30 Burning Questions About Employee Monitoring Laws Answered

Questions regarding state-specific employee monitoring in USA: California, New York City, Texas. Questions regarding the ECPA. Questions regarding the GDPR. Questions regarding the ethical side of monitoring. Questions regarding the employee’s rights in terms of employee monitoring.

Short and simple, employee monitoring in the United States is completely legal. Most federal and state laws allow employers to monitor pretty much everything that happens in their company, especially when there is a legitimate business purpose for that. That being said, laws do govern just how extensive the use of employee monitoring software is permitted in the workplace.

Today, we’ll go over most asked questions regarding employee monitoring laws in the United States to make matters easier for both employers and employees when it comes to the practice of employee monitoring in the workplace as a whole.

Questions on the Basics of Employee Monitoring

What constitutes employee monitoring in the workplace?

Quite often the first question that arises is what is employee monitoring software? Essentially, the practice of employee monitoring consists of using various methods of workplace surveillance with the aim of gathering information about the internal climate in the company, including information about the whereabouts and activities of the personnel.

Why do companies decide to monitor their employees?

Businesses introduce employee monitoring in order to improve productivity and protect corporate resources.

The main goals companies aim to accomplish with employee monitoring include:

Prevention internal theft of sensitive information
Examination of employee productivity
Insurance of the correct company resources allocation and use
Gathering of evidence for potential litigation

What employee monitoring tools do companies use?

Among the most commonly used employee monitoring methods the following can be highlighted:

Employee monitoring software, which shows managers what exactly employees do during their working hours. Its main functionality may include user activity monitoring, web and application tracking, and keystroke logging.
Time and attendance management tools, which provide managers with a record of employees’ billable hours and their paid time off. These records may become valuable not only for salary calculation, but also during potential work or vacation time-related disputes.
Time tracking solutions that help managers get an overview of employees’ working time at their computers and generate comprehensive reports that help understand the efficiency and level of engagement of employees.
Video surveillance and GPS software, which strengthen company security and productivity as well as ensure employee safety, efficiency, and accountability in the workplace.

Is employee monitoring legal in the United States?

Yes, according to the federal monitoring laws, employee monitoring is completely legal in the U.S. Employers have an extensive amount of rights to monitor their employees’ activities. However, such monitoring is ought to have valid business reasons behind it.

Is it mandatory to inform employees of the monitoring and acquire their written consent?

When it comes to federal legislation, employers have no legal requirements to disclose the fact of employee monitoring to their workers. At the same time, state laws in four U.S. states (Connecticut, New York, Texas, Delaware) establish that notifying staff about the use of monitoring software beforehand and getting their consent is a requirement. So if an employer in these four states fails to obtain the employee’s consent for monitoring, it can be considered spying and employees may sue for violation of their personal boundaries.

Is it mandatory to formulate dedicated monitoring policies?

Yes, it is. Code of conduct as well as various policies are considered mandatory components for every business in the U.S.

When comprising a workplace policy regarding monitoring, employers are recommended to:

make the policy adequately defined and documented;
explicitly outline the scope of data that will be monitored and the means of monitoring;
acquire a written acknowledgment from employees;
explain to the employees that there is no privacy to be expected when using company-owned devices yet that the data unrelated to work performance will not be gathered.

Questions on the Scope of Monitoring

What activities can be monitored in the workplace?

In a nutshell, it is legal for employers to monitor:

screen (using the software’s features of screen video recording or even live streaming that enable complete overview of what every employee is engaged in during the working hours)
phone calls (with the exception of intercepting private conversations. Moreover, besides having a legitimate business interest, the employer needs to either inform about the ongoing monitoring or obtain consent from at least one party of the real-time conversation);
email, voice mail, text messages (with the exception of reviewing personal emails stored outside the employer’s system. It should be made clear that employees must not have a reasonable expectation of privacy when using company-owned communication channels);
Internet usage (with the exception of accessing personal and secure websites provided by a third party. It is strongly recommended for the employer to establish a proper Internet usage policy);
social media (with the exception of reviewing private social media pages or requiring personal login details. The same recommendation is applicable);
screenshots and keystrokes (the same recommendation is applicable).

Is it legal to monitor company-owned devices?

Yes, it is. According to the ECPA, any device that employers have provided their employees with is considered company property, and therefore the employer has every right to monitor said device and any activity employees carry out on it (even outside the workplace).

Is it legal to monitor employees’ personal devices?

Yes, it is. Under specific conditions, employers have the authority to collect data on personal devices (laptops, tablets, phones) that belong to an employee, granted there is a court order or a well-defined workplace Bring your own device (BYOD) policy that permits such monitoring for work-related reasons within the company premises.

