The Ultimate Guide to Employee Monitoring

Employee monitoring is no longer exclusively a top-down initiative. 92% of workers are open to being monitored by their employers, but only if it used to provide benefits for their personal performance and well being.¹

In today’s privacy-conscious world employers need to monitor employees in a way that is transparent, minimally invasive, and respectful of employee privacy. They need to carefully balance the demands of organizational productivity, employee privacy, and regulatory compliance requirements surrounding the storage, use, and protection of their employee’s data. 

If you want to join the 94% of organizations that use employee monitoring to gain actionable workforce insights you need to set yourself up for success by adopting a privacy-first employee monitoring strategy.²

This white paper outlines the benefits of monitoring employee computer usage and provides actionable tips for creating an employee monitoring strategy that respects employee privacy, protects sensitive data, and provides tangible insights you can use to manage your workforce.

Trend #1

The Rise of Remote Workers

There has been a demand for remote work well before COVID-19 forced businesses to adopt it on a global scale. The 2019 State of Remote Work report by Owl Labs found that nearly two-thirds of U.S. workers work remotely at least some of the time. Greater than 50% of the on-site workers surveyed want to work remotely in the future.³

Recent findings confirm that COVID-19 is going to have a lasting impact on the future of work.  74% of CFOs surveyed by Gartner in March of 2020 plan to convert part of their workforce to permanent remote positions.⁴ Employee demand for flexible work arrangements is also high, with 76% of employees surveyed by Global Workplace Analytics in 2020 wanting to continue working from home.⁵

The 2018 Insider Threat Report from Cybersecurity Insiders found that 94% of organizations deploy some method of monitoring their users.⁶ Employers need to be mindful of how their monitoring practices are perceived by employees that are working from the privacy of their homes.

Trend #2

The Data Privacy Revolution

Consumers are becoming more aware of how their privacy is being affected in our modern world. Social media networks, search engines, and nearly every major website have built core business processes around the collection, analysis, and monetization of consumer data. 

Privacy advocates want greater control over their data. They want a say in how their data is being collected, used, and stored. This demand has contributed to data privacy legislation such as Europe’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Employees want to know how their computer usage data is being collected, protected, and used. A successful employee monitoring initiative needs to work with employees to address these uncertainties.

Trend #3

Rapid Workforce Digitalization

The internet has positioned itself as the cornerstone technology that enables modern businesses. Unfortunately, misuse of the internet by employees can also lead to severe consequences. Internet abuse creates opportunities for harassment, reduced productivity, and cybersecurity threats.

Computer monitoring software serves as a critical tool for deterring undesirable behaviors in the workplace. A 2019 study published by the National Center for Biotechnology Information found that awareness of security measures such as monitoring computer activities increased compliance with policies designed to protect electronic medical records.⁷

Businesses that don’t monitor employees take on significant risks. A lack of visibility into workplace technology usage provides bad actors with the opportunity to abuse their privileges undetected.

1. It Detects Employee Disengagement

Actively disengaged employees cost the U.S. up to $605 billion each year in lost productivity.⁸

By monitoring employees an organization can discover early warning signs of disengagement such as excessive unproductive web browsing. 

An important caveat is that not all non-work web activity is a definitive sign of disengagement. Personal browsing has even been found to have a positive impact on productivity so long as internet browsing did not consume more than 12% of work time.⁹

For the optimal balance between autonomy and productivity employee monitoring software can be used to confirm if personal browsing is within reasonable limits.

2. It Drastically Reduces Software Expenses

Underutilized software cost businesses in the US and UK an estimated $34 billion per year.¹⁰

Employee monitoring detects redundant or underutilized software that can be decommissioned or consolidated. Businesses that track utilization rates will improve their capital efficiency and protect against application sprawl.

3. It Provides Valuable Workforce Insights

Historical employee monitoring data is critical for identifying workforce trends.

• We have departments with consistently high utilization rates. Are they overworked? Is there an opportunity to grow the company in this area?
• Are employees making use of the new software we recently implemented? If not, do employees need more training?
• How engaged are our employees? Do they spend the majority of their time on-task?

Business intelligence tools such as Tableau or BigQuery provide further insights by combining raw computer activity data with other metrics that are relevant to the organization.

