Workplace surveillance and AI

The CIPD has been asked by the committee to provide evidence on some key questions relating to workplace surveillance and AI. We have outlined our answers below:

1. Do, and if so, why do employers use surveillance and AI?

Surveillance is a loaded term compared to monitoring or measuring performance. In the workplace, employers do monitor their workers’ performance on the job and compliance with company policies. Employers may use AI-embedded software to do the monitoring. For example, it’s common for employers to have a written IT policy that outlines appropriate internet use at work and that the monitoring software will flag inappropriate use to management. CIPD research found four in ten bosses said their organisations use software to monitor home workers’ productivity.

2. What are the benefits/disadvantages of using surveillance and AI?

When used appropriately, AI can efficiently monitor workers’ performance and compliance with company policies consistently at scale. In roles where performance review is structured, regular and personalised performance feedback by AI has been shown to be an effective management tool for promoting employee growth and creating a good work atmosphere. AI has helped managers to intervene early to support workers by spotting signs of burnout from observing email traffic data. It has helped with health and safety compliance, e.g. operators at printer company wear a device at least once a year to check that they’re lifting boxes correctly and not injuring their backs.

The problem with some methods of monitoring (with or without AI) is that it can be seen as irrelevant, unnecessary or too intrusive for ensuring performance or compliance.

Perhaps the employer is not measuring the right indicators. Perhaps workers feel that the data collected encroaches on their private life. Perhaps workers are OK for HR but not their line managers to see the data collected (see RICOH case study in Stage 4 of CIPD responsible investment in technology guide)

CIPD research showed that many workers have concerns about the use of technology to monitor the workplace. Our survey found that the majority (73%) of employees felt that introducing technologies to monitor the workplace would damage trust between workers and their employers. Around two in five employees (43%) expressed concerns that the introduction of workplace monitoring technology could make it easier for their privacy to be violated.

3. What obligations does the current law place on employers?

Under UK GDPR, employee consent is required if employers don’t have a lawful basis for processing the personal data. If there is a lawful basis (e.g. a legitimate interest) then employee consent is not required to collect their personal data but they still do need to be informed what’s being monitored and why. For example, telling a call centre agent that their voice calls at work are recorded to assess their performance is a legitimate interest and is less intrusive than recording their video while on a call. Covert monitoring can only be done in exceptional circumstances such as where there are grounds to suspect gross misconduct. Employers are also required to conduct a data protection impact assessment to show how they comply with their obligations. See ICO and gov.uk guides for more information.

4. Does the current law strike the right balance between workers’ rights to privacy and employers’ freedom to manage their workforce?

Yes, but tensions lie in the grey areas. What is considered a relevant and necessary monitoring measure for an employer and what is considered intrusive to an employee is context dependent. CIPD research found over half (55%) of the 2,119 bosses we surveyed agreed with at least one of eight monitoring measures suggested for home workers, but there was no strong consensus on which way was more acceptable. The top three acceptable ways of collecting information about home workers were: tracking the amount of time spent on billable tasks for a client (24%), observing email sending behaviours (but not email content) to identify whether the employee is at risk of burnout (24%), recording how much time they’re using their work laptop everyday (22%).

5. If the use of surveillance and AI in the workplace were regulated more what impact would this have on employers and workers? Would greater regulation necessarily lead to a decrease in productivity?

It depends on the details of the regulation and how much burden is placed on employers to show that they’re compliant. The AI-embedded monitoring software may be bought from a software vendor, in which case requiring vendors to have product certification for high-risk use (e.g. negatively impacting people’s livelihoods) can help reduce the compliance burden on employers. Regulation can be a mechanism to formally define minimum standards for good practice, provide some clarity for everyone and sanction those who fail to comply.

6. What improvements, if any, should be made to the current framework? What impacts would those changes have on employers/workers?

More examples would be helpful to increase clarity and normalise what is seen as good practice and in which situations. In particular in the grey areas where an employer believes they have a legitimate interest to monitor their worker but the worker feels the method is too intrusive. This could be done through expanding ICO or gov.uk’s existing guides or a more formal statutory code of practice. The question of what changes should be made to the current framework would also benefit from a discussion with GDPR and data protection lawyers.

(October 2023)