Data Protection and Workplace Monitoring

What are my data protection rights at work?

The data protection rights of employees are covered by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). Under these rules, employers must ensure that any information they hold on employees is:

used fairly, lawfully and transparently
used for specified, explicit purposes
used in a way that is adequate, relevant and limited to only what is necessary
accurate and, where necessary, kept up to date
kept for no longer than is necessary
handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

Employees have the right to be told:

what records are kept and how they’re used
the confidentiality of the records
how these records can help with their training and development at work

If an employee asks to find out what data is kept on them, the employer will have 30 days to provide a copy of this information.

Can my employer monitor me at work?

Employers are allowed to monitor their employees in the course of their workplace activities, within certain boundaries. However, they are not permitted to monitor their personal communications, as this will be considered a breach of privacy and potentially their human rights.

You should consult your company handbook, contract or written statement, along with any relevant policies, to check if your boss is expressly allowed to monitor them in specific ways, such as:

internet use
emails
CCTV
phone calls
messaging apps (eg WhatsApp)

If there is no policy on the specific monitoring, raise the problem with your line manager or HR department. If this doesn’t work, follow your company grievance procedure, and consider submitting a letter of grievance.

In some cases you may be able to resign and claim unfair constructive dismissal for breach of the implied term of trust and confidence – but this will depend on the facts and can be difficult to prove.