I Spy: As more companies surveil workers at home, do laws do enough to protect privacy?
Photo illustration by Sara Wadford/Shutterstock
When demand for employee monitoring technology soared as millions moved from the office to remote work during the coronavirus pandemic, class action lawyer Benjamin F. Johns took note.
His firm, Chimicles Schwartz Kriner & Donaldson-Smith, announced in October a class action investigation into Hubstaff, one of several companies offering tech that can monitor employees inside their homes. Dubbed “bossware” or “tattleware,” some of these monitoring programs can track websites visited, log keystrokes, take screenshots or even record video and audio.
“When everyone went remote, it heightened the concerns about privacy. And while employees do have to give up some of their rights, just by virtue of the employer-employee relationship, they don’t give up all their privacy rights,” Johns says.
Hubstaff did not respond to a request for comment on the investigation, and the law firm has not announced any legal action. But it is still looking into whether the technology might be falling afoul of the Illinois Biometric Information Privacy Act. The 2008 law bars private companies from collecting workers’ retina or iris scans, fingerprints, voiceprints, facial geometry or DNA without notification and explicit consent.
As remote work becomes a permanent reality for more Americans, blurring the line between the office and the home, businesses are using employee monitoring services to keep tabs on workers. Attorneys like Johns are eager to test the technology against existing laws. But some legal experts and privacy advocates, alarmed by the tech’s increasing popularity, believe policymakers need to rethink state and federal laws.
“The phrases ‘bossware’ and ‘tattleware’ imply a very intrusive kind of surveillance of what the worker is doing,” says Matt Scherer, a lawyer who specializes in digital worker privacy at the Center for Democracy and Technology. “The law has dragged far behind.”
After the COVID-19 pandemic was declared in March 2020, the demand for monitoring technology—with names such as Time Doctor and StaffCop—surged. And by the second year of the pandemic, 60% of companies surveyed were using the tech, double the share of early 2020, according to Gartner, a technology research and consulting company.
Makers of the software resist the notion it is designed to spy on workers. Elizabeth Harz, CEO of Awareness Technologies, which makes the monitoring software InterGuard, says it helps companies protect their data and track hours to make sure their workers aren’t burning out. There is the potential for managers to abuse monitoring tech, Harz concedes. But while some programs use video and audio recording, InterGuard does not, although it can record screenshots. “What’s different now is we’re talking about people’s homes,” Harz says. “Managers don’t want to see somebody’s child in a home office. Managers just want to know that people are working and that their data is being protected.”
There are no national laws and few state laws regulating employee monitoring technology. Companies have broad powers to monitor workers on devices they own, according to legal experts.
Monitoring must be used for a legitimate business purpose, and according to information technology attorney Stephen S. Wu, chair of the ABA’s Artificial Intelligence and Robotics National Institute, most employers get consent as part of the hiring process. Connecticut, Delaware and New York require employers to notify workers that they are monitoring them. But in other states, it is lawful for employers to use the tech without consent, leaving workers largely powerless.
There are limits, however, especially if companies abuse the software and monitor workers when they are off duty, and remote work and flexible hours muddy that boundary, according to Chicago employment lawyer Peter Gillespie. Christopher Jevsevar, an employment lawyer at Osprey Law in Carlsbad, California, says companies could be exposed to invasion of privacy claims if they use bossware to surreptitiously record audio or video of a worker, especially in California and other states where the right to privacy is enshrined in state constitutions.
“If someone is accessing my webcam and seeing and listening to what’s going on in my house, I think that would be highly offensive,” Jevsevar says.
The Electronic Frontier Foundation’s Hayley Tsukayama adds that the privacy rights of other family members are at risk if they are recorded or captured on camera. In addition, features such as keylogging or screenshots could sweep up private social media messages and sensitive financial information.
“It’s bad for workers,” says Tsukayama, a legislative activist for the digital privacy group. “When your home is also your office, it’s still your home.”
Tracking lawyers
The legal industry is also increasingly relying on the tech. But Michael D.J. Eisenberg, a Washington, D.C., attorney who publishes a blog called the Tech Savvy Lawyer, says the software is a bad fit for most lawyers, whose billable hours include work that keeps them away from their desks. As a solo who sometimes hires law clerks, he says he would never use monitoring—partly to protect privacy, but also because proof of productivity is in their work.
“I can’t think of one of my friends or colleagues who run small and solo practices using this kind of stuff,” Eisenberg says. “They have an inherent trust when they hire that person because they’ve talked with them, they met with them, they’ve got a feel for who they are.”
However, several lawyers said they don’t see anything wrong with companies using the technology to measure productivity and hold employees accountable as long as it is used for business purposes.
“My view of the situation is that the technology is not so prevalent that the employers are being unreasonable with it,” Gillespie says. “I’m always concerned about calls for additional legal requirements where the concerns are oftentimes fairly speculative.”
Camille N. Anidi, a contract lawyer on Long Island, New York, was featured in a November Washington Post article about monitoring technology. She soon soured on facial recognition and tracking software that was meant to keep her on task as she reviewed dozens of documents in her home office.
When it comes to recognizing people of color, facial recognition technology can be flawed. Anidi, a Black woman, had to re-scan her face and restrict her head movements to make the technology work. The law firm would call or email her to ask why she had fallen behind.
“At the end of the day, if I’m getting the work done, you should trust me to get the work done and not feel the need to monitor me at my home,” Anidi says.
Future work, future laws
Even before the pandemic, legal experts were pushing for greater protections against surveillance in the digital workplace.
In February 2020, Ifeoma Ajunwa, now an employment law professor at the University of North Carolina School of Law, asked lawmakers in a congressional hearing on worker privacy to consider making a law that would ban surveillance of employees outside the office and when they are off duty.
In Illinois, there is a pending bill that would curtail employee monitoring, allowing workers to challenge its use and bar employers from using the technology to discipline, fire or promote them. A pending state law called the Massachusetts Information Privacy Act could be one of the more robust worker privacy measures in the country, according to the American Civil Liberties Union of Massachusetts. It would limit surveillance technology and could be a blueprint for the federal government and other states, Scherer says.
Jevsevar is convinced there is more litigation to come, especially as the law evolves and more states address monitoring by passing new laws. That’s important, Scherer says, because without those wholesale policy changes at the state and federal levels, workers can go to court, but there is nothing to stop another company from continuing with the same practices.
“That’s the problem with living in this policy Wild West where there’s no specific laws that hold all employers to a certain standard of respecting workers’ privacy,” Scherer says.
