Can your employer see what you do on your work laptop?

MacWindowsUpdated

Yes, an employer can monitor a work laptop, but in the UK only in a way that follows data protection law. The ICO says monitoring must be lawful and fair, and that apart from very exceptional cases, employers must tell workers about it. You also have rights to see what was collected and, in some cases, to object.

This is general information, not legal advice. For a real case, speak to a solicitor (or a lawyer in the US).

Quick answer

In the UK, your employer can monitor a work laptop if it has a lawful basis, the monitoring is necessary and proportionate, and it tells you. The ICO lists web browsing, emails, documents, app use, screen captures, webcam captures and keystrokes as things device monitoring can capture, but says webcam shots are particularly unlikely to be justified. You can ask for a copy of what's held about you.

What does UK law allow an employer to monitor?

The ICO's guidance, "Employment practices and data protection: monitoring workers", says data protection law doesn't stop employers monitoring workers, but they must do it in a way that's lawful and fair. It covers anyone who performs work for an organisation, whatever the contract, and it applies to people working from home.

The main requirements the ICO sets out:

  1. The employer must identify a lawful basis for the monitoring, and a further condition if it's likely to capture sensitive information such as health details or trade union membership.
  2. It must be clear about its purpose and document why the monitoring is justified, including what less intrusive options it considered. If it can achieve its aim in a less intrusive way, it must.
  3. It must carry out a data protection impact assessment, a DPIA, before any monitoring likely to cause high risk to workers.

The ICO also notes that the guidance is under review following changes made by the Data (Use and Access) Act, so details may change.

What can be monitored on a work laptop?

The ICO lists what device activity monitoring can include: web browsing, emails and messages, documents, use of applications, screen captures, webcam captures, and keystroke monitoring. It says employers are particularly unlikely to be able to justify capturing webcam shots or footage.

On email, the ICO says an employer must complete a DPIA before monitoring emails and messages, and must tell workers in advance, for example in policy documents, if it may look at content in exceptional circumstances. It must not access content unless it has a clear policy explaining when that may happen. The ICO adds that it would be difficult to justify reading content if monitoring network traffic would meet the purpose.

Even where an employer bans personal use of a system, the ICO says the ban would not entirely justify accessing the content of personal messages.

Does my employer have to tell me?

Yes, apart from very exceptional cases. The ICO says employers must tell workers about any monitoring in a way that's accessible and easy to understand, and must tell them when they introduce changes. It says monitoring without transparency is unfair.

Covert monitoring is the exception, and the ICO sets a high bar for it:

  1. It's unlikely to be justified in most usual circumstances. One example of where it might be is preventing or detecting suspected criminal activity or gross misconduct.
  2. A DPIA must be carried out, and it should be authorised by senior management.
  3. It should be targeted, limited to the shortest time possible, and stopped when the investigation ends.
  4. It shouldn't use audio or video in places where workers would reasonably expect privacy, such as toilets or changing rooms, and in most circumstances shouldn't capture communications workers would expect to be private, such as personal emails.

What about my own phone, or working from home?

The ICO says monitoring can be particularly intrusive if workers are using their own devices, and that employers should make sure they aren't capturing private use of a personal device used for work.

At home, the ICO says workers' expectation of privacy is likely to be significantly greater than in the workplace, and the risk of capturing information about family and private life is higher.

How can I find out what's on my work laptop?

Ask. Your employer's privacy information should explain what it monitors and why, and IT can tell you which tools are installed. You can also check two things yourself.

  1. On a Mac, choose Apple menu > System Settings, click General, then click Device Management. Apple says you can double-click a profile to see information about it, and that if you can't remove a profile, you should ask the person who provided it.
  2. If your employer uses Microsoft Intune, Microsoft lists what enrolment does and doesn't show. It says the organisation can't see browsing history, email and text messages, passwords or the content of documents you create through enrolment, but can always see details such as the device name, model and serial number. On a corporate-owned Windows device, it can query details including file names and event log entries.

That list covers Intune enrolment only, so check your employer's policy for any other tools.

What are my rights?

The ICO sets out three that matter most here.

  1. The right to be informed. You're entitled to clear information about any monitoring.
  2. The right of access. The ICO says an employer must make personal information collected through monitoring available to you if you make a subject access request, unless an exemption applies. The ICO says it must respond within one month at the latest, which can be extended by up to two months if the request is complex.
  3. The right to object. You can object to monitoring where the employer relies on legitimate interests or a public task, giving reasons based on your situation. It isn't absolute: the employer can refuse if it can show compelling legitimate interests that override yours, but it must tell you and explain that you can complain to the ICO.

If you think the monitoring breaks data protection law, complain to your employer first, then to the ICO. Our guide on how to report snooping at work sets out the steps.

What about the US?

One US example: New York's Civil Rights Law section 52-c requires an employer with a place of business in the state that monitors employees' phone calls, email or internet use to give prior written notice on hiring, which employees acknowledge, and to post the notice where they can see it. The state attorney general may enforce it, with civil penalties of up to $500 for a first offence, $1,000 for a second and $3,000 for each one after.

More questions

Can my employer see my browsing history on a work laptop?

It can, if it uses a tool that captures it. The ICO lists web browsing among the things device monitoring can include, and says employers must tell workers about it. Microsoft says enrolment in Intune alone doesn't show your browsing history, so it depends on the tools your workplace uses.

Can my employer read my personal emails?

The ICO says that in most circumstances covert monitoring shouldn't capture communications workers would reasonably expect to be private, such as personal emails, and that even a ban on personal use would not entirely justify accessing the content of personal messages.

Can I put my own security software on my work laptop?

Ask IT first. The NCSC tells staff that settings configured by their system administrator help keep information secure.

Can I use Failshot on my work Mac?

Only with your employer's agreement. It's their device, and they're responsible under data protection law for any monitoring on it. For Failshot, that also means they've agreed Failshot's Organisation Terms and told everyone who uses the laptop before Failshot is turned on.

Does my employer need my consent to monitor me?

Not usually. The ICO says consent is not usually appropriate at work because of the imbalance of power, as workers are likely to feel they have no choice but to give it. The employer still needs a lawful basis, and where it's legitimate interests, you can object and they must weigh your reasons.

Sources