CCTV in the shop, email on company servers, a GPS tracker in the delivery vehicle: monitoring is easier than ever, and so is getting it wrong. The Data Protection Act 2019 applies to employee personal data like any other, and it reshapes what employers may collect, watch and keep. Setting the framework early avoids most of these problems.
Can employers monitor staff under the Data Protection Act 2019?
Yes, but monitoring is the processing of personal data, and the Data Protection Act 2019 requires a lawful basis, transparency and restraint. Employees are data subjects with rights over their information, and the employment relationship does not suspend those rights. Consent deserves particular care: given the power imbalance in employment, consent alone is rarely a dependable basis for open-ended surveillance. The Act also covers candidate data during recruitment and former employees’ files after separation, so the policy should span the full employment lifecycle.
What does lawful monitoring look like in practice?
- Tell staff what is monitored, why, and how long the data is kept
- Limit monitoring to what is necessary for a stated purpose
- Restrict access to a small, defined group
- Avoid covert monitoring except in exceptional, documented circumstances
- Assess high-risk systems, such as biometric time clocks, before rollout
- Secure the data and delete it when the purpose lapses
What happens if monitoring breaches the Act?
Employees can complain to the Office of the Data Protection Commissioner, which can investigate and take enforcement action, and remedies can include compensation, so the exposure is not theoretical. Unlawfully obtained material may also complicate a disciplinary case, because the ELRC will scrutinise how the evidence was gathered. The cleaner the monitoring framework, the safer the evidence it produces.
Where should policies start?
A workplace privacy notice and a monitoring policy are the foundation, followed by a review of existing CCTV, device and vehicle systems. Our governance advisory team works with employers on data protection compliance within wider corporate governance, alongside the firm’s other practice areas.
This article was written by Charles Muriu Mathenge, who advises businesses, HR directors and boards on corporate and commercial matters at CS Advocates LLP.
For guidance on your specific situation, contact CS Advocates LLP , call, WhatsApp, or book a confidential consultation at our Westlands, Nairobi office.