business that you brought in, what business you retained during the year, what clients you retained, your marketing contribution, your contribution to your CSR, your corporate responsibility aspects, and things like that.

So it just can't be monitored on one thing, but you don't need to be spying or monitoring your employee every day in the office in order to gain that information.

It's that aspect of you could have somebody that's in the office for eight hours a day and doing nothing, looking busy, but they're not actually producing anything. So you do need to have some way of monitoring the objectives, but I think that is different than monitoring the person themselves and two distinct ways.

Again, the employee should be provided with the information that the employer has sourced or obtained, and should be aware of that. And whether or not you're going to be looking at reviews on a weekly, monthly, quarterly, biannually, or annually, whatever way the reviews are done, there's feedback given to the employees. And if there are management reports, those are shared, that employees are clear as to how their performance will be managed and monitored.

You're looking as well at the feedback of others. How is somebody else on your team performing? And there is completion of appraisal forms, and there's completion of review forms.

All that sort of information can be used in order to conduct a review and see how somebody is performing without this unnecessary spying or monitoring of employees behind their backs, when they don't know, and it causing difficulties in the relationship.

Christine:  Yeah, I think there was one comment made during your session at the Annual Review that you reap what you sow. So if you trust employees, they in turn will trust you, and you'll get better productivity out of them.

And I think what I've noticed in the Republic of Ireland Annual Review this week . . . The Northern Ireland one was a few weeks ago. But what came out in loads of sessions is transparency. You really can't go wrong if you're being open and honest with your employees, and it seems to be there's a big push for that in every area of employment law. So I think that can only be a good thing.

Seamus:  Yeah. And certainly from a tribunal aspect, that's what the expectation is whenever you end up at a hearing. And often, the judge will ask the question whenever it hasn't been dealt with in cross-examination or whatever it is. The judge will say, "Well, what was the communication around that? What was discussed? What was the employee told? How were they to be aware?"

Really interesting just as part of that . . . And we're talking about being open and transparent. Microsoft did a survey back in September of this year, and the survey said that 87% of workers felt they worked equally or more efficiently at home than they did in the office. Eighty per cent of managers disagreed with that. This was their survey.

And then it said 87% of workers reported that they were performing just fine. Fair enough, you would expect employees to say that. But just 12% of employers said that they had full confidence that their team is productive.

And this is a company, Microsoft, where you would imagine that that very high-end, top-end monitoring is going on. You just wonder a lot of the time if they're monitoring in that kind of way, are they missing the real productivity that happens?

Christine:  Yeah. They're missing the point it. Are they still keeping their head above water, doing a good job? Are they satisfying their customers? All of that.

So, yeah, I think presentee-ism needs to go, doesn't it? Because as you say, there are some people that come into the office and spend an awful lot of time on their phones and walking about, having a chat.

I honestly think I personally am more productive at home now. I have my wee desk set up just the way I like it. When I go into the office, I think there are just so many distractions for me now.

Now, I know my job is that type of job. A lot of thinking goes on. But I think a lot of people find they're more productive at home. You don't have the people walking up, or you've had your tea break, but then someone else is on a different tea break schedule and comes past and has a chat while you're trying to get into something. I can find that quite distracting.

Just to finish up this wee section, ICO finds that that's kind of what looms if you do the wrong thing. Do the ICO have the power to fine you for misuse of data in that way?

Seamus:  Absolutely. There is a power for the ICO in relation to fines, in relation to making publications. And these publications are all open to the public. So if they do an investigation, make a finding, they publish it.

And they do have the power in relation to . . . I mean, this is just treated as any normal breach of data. So off the top of my head, trying to remember, isn't it a maximum of €20 million, or 4% or 5% of turnover, or something like that? I can't remember . . .

Christine:  I can't remember either, Seamus, I'm ashamed to say.

Seamus:  . . . precisely what it is. But they have those powers.

I couldn't actually find any cases where for these specific issues, where ICO have taken an employer to task over monitoring and breaching data laws in relation to it for employees.

I did come across some cases where employees had been admonished, but essentially, the employer was the liable party, specifically around health trusts and employees snooping around in other people's medical records and things like that as well. That seemed to have been reported quite a bit and fines issued in relation to it.

But I've no doubt that as the technology goes, it gets tighter and tighter and tighter. And as much as it gets better, the downside is it leaves a trail for what employers are doing. They can't hide away from that either. So there is always the risk.

Maybe I'll just mention one case, and I did mention this at the seminar. It's a case of Chetu. It's a Dutch case. Essentially, Chetu are an American company based in the Netherlands, with an office there. An employee refused to keep their monitor on for their nine-hour shift every day that they were working. I think it was specifically about a programme that they were working through in the office.

I'll just read out what the employees said to the Court. The employee said, "I don't feel comfortable being monitored for nine hours a day by a camera. This is an invasion of my privacy. It makes me really uncomfortable. That is the reason why my camera is not on". The employer could already monitor all activities on their laptop, and sharing screens, and things like that.

What the employer said was this was a reasonable task that it wanted to do, that it was no different from observing an employee in an office environment. And you have the European Court of Human Rights on this one. What they said was, "Video surveillance of an employee in the workplace, be it covert or not, must be considered as a considerable intrusion into the employee's private life".

And they found in the circumstances of this case, they said there was no sufficient justification for the monitoring taking place, and they awarded an employee €75,000. So about £65,700 was what the award was for.

And I do think that we'll start to see more of these cases coming through. This was a Dutch case, but obviously, it was the European Court of Human Rights that dealt with it. Importantly, bringing it all back, it was about the justification for the monitoring.

Christine:  Yeah. I think I would have to wholeheartedly agree with the Court's decision there. Yes, if I'm at my desk in my office, people can see I'm there, but there's certainly not someone sitting opposite me staring at me for the duration of my day in the office. So, to me, it seems excessive. An interesting one. Thanks for that, Seamus.