Is it legal to monitor screen contents and keystrokes?

Yes, it is. There is an important remark to make, however – monitoring of screen contents and the keystrokes is generally permitted on a work computer.

Is it legal to monitor phone and email conversations?

Yes, it is, provided that an employee is using the company phone. And while the ECPA does state that it is against the law to intentionally intercept any wire, oral, or electronic communication, there are a few exceptions to that. These exceptions can be made in regards to the service provider (who is permitted to access electronic communications), presence of a legitimate business reason behind monitoring (business-related exception) and permission of at least one party to record the phone conversation (prior-consent exception).

Is it legal to monitor Internet usage?

Yes, it is. Monitoring web activity on company-owned devices is not prohibited by the U.S. federal laws. There are various features of employee monitoring software that gather data on precisely what employees are doing on their PCs during their working hours. Employers should disclose to their employees that there is practically no reasonable expectation of privacy when using a company-owned device.

At the same time, employers must be careful and consider privacy laws as well as protect sensitive employee information. Potential data breaches could expose certain sensitive information in regards to employees, and that would leave the company vulnerable to employees filing lawsuits against their employers.

Is it legal to use video surveillance in the workplace?

Yes, it is. However, all monitoring must be within reason. Thus, video surveillance can be conducted in common areas and entrances, while surveillance in bathrooms and other areas that are considered private is strictly prohibited.

Questions on the Employer’s Rights and Obligations

What U.S. federal legislation protects employers’ rights?

At the federal level, employer’s right to monitor their employees is protected by Electronic Communications Privacy Act (ECPA), which essentially establishes fundamental legal background for all activity regarding employee tracking and monitoring practices.

The Stored Communications Act (SCA) confirms the employer’s right to review files and data generated by employees during their working hours. At the same time, it should be noted that such monitoring must have valid business reasons behind it.

What are the consequences of violating employee monitoring laws?

If an act of violating employee monitoring laws has been brought to light, it could potentially result in lawsuits, fines, and damage to the reputation of the company. In certain cases, such violations may even result in criminal liability.

Can employers sue their employees using data from monitoring?

Yes, they can. However, while an employer can use the information and evidence gathered through monitoring software to take legal action against an employee, it is a bit more nuanced. For example, it is wise to keep in mind that if any laws had been violated during the monitoring, the employer could potentially face a counterclaim from the employee.

Are employers obliged to protect sensitive employee information?

Yes, they are. Even if such sensitive employee information comes from an employee’s personal browsing history or private data stored on a company-owned PC, employers bear the burden of protecting it. The company would fall vulnerable to litigation by the employee if a data breach occurs and exposes certain sensitive employee-related information.

Questions on the Employee’s Rights

What U.S. federal legislation protects employee privacy?

The basic legal background for employee monitoring is outlined in the Electronic Communications Privacy Act (ECPA), which prohibits employers from intentionally intercepting or disclosing oral, wire, and electronic communications of their employees. There are, however, two exceptions, which include the presence of a legitimate business reason for an employer to implement workplace monitoring, as well as the presence of an employee’s consent to such monitoring.

Another act that complements the ECPA and prohibits access to the contents of electronic communications is the Stored Communications Act (SCA). However, such restriction only applies to the communications where employees can have a reasonable expectation of privacy. And since company-owned devices at their core are not intended for personal use, it actually turns out that employers have every right to monitor information stored in their systems.

What other laws protect employee privacy rights?

In addition to the federal acts we’ve mentioned above, the constitutions of several states, such as California, Louisiana, Florida, South Carolina guarantee a right to privacy for all their citizens. There are also various state statutes that regulate certain aspects of data protection and electronic monitoring.

Moreover, the National Labor Relations Act (NLRA) prohibits the surveillance of employees who are engaged in protected union activities. The Fourth and Fourteenth amendments shield state and local government employees from workplace searches, however, that does not apply to the private sector.

Questions on State-Specific Employee Monitoring

When Is It Legal to Record Employees at Work in California?

Under California law, employers have the option to record their employees and even use surveillance cameras when such surveillance is in the interest of their business.

To specify, it means that employers can legally record their employees in public workplace locations, even such places as the break room or the corridors.

At the same time, California Penal Code forbids employers from putting surveillance cameras in such places as restrooms, showers, locker rooms, dressing rooms, bedrooms, or even tanning booths. Essentially, surveillance cameras are prohibited in those areas where employees might reasonably expect privacy. Of course, an employer can receive an exemption from these rules if they have a specific court order that authorizes such use of surveillance.

What’s more, under the federal National Labor Relations Act, employers are prohibited from recording employees while they’re participating in union or other protected activities, including union meetings.

