Employers may monitor staff in work-from-home setup — NPC

MANILA, Philippines — Employers may monitor their staff under the work-from-home (WFH) setup through the installation of monitoring software in company-issued devices, according to the National Privacy Commission (NPC).

“Employers in exercising their legitimate interest may monitor employees during WFH but should balance it with the rights and freedoms of their employees and adherence to the general data privacy principles,” NPC said in a bulletin on Friday.

“We reiterate the discussions in NPC Advisory Opinion No. 2018-048: monitoring employee activities when he or she is using an office-issued computer may be allowed under the DPA (Data Privacy Act), provided the processing falls under any of the criteria for lawful processing under Sections 12 and/or 13 of the law,” the commission added.

However, employers must be transparent to the employees and notify them that they are being monitored, according to NPC.

It added that there should also be an “assessment of the necessity and proportionality of the monitoring vis-à-vis the objective of the same.”

Employers are recommended to conduct a privacy impact assessment of the monitoring software to determine risks and how to mitigate them. They should likewise implement clear policies with regard to its monitoring procedures.

“Further, less privacy-intrusive means of monitoring should be considered rather than excessive and disproportionate mechanism in monitoring such as the use of tracking mouse movements, recording keystrokes, taking random photos of the computer screen, enabling webcams to take a picture of the employee, etc.,” the NPC said.

Meanwhile, the commission said employers should not require their staff to stay on video during business hours or even beyond when they have overtime work as proof of work done during the day.

“The proportionality principle dictates that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. Employers should avoid extreme privacy intrusive means of managing employees as there are other available means of ensuring that employees are doing their assigned tasks,” it explained.

Employers can secure personal data processing systems being used during work from home setting by providing proper ICT equipment and support facilities and mechanisms to employees. Data protection and privacy policies should likewise be in place to guide the staff.

For the government sector, heads of agencies should ensure that employees have access to or are provided with communication equipment or facilities to carry out their functions.

Aside from employee monitoring, employers are also allowed to check the travel history of their employees in compliance with the requirements of the Department of Health, according to the commission.

EDV