Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what discussions he has had with the Secretary of State for Digital, Culture, Media and Sport on protecting workers from intrusive monitoring, including monitoring eye movements and toilet breaks; and what protections employees have in respect of that monitoring.

Employers are neither expressly permitted to monitor, nor are they prohibited from doing so. Monitoring by employers must not breach the duty of trust and confidence implied into an employee's contract of employment and must comply with the European Convention of Human Rights, Data Protection legislation and Equality Act 2010.

Organisations that process workers’ personal data for the purposes of monitoring their activities or surveillance must comply with the requirements of the UK General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018 (‘DPA’). This means that the data processing must be fair, lawful and transparent.

Any adverse impact of monitoring on individuals must be necessary, proportionate and justified by the benefits to the organisation and others. A Data Protection Impact Assessment (DPIA) would usually be required, particularly where the processing involves the use of new technologies, or the novel application of existing technologies. Where organisations are operating behavioural biometric identification techniques such as through keystroke analysis or gaze analysis (eye tracking) they would generally need to conduct a DPIA.

The UK GDPR and the DPA are administered and enforced independently of the government by the Information Commissioner’s Office (ICO). The ICO publishes a range of advice and guidance for organisations on their data protection obligations including specific guidance for employers here.

The ICO ran a call for views seeking stakeholder and public input into future guidance on data protection and employment practices and has published a summary of responses here. The ICO is now acting on the feedback received and creating products that they will be consulting on and publishing on an iterative basis. The products will form a new, more user friendly hub of employment guidance.

Regular discussions are held across the government on all aspects of data protection.