What Is the New York Law Regarding Electronic Monitoring of Employees?

In accordance with the New York's Civil Rights Law, New York companies must give written notice of possible recordings of phone, email, or internet communications to their employees.

It is also worth mentioning that the law mandates that all private businesses must provide notice of their electronic monitoring practices to new employees upon hiring and obtain written acknowledgement of the monitoring. Each employer is also obliged to post a notice of the ongoing electronic monitoring in a place that is visible for employees who are subject to such monitoring.

This legislation applies to any business located in New York State, regardless of its size, which monitors employees’ email, telephone conversations, and internet usage.

What Are the Main Points of Workplace Privacy in Texas?

Texas companies need to be aware of the fact that Texas courts recognize the following three of the four common law invasion of privacy claims:

Intrusion Upon Seclusion of Another (which implies deliberate invasion of a person’s privacy by another party).
Public Disclosure of Private Facts (which entails publication of matters that concern private life of another person that would be highly offensive and is not of legitimate concern to the public).
Appropriation of Name or Likeness (which occurs when an individual’s name or likeness is used to promote a product or service without said person’s consent).

Another legislation that is worth mentioning here is Tex. Pen. Code 16.02, which prohibits intentional interception or even endeavor to intercept a wire, oral or electronic communication. The disclosure or use of the contents of said communication is also prohibited. The law, however, does allows such interception under certain circumstances, which includes interception in the ordinary course of business and interception when there is the prior consent of one of the communication parties.

Questions on the Electronic Communications Privacy Act of 1986 (ECPA)

Are employers authorized to monitor employees’ communications?

Yes, according to the ECPA, business owners have the authority to monitor all employee verbal and written communication. At the same time, the company needs to have a legitimate business reason for such monitoring.

Is monitoring of other types of employee activity authorized?

Yes, additional employee monitoring is not prohibited, provided that the employees have given consent to it. However, consent provision in terms of the ECPA can be tricky, seeing how it might be inferred to allow monitoring of employees’ personal and business communications.

Are employers authorized to go through employees’ emails?

Yes, employers are not legally prohibited from looking at sent employee emails. In addition to the ECPA defining “electronic communications” as any electronic messages in transmission, these transmissions, upon being sent, become “electronic storage,” which a number of federal courts have determined employers can monitor as well.

Questions on the General Data Protection Regulation (GDPR)

What is GDPR?

GDPR stands for the General Data Protection Regulation. It is a European Union law that governs the way in which we can use, process, and store information about an identifiable, living person – their personal data.

The full text of GDPR contains 99 individual articles, and the Regulation can be rightfully considered the world’s strongest set of data protection rules that enhances how people can access information about them and places limits on what companies can do with the employees’ personal data.

Do US-based companies need to comply with GDPR?

To a certain extent, yes. There are situations when companies must comply with the GDPR even if they don’t have their branches in European countries. Such compliment is required when a company has remote workers on the staff who are EU citizens.

Article 3 of the GDPR says that the regulations apply even to those data controllers and processors who are based outside the European Union whenever they monitor user behaviors taking place within the Union.

Thus, if employers wish to include their European staff in the workplace monitoring practices, they need to 1) come up with a legitimate business interest, 2) conduct a formal data protection impact assessment, and 3) receive explicit informed consent from the employees regarding the monitoring. The workers, in turn, have the right to withdraw their consent at any time, request access to the data gathered on them, and ask for deleting that information.

Questions on the Ethical Aspect of Monitoring

Is employee monitoring considered an invasion of privacy?

No, when done correctly, employee monitoring is not considered an invasion of privacy. Moreover, the Electronic Communications Privacy Act of 1986 (ECPA) protects employees against invasion of privacy by putting certain restrictions on workplace monitoring, such as prohibiting employers from intentionally intercepting the oral communication of their staff members.

Can employee monitoring be done ethically?

In all honesty, employee monitoring is as ethical as companies choose to make it. For example, it is rather understandable that if employers are tracking their employees’ whereabouts without their knowledge or accessing their private information via computer screen video recordings, they’re not really using the software in an ethical way.

The point is, it is entirely possible to make employee monitoring ethical, but it depends solely on the employer and their company’s values.

How to adhere to ethical employee monitoring?

To make monitoring as ethical as possible, it is important to be transparent with employees about it by telling them beforehand about the intent to monitor their PC activity, explaining exactly what will be monitored, how the acquired data will be stored and used, and so on. It’s also wise to keep in mind that monitoring an employee's every move signals distrust, which can essentially lead to employee disengagement, burnout, and overall increase of employee turnover.