Monitoring employee conversations: Drawing the line between privacy and protection

Update: This piece was updated 04/10/2019 to reflect recent survey results.

Back in 2015, we ran a survey to get business owner opinions about monitoring employee conversations on internal communication tools. The results came back with a “less is more” attitude: 43% of respondents said they do not monitor employee conversations on internal chat tools, believing it to be an invasion of privacy.

Employee monitoring laws are complex at best. Where they’re not regulated by industry or geography, they’re open to interpretation and conjecture. As a result, companies struggle knowing how much is too much when it comes to monitoring employee conversations.

As data privacy concerns continue to make headlines and GDPR continues full speed ahead, we wanted to see if employers had the same cautious approach to monitoring employee conversations in 2019 as they did four years ago.

We recently ran an expanded version of the same survey, asking 173 respondents in management positions or above how they felt about monitoring employee conversations. To our surprise, respondents were far less likely to consider monitoring employee conversations as invasive: Compared with 43% in 2015, only 10% of respondents believed it to be an invasion of privacy in 2019.

With so much at stake, businesses need to find the right balance between protecting their company without infringing on the privacy of their employees.

What we'll cover:

• The results: then and now

• Monitoring in popular chat tools

• Navigating employee monitoring laws

• Best practices for monitoring employee communication

By all accounts, businesses are keeping a close eye on employee conversations as a way to protect their company and ensure productivity.

Summary of key findings from our 2019 survey

• 47% of respondents monitor employee conversations on a daily or weekly basis

• 38% of respondents believe that monitoring employee conversations is necessary to protect their company

• Nearly 30% of respondents say they monitor employees to ensure productivity

Of the 173 respondents surveyed, 72% have access to employee conversations taking place on internal communication tools. This is a jump from 2015, when only 56% of respondents had access to online employee conversations.

Notably, the frequency of time spent monitoring employees has also increased. Almost 50% of respondents who monitor employee conversations in 2019 say they do so on a daily or weekly basis, more than double the percentage who monitored with similar frequency in 2015.

What accounts for this jump? It’s likely a combination of factors, including but not limited to:

• Technological advancements: Technologies for employee monitoring have improved over the past four years, making it less invasive and more cost effective for companies to deploy monitoring tools or adopt tools with built-in monitoring features.

• Shifting work culture: Trends toward remote working and the gig economy make it more difficult to physically monitor employee activity.

• Regulation and data privacy: Revamped regulations such as GDPR make companies more cautious about employees sharing sensitive customer data.

A growing number of employers are more interested in tracking the effective conversation flow of their employees' emails versus the actual content. This video explains one "not-so-creepy" reason companies monitor chats.

Our survey results support these last points. Nearly 30% of respondents said they monitor employees to ensure productivity, while 25% say they want to ensure that their employees are adhering to internal communication policies.

According to our research, the three most popular chat apps being used by small business are Google Hangouts, Skype or Skype for Business, and Slack.

Here’s how monitoring plays itself out in each one.

• Google Hangouts stores chat history in Gmail. Administrators can set rules so that users cannot change this setting, but the storage settings can be turned off by administrators so that chat history is not archived in Gmail.

• Skype and Skype for Business (formerly Lync) has monitoring features , mostly used for monitoring quality of experience and call detail recording. Skype for Business has more robust monitoring features, which include access to past conversations.

• Slack allows varying degrees of access based on pricing plans. Administrators on the free and standard plan require a legal process and employee consent to export personal conversations, while Plus plan admins have access to a self-service tool which allows export of all data (including private direct messages between employees).

Where there are gaps in access, third-party tools can use a combination of screen monitoring and key logging to monitor not just employee conversations but any employee activity on their workstation.

The key to monitoring is to find the right balance. To do that, you need to know the laws.

It’s hard to definitively say how much is “too much” when it comes to monitoring employee communication.

