Monitoring employee computer use

Do employees need to be notified their computer use is being monitored?

Question: Do we need to formally notify employees that we monitor computer use through e-mail reviewing and keystroke logging or is it implied in the workplace?

Answer: Yes, it is important to formally notify employees the company monitoring their computer use through both e-mail reviewing and keystroke logging. Whether employees have a reasonable expectation of privacy with respect to their use of company computer systems remains the most widely debated legal issue surrounding workplace e-mail, Internet use and, even more recently, keystroke logging policies.

To date, there is no Canadian ruling which effectively addresses the issue of employee e-mail or keystroke logging. However, it appears that where an employer’s right to monitor e-mail is contemplated in a collective agreement, or where an employee has consented to e-mail monitoring, such monitoring is acceptable so long as the infringement on privacy does not exceed the scope of the consent. The focus becomes one of reasonableness of the substance and implementation of the workplace rules.

Private sector privacy legislation has been passed in British Columbia, Alberta, Quebec as well as federally with respect to the collection of personal information, including employee information. Generally, the legislation allows for the collection of personal employee information without consent only if: the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the employer and the employee; and the employer has notified the employee that it will be collecting employee personal information about the individual and the purposes for the collection.

In Alberta, the Information and Privacy Commissioner (IPC) in Parkland Regional Library, decided a public library violated the province’s public sector privacy legislation by using keystroke logging software to monitor the computer use of an IT technician it suspected of slacking off. The IPC first determined the information gathered by the library through the use of the software was “personal information” about the employee, because it related to the quantity of work he did, his working style and how he prioritized his tasks. Second, the software also captured some personal banking information, which had no legitimate work-related purpose. Finally, the IPC decided keystroke logging was not a “minimally intrusive” means to gather information about an employee’s workplace activity. While the IPC did not rule out the use of keystroke logging software for all purposes, he severely restricted it and recommended employees be forewarned of its use.

Another reason to provide express notification to employees is to ensure employees are aware of the monitoring and it cannot be characterized as “surreptitious surveillance” which, in the context of video or digital camera recording, has been found to be justified only where there is a substantial problem; there is a strong possibility that surveillance will be effective; and there is no reasonable alternative to the surreptitious surveillance.

The threshold is lower with respect to surveillance that is not surreptitious, which is announced to the employees affected. In that circumstance, the test is whether the surveillance is a reasonable exercise of management rights in all the circumstances. This test is also consistent with recent federal and provincial privacy legislation with respect to private employee information in the context of an employment relationship.

An effective way to balance the interests and rights of employers against those of employees is to draft and implement an appropriate and comprehensive e-mail, Internet and keystroke logging policy. The policy should set forth terms of use and the circumstances of monitoring which are consistent with the goal of protecting both the company and its employees against misuse and liability, whether resulting from harassment, defamation, breach of confidential or proprietary information, or any other inappropriate use. The policy should also make clear to employees that any personal information gathered by means of the monitoring policy will be used only to effect the stated purpose.

Employers may also consider requiring employees to consent to monitoring as a term of their employment. Such a policy should be made part of the terms and conditions of employment at the time of hire or, alternatively, signed acknowledgements may be obtained from employees indicating they understand the policy and consent to monitoring.

For more information see:

Parkland Regional Library, Alberta IPC Order F2005-003, June 30, 2005.

Brian Kenny is a partner with MacPherson Leslie and Tyerman LLP in Regina. He can be reached at (306) 347-8421 or [email protected]

Latest stories