It is widely accepted that employers are allowed to monitor the use of their computer systems to maintain security, prevent illegal activity by employees, and to ensure compliance with the employer’s computer use policies.
Generally, privacy commissioners and courts have reasoned that if, in the course of monitoring the computer systems, the employer has reasonable grounds to suspect an employee is misusing or has misused the system, the employer is entitled (and may be under a duty) to investigate further. The investigation may include direct monitoring of the employee’s computer use and even reading the employee’s emails.

Keystroke Logging, Screenshots and Similar Surveillance Tools

Keystroke logging and other detailed collection of personal information is generally considered to be particularly privacy invasive because it can capture information such as account numbers and passwords. However, depending what online activity is suspected and the grounds for the investigation, it may be permissible for an employer to use keystroke logging or the collection of screenshots, if no less privacy-invasive method of investigation is effective.

Computer Use Policy Required

Before doing such monitoring, the employer should develop a computer use policy which details:

  1. the types of activities that are prohibited (for example, visiting websites dealing with pornography, hate speech, criminal activity or downloading material from such sites);
  2. the nature of the monitoring or audits that are done, including whether employee productivity is monitored or assessed; and
  3. the employer’s intention to investigate if a breach of the policy is suspected and use evidence of the employee’s computer use (including any relevant emails) in any discipline that may be imposed.

However, if the employer is worried mostly about reduced employee productivity because of excessive personal use of the computer systems, then less privacy-invasive methods should be used.

Surreptitious computer monitoring should not be used by an employer to ‘catch’ an employee wasting company time unless the employer already tried other ways to address the problem and those efforts did not work.

What You Can Do If Your Computer Use Has Been Inappropriately Monitored

If you feel that your employer has inappropriately monitored your computer use, you may do the following:

  1. First look at the privacy policy and any policy that applies to employee computer use, if your employer has one, to see if the policy gives notice of the circumstances in which monitoring is used;
  2. If you are comfortable doing so, you could ask the privacy officer about the computer monitoring;
  3. If you are unionized, seek assistance from your union representative and your union;
  4. You may also lodge a formal complaint with the relevant privacy commissioner; and
  5. You may also wish to consider whether it is appropriate to commence a lawsuit for invasion of privacy.