Monitoring employees working from home

Does the law apply to home workers?

Yes. The ICO's guidance on monitoring workers says homeworking does not count as personal or household processing, so it falls within the guidance and UK data protection law in the usual way. It also says monitoring can cover work done elsewhere than your premises and outside working hours, which is exactly what remote monitoring software can do if it is not configured carefully.

What changes is the balance. The ICO notes that Article 8 of the Human Rights Act 1998, the right to respect for private and family life, is increasingly important because of the rise of homeworking. It says workers' expectations of privacy are likely to be significantly greater at home than in the workplace, and that the risks of capturing information about their family and private lives are higher. It also observes that it is not always easy to tell workplace and private information apart when people work from home. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.

What the ICO expects for home workers

The general rules apply, with extra weight on a few of them:

• Least intrusive means: be clear about your purpose and choose the lightest method that achieves it.
• DPIA: carry out a DPIA, and consider everyone your monitoring might capture, which the ICO says includes household members when workers are based at home. See employee monitoring DPIAs.
• Transparency: tell home workers exactly what is monitored and when.
• Webcams: the ICO says webcam capture is particularly unlikely to be justified.
• Personal devices: device monitoring is particularly intrusive on personal devices, and you should not capture private use. See monitoring employees' personal devices.
• Fairness and accuracy: workers should be able to see and challenge results, and data analytics can draw wrong conclusions.

The ICO's webcam example

The ICO gives a remote working example that is worth quoting in substance. An employer finds that a small number of remote workers started later than their timesheets said, and rolls out device monitoring that lets senior managers see automatic webcam images to check whether people are at work.

The ICO says this is likely to infringe data protection law because it is disproportionate and there are less intrusive ways to check start times. The same purpose could be met by checking when workers log on to the computer system and giving them the chance to explain any discrepancies.

The lesson applies beyond webcams. Before you switch on screen recording or keystrokes for home workers, ask whether log-on times, application usage or team-level reports would answer the actual question. Teramind does not record webcam video; its camera usage channel reports when a webcam is in use and by which application. Teramind notes, though, that if screen recording and audio are switched on they will capture a video call window and its sound, so for home workers that is another reason to keep screen capture narrow and audio off.

Lighter options that often meet the need

Common reasons for monitoring remote staff, with less intrusive ways to approach them:

The remote employee monitoring software page covers the features themselves, including the Remote Workforce Activity and Hybrid Workforce Monitoring views.

Teramind settings that respect home life

When we set Teramind up for home and hybrid workers, these are the settings we suggest considering:

• Working-hours schedules: monitor only during agreed hours, so evenings and weekends on a shared or family-adjacent device are not captured.
• Revealed agent: workers clock in and out, so monitoring runs only when they say they are working; it suits contractors and people who want clear boundaries. See the Teramind agent.
• Exclusions: personal banking, health, family and similar sites excluded, with excluded windows blacked out in recordings.
• Private browsing: Teramind's option not to monitor private browsing stops logging URLs and keystrokes in Incognito or InPrivate windows and treats them as excluded on screen.
• Lighter screen capture: live view only, or video saved only when a rule is broken, instead of continuous recording.
• Audio off: the ICO says any capability to record audio should be switched off by default, and Teramind's own privacy guide says audio monitoring should almost always be disabled. We suggest leaving it off for home workers.
• Location only if needed: in-office or out-of-office status rather than detailed location, and only if your purpose needs it.
• Restricted access: role-based access so line managers see only what they need, with an Audit trail.

Hybrid workers, shared devices and location data

Hybrid working raises a few practical issues that are easy to miss in a DPIA:

• Shared or family devices: if a work computer is used by others in the household, or work is done on a shared machine, monitoring can capture people who are not your workers at all. Company-owned devices used only for work avoid most of this.
• Location data: knowing whether someone is in the office or at home may be enough for a hybrid policy question. Teramind's geolocation reporting lets you define locations by coordinates and radius, optionally refined by known Wi-Fi access points, and compare office and remote working; Teramind's own privacy guide says geolocation should be disabled unless explicitly justified, so collect only the level of detail your purpose needs.
• Different rules on different days: if monitoring is lighter at home than in the office, or the reverse, explain that clearly in your policy so workers are not surprised.
• Aggregated before individual: for questions about how hybrid working is used across the business, team-level reporting may be enough, and the ICO notes that aggregated reports could meet a need without individual monitoring.
• Accuracy: activity measures can misread home working, where calls, reading and thinking time can look idle. Teramind itself says its engagement measure reflects input activity, not productivity, so workers should be able to see and challenge results.

Talking to staff and writing it down

The ICO says you should seek the views of workers or their representatives before introducing monitoring, unless there is a good reason not to. For home workers this is especially useful: they can tell you about shared devices, caring responsibilities or rooms that are used by others, which your DPIA should take into account.

Put the outcome into your employee monitoring policy: what is monitored at home, when, on which devices, and how workers can raise concerns. Pair it with practical guidance on working securely from home, such as remote working security training. For the Cyber Essentials view of home working, see BYOD and home working requirements.

How Forever Systems helps

We supply, set up and support Teramind for remote and hybrid teams, and we start from the lightest set-up that answers your question. We can:

1. Help you define what you need to know about home and hybrid working, and which features that needs
2. Give you the technical detail for your DPIA, including what could be captured at home and how to limit it
3. Deploy the agent to remote computers, either remotely through tools such as Microsoft Intune or Jamf, or by inviting workers to install the visible Revealed agent themselves
4. Configure schedules, exclusions, agent type, screen capture and access to match your DPIA and policy

Contact us to talk about your remote and hybrid teams. Ask us for a quote.