4. It Protects Businesses From Shadow IT

Gartner predicted that by 2020 a third of successful attacks on enterprises would be shadow IT exploits.¹¹ 

Shadow IT refers to any system, solution, or software that’s used without approval from the IT department. This lack of oversight is a unique threat to an organization’s cybersecurity. 

Software usage data allows security teams to detect the use of shadow IT in the organization. Once detected they can be officially adopted, blocked from use, or substituted with viable alternatives.

5. It’s a Crucial Data Loss Prevention Tool

58% of data loss events in healthcare involve insiders, making insider threats the single greatest data security threat for the industry.¹²

Organizations that collect, process, and/or store sensitive data are responsible for the security and integrity of that data.

With the average total cost of a data breach being an estimated $3.86 million organizations rely on employee monitoring to detect and deter high-risk behavior.¹³

Data theft is not unique to entry-level employees and management either. A 2018 report by data loss prevention company Code42 found that 72% of CEOs admit they’ve taken valuable intellectual property (IP) from a former employer.¹⁴

Monitoring activity on data egress points such as USB storage devices and file sharing websites is crucial for detecting and preventing data theft.

6. It Reduces Legal Liability & Protects Staff

Electronic monitoring software is rated as the most effective deterrent of inappropriate web use in large firms¹⁵

Internet abuse in the workplace presents a significant risk if left unaddressed. Employees that visit hateful, pornographic, or otherwise harmful websites while at work create a hostile work environment for their coworkers.

Failure to monitor for and address this type of behavior undermines organizational performance and creates serious legal liabilities for employers.¹⁶

While internet use policies set standards for internet use in the workplace, without some form of electronic monitoring employers risk being unable to detect and deter egregious web browsing.

Be Transparent About Employee Activity Monitoring

Employees that are not aware that they are being monitored, why they are being monitored, and how they are being monitored are less likely to find employee monitoring acceptable.¹⁷

Fortunately 84% of employers surveyed by the American Management Association follow the best practice of notifying their employees that they monitor and review computer activity.¹⁸ 

Covertly monitoring employees leads to higher employee turnover and increased levels of stress.¹⁹ This creates perceptions that their employer is spying on them and unfairly scrutinizing their every move.  

An effective employee monitoring strategy empowers employees. They need to know that it’s being implemented for tangible benefits rather than stemming from a lack of trust in their ability to self-manage.

Starting with transparency at the forefront gives employees an opportunity to find out whether or not their employers data collection is fair, minimally invasive, and beneficial for them.

“Employers must not use tech to control and micromanage their staff. Monitoring toilet breaks, tracking, and snooping on staff outside working hours creates fear and distrust. And it undermines morale.”

– Frances O’Grady, General Secretary of the British Trades Union Congress ²⁰

Determine the Required Scope of Monitoring

Creating a privacy-first employee monitoring program requires significant forethought.

It needs to have a clearly understood purpose and an implementation that is minimally invasive for the intended outcomes. Part of this process is determining the organization’s goals and the metrics they need to achieve those goals. 

Organizations that are subject to GDPR use a Data Protection Impact Assessment (DPIA) to evaluate their proposed solution against the potential impacts it may have on employee privacy.²²

A DPIA demonstrates the employer’s commitment to the GDPR principle of proportionality, which stipulates that the solutions used to further the legitimate interests of a data controller (employer) must not exceed the potential impacts on the data subject (employee).

Even if your organization is not legally required to use a DPIA it will serve as an important baseline when planning your privacy-first employee monitoring program.

“If organisations wish to monitor their employees, they should be clear about its purpose and that it brings real benefits. Organisations also need to make employees aware of the nature, extent and reasons for any monitoring”

– Spokesman from the UK’s Information Commissioner’s Office²³

Best Practices for Reducing Privacy Impacts

• Do not track more than necessary. Only collect, store, and use the types of data that are adequate and relevant for the stated purposes. Overly invasive monitoring methods such as capturing individual keystrokes and webcam feeds are highly likely to infringe on employee privacy rights unless there is a legitimate business need that cannot be adequately met through less invasive methods.
• Only use monitoring for the stated purpose. Lack of predictability leads to increased perceptions of invasiveness among employees. By using employee monitoring data for its stated purpose employers improve their employee’s trust that the system is being used fairly and responsibly.²⁴
• Do not monitor personal devices. Employees have a reasonable expectation of privacy on their personal devices, even if they use them for work purposes. Employee monitoring solutions that limit data collection to work hours can reduce privacy impacts, though the potential to capture personal computer activity may remain a concern.
• Limit data accessibility & retention. Computer usage data may be sensitive. Restricting access to monitoring data to a “need to know” basis limits opportunities for misuse. Employers may also be required to store data for a predetermined period as part of their industry compliance standards. Periodically culling data that is no longer relevant reduces the employer’s liability by reducing the amount of data that would be leaked following a data breach.