Consider the landmark case of Bărbulescu v. Romania to get an idea of just how complex the subject of employee workplace monitoring can get.

Former employee B

ă

rbulescu was terminated after his company (Romania) found him engaging in online personal communication during work hours. This was strictly prohibited, and the company made explicit that his communication would be monitored to thwart this type of behavior.

 

B

ă

rbulescu appealed his termination, denying having had private conversations at work. The appeal was unsuccessful, as the company was able to prove that he was having these conversations with transcripts of chats that were collected while monitoring him.

 

These transcripts led B

ă

rbulescu to once again challenge his dismissal, this time for a violation of Article 8 of the European Convention on Human Rights, which encompasses the right to respect for private and family life, including through correspondence.

 

In 2016, the court sided with the company, saying that it was not a violation of Article 8, predominantly because the possibility of monitoring had been disclosed to Bărbulescu upon employment.

 

In 2017, however, the case was overturned and came out in favor of Bărbulescu, stating that Article 8 had in fact been breached. Although the monitoring had been disclosed, the scope of monitoring and the degree of intrusion were not justifiable by legitimate means.

If even the courts have trouble defining what an acceptable level of monitoring is, how do small businesses navigate the nuanced world of employee monitoring? Very carefully.

No clear-cut rules

There’s a level of necessity for compliance in heavily regulated industries such as finance, where anything communicated within and between companies can (and in some cases should) be monitored. For everyone else, the waters get a bit murky.

Privacy laws protect employees to a certain extent, but business is one exception where privacy rules and regulations aren’t always applicable.

Some of the most common reasons for monitoring employees can include:

• Protecting proprietary company information

• Checking for violations of company policy in regards to personal use of company hardware

• Investigating complaints or claims of harassment or misconduct

• Investigating potential criminal activity by employees

• Accessing necessary business information that only certain employees have

Europe and Canada have notably more stringent regulations when it comes to privacy and data protection, while the United States takes a more lax attitude. Certain states and provinces can have their own privacy rules as well.

Here’s a summary of some of the regulations around data privacy in the United States, Canada, and the United Kingdom and how they might be applied to monitoring employees in the workplace.

Privacy laws by country

The general sentiment is that companies with a legitimate business purpose can monitor employees. In Canada and the United Kingdom, full disclosure is necessary unless in extenuating circumstances, but it’s not a requirement in the United States, except in certain states.

Things can get dicey when issues arise, especially if personal communication is involved. Following some best practices will put your organization in a good position to be able to protect itself while respecting the privacy of your employees.

Company culture has a lot to do with whether your employees perceive monitoring as invasive. Being transparent from the beginning will ensure that employees don’t feel as if they are “being watched.”

Things to keep in mind when monitoring employee communication:

• Set usage rules: If you don't want employees to use company-owned devices for personal use, tell them. Outline what is and is not acceptable use so that there are no gray areas (or the gray areas are smaller).

• Make monitoring explicit: Tell your employees from the outset that you're going to be monitoring conversations. Write it in their employment contract so there's no dispute about disclosure if issues arise.

• Block specific sites: If you're worried about employees wasting too much time on social networks or other sites, block these sites completely to avoid spending time looking to see if employees are using them.

• Adopt a "less is more" attitude: Unless you notice productivity issues, suspect abuse of company owned machines, or are investigating specific issues, err on monitoring less rather than more. It's no longer 2015, but having a more cautious approach to employee monitoring will help you avoid potential privacy infringement.

Think your business could benefit from monitoring employee conversations?

Visit our product catalog

Methodology

GetApp ran a survey via Amazon Mechanical Turk in March 2019 to collect the data in this survey. As prerequisites to take this survey, all respondents had to live in the U.S., work full-time at a company with fewer than 200 employees, and be in a management level or above, with access to employee communication on internal chat tools. The survey asked a series of 10 multiple choice questions and received a total of 173 qualified respondents.

The 2015 comparison data was collected through an online survey of 500 business owners.