United Kingdom

Data Protection Act 1998 implements the EU Data Protection Directive

The Regulation of Investigatory Powers (“RIP”) Act of 2000 regulates the monitoring or interception of emails and other forms of communication.

Impact assessment must be performed before monitoring takes place.

In the United Kingdom, workplace monitoring is regulated by the Data Protection Act of 1998 as it generally involves the processing of personal data. However, the Information Commissioner has set out detailed guidance for companies as to how the legislation applies to workplace monitoring. The Information Commissioner’s office has published its Employment Practices Data Protection Code to regulate workplace monitoring. The Code expressly recognizes the need to “strike a balance between a worker’s legitimate right to respect for . . . private life and an employer’s legitimate needs to run its business.” Under the Code, employers are required to carry out an impact assessment to establish whether any planned monitoring is necessary to address a legitimate business need, and goes no further than is necessary to meet that need.

The U.K Information Commissioner is responsible for enforcement of the Employment Practices Data Protection Code and the Data Protection Act of 1998. This does not prevent individual employees or potentially other interested parties from pursuing claims against employers who do not comply with the law. Any company that collects or processes personal information on employees located in the U.K. should carefully review and understand the Information Commissioner’s codes.