Use Monitoring Data Fairly

The perceived privacy impacts of an employee monitoring solution are significantly impacted by how the data is used.

Employee monitoring is best received when the collected data is used for learning and developmental purposes.²⁵

By using monitoring data for the employees benefit employers greatly increase the likelihood that the proposed solution will be perceived as fair. 

Best Practices For Using Monitoring Data

• Avoid singling out individual employees. Singling out individual employees creates perceptions of unfairness that lead to decreased job satisfaction.²⁶ Employers can improve the acceptance of their monitoring program by monitoring across their organization and referencing aggregated data for insights rather than addressing the usage of specific employees. Addressing the monitoring data of individuals should be reserved for instances of high risk and clearly objectionable behaviors such as accessing pornography or engaging in illegal activities. 
• Monitor employees equally. To avoid perceptions of discrimination, employees in similar roles should be monitored and assessed equally. This can be extended further by including managers in the monitoring ecosystem.
• Do not use computer activity data as the sole indicator of performance. Even if the majority of an employee’s role involves the use of the computer it is normal for a productive employee to have periods of time where they are temporarily inactive on their workstations as they can be engaged in other job-adjacent tasks.
• Understand the limitations of employee monitoring. Computer usage data does not always provide full context for the activities captured. Seemingly unproductive or unacceptable usage behaviors may have greater relevance to the organization than can be readily determined through the exclusive use of computer monitoring.
• Do not make significant decisions solely based on employee monitoring data. Decisions that have a significant effect on employees such as promotions, job retention, and salary negotiations should not be made solely using employee monitoring data. These types of decisions require human intervention and external factors to ensure that the evaluation is fair, accurate, and adequate.

Protect Employee Monitoring Data From Misuse

Employee monitoring data can be highly sensitive depending on its nature.

Organizations need to ensure that security measures are in place to prevent their employee’s data from being misused or leaked to unauthorized parties.

Shady Maple Follows Best Practices 

Shady Maple is a farm market and fresh produce distributor based in Eastern Pennsylvania, USA. They use employee monitoring and web filtering software to manage employee productivity and enforce the acceptable use of technology in the workplace.

Barclays’ Lack of Transparency Backfires

Barclays is a bank based in the UK. As they process data of European citizens they are expected to be compliant with GDPR’s data processing requirements.

A lack of transparency surrounding their employee monitoring practices prompted an investigation in August of 2020 by the Information Commissioner’s Office (ICO), the United Kingdom’s privacy watchdog. ^28-30

“The stress this is causing is beyond belief. It shows an utter disregard for employee wellbeing. Employees are worried to step away from their desks, have full lunch breaks, take bathroom breaks or even get up for water as we are not aware of the repercussions this might have on our statistics.”

– Barclays whistleblower via City A.M.

Ready to start monitoring your remote and in-office employees?

Try a free trial of CurrentWare today

• Monitor & manage internet use to improve employee productivity
• Control USB devices to protect sensitive data against theft
• Block dangerous websites to improve the security of your network

CurrentWare’s solutions are advantageously priced and simple to use. Want to learn more? Contact us by phone, email, or live chat.

About CurrentWare

CurrentWare is a software company that provides a suite of workforce management solutions for computer monitoring, content filtering, data loss prevention, and remote power management.

CurrentWare’s solutions are adopted by a wide array of government and private organizations including schools, hospitals, libraries, and for-profit businesses. CurrentWare customers improve their user productivity, data security, and business intelligence with advanced awareness and control over how technology is used in their organization.  

 CurrentWare Inc.
92 Wanita Road
Mississauga, ON
L5G 1B8
Canada

1-888-912-9619

Disclaimer
The contents of this white paper are intended to convey general information only and not to provide legal advice or opinions. The contents of this paper should not be construed as legal advice. CurrentWare advises consultation with legal counsel and/or an attorney for advice and legal opinion on specific legal issues.

Illustrations provided by Storyset by Freepik