Privacy in the Workplace: Legal Considerations of Surveillance at Work

Brian Garrett headshot
Brian B. Garrett
Director, Litigation Department and Chair, Education Law Practice Group
Published: New Hampshire Business Review
March 24, 2023

As technology continues to advance, so does the capability for employers to monitor the workplace.  From video surveillance to keystroke tracking and social media monitoring, there are many ways employers can surveil the safety and productivity of their workforce.  With various ways to track the workplace effectively, it is important for employers to consider the potential legal implications of these practices.

Legal Framework for Workplace Surveillance

In general, employers can lawfully monitor employees in various manners, but it is helpful to understand the tapestry of federal and state legal restrictions—including privacy, geolocation, and biometric laws—that apply to workplace surveillance.  For example, New Hampshire has a broad privacy statute (RSA 644:9) that prohibits non-consensual surveillance in any “private place” where one may reasonably expect to be safe from surveillance, such as restrooms or locker rooms.  New Hampshire’s wiretap law (RSA 570-A:2) also prohibits non-consensual recording of any oral communication, which could be implicated by video surveillance of a workplace that additionally captures audio.

A growing number of states outside of New Hampshire also have broad privacy laws that impose obligations on the collection and use of personal information about individuals, including images, video recordings, or biometric data of them.  These laws require companies to notify, obtain consent, and afford rights to individuals regarding their personal information before collecting and using it.

Federal statutes like the Electronic Communications Privacy Act of 1986 (ECPA) and its amendment, the Stored Communications Act, protect the privacy of electronic communications, such as emails, text messages, and stored data, from unauthorized access by third parties, including employers.  Two primary exceptions to the ECPA include:  (1) if the employer can demonstrate a legitimate business purpose for monitoring oral and electronic communications; and (2) if the employee provides consent for an employer to monitor electronic communications.

Further, unionized employers may have additional restrictions to monitoring the workplace—the National Labor Relations Board has held that the ability for employers to impose such workplace monitoring must typically be the subject of collective bargaining and be agreed to by the union.

Practical Steps for Appropriately Monitoring the Workplace

Employers can take practical steps to monitor the workplace appropriately and minimize legal risks.  The first step to consider is to audit any forms of surveillance, including what information is being monitored, where, and why.  In assessing such surveillance measures—or if employers are considering adding new measures—employers should consider whether such practices are reasonable and narrowly tailored to achieve a legitimate business purpose.

Employers should also provide notice to employees that the employer is conducting the surveillance.  Employers can effectuate such notice in various ways:

  • Incorporating policies into employee handbooks about the use of workplace surveillance, including a statement about the forms, locations, and purpose of any monitoring, as well as the procedures the employer incorporates to protect the privacy and security of any information collected or stored;
  • Sending written notices to the workplace outlining the forms, locations, and purposes of any monitoring; or
  • Making security cameras exposed and easily seen, including by posting conspicuous signs, either next to cameras or elsewhere in the workplace, indicating that the employer implements video surveillance.

By providing the above forms of notice, employers could claim they received implied consent from employees to engage in workplace surveillance.  Alternatively, employers could seek an express, signed consent from employees to monitor the workplace, thereby providing an additional layer of protection.  Such consent could be obtained by having employees execute an acknowledgment that specifically identifies the sections of the employee handbook that contains the policies outlined above and the employee’s agreement to those monitoring policies.

Regarding video surveillance, many states, like New Hampshire, require two party consent to record audio.  Therefore, security cameras should not capture audio of employees’ conversations, which could implicate applicable wiretapping statutes and potentially be considered a crime.  Similarly, employers should confirm whether such video recordings capture biometric information, such as facial characteristics, which receives privacy and/or security protection in a growing number of states outside of New Hampshire.  Video surveillance should also be limited to the least intrusive time, place, and method to serve the employer’s legitimate business purpose.

Employers should also consider a plan for retaining any recordings and responding to requests for such materials.  Through this process, employers could determine whether surveillance tapes record in a loop or are retained for a period of time before being automatically deleted.  If a security event or injury occurs, or if a request has been made for a recording, employers should take steps to immediately preserve the recording and isolate it from any routine deletion process until a disclosure determination is made.  Failure to preserve may result in court ordered sanctions.

Finally, employers should carefully assess whether the benefits of increased surveillance outweigh the potential negative impact on employee morale.  Employers may want to consider alternative ways to achieve their goals without intruding on their employees’ sense of privacy and autonomy.

Overall, employers must consider various legal implications before implementing any surveillance in the workplace.  By taking practical steps and following legal requirements, employers can help reduce legal risks and protect their business interests while respecting the privacy rights of their employees.  Consultation with legal counsel is recommended to ensure compliance with applicable laws and regulations.