Written by Haim Ravia and Dotan Hammer
The Israeli Privacy Protection Authority published draft guidance on the privacy-related aspects of monitoring remote workers. The draft explains that privacy protection laws permit employers to use technological tools to monitor employees that work remotely, subject to certain restrictions. But any such use may only be for legitimate reasons. The use of the monitoring measures must be proportionate and consensual, and the employees must be informed in advance of the measures used.
The draft guidance classifies the possible surveillance measures into three categories: measures that do not harm the privacy of employees, measures that are minimally harmful, and extremely harmful measures.
The draft describes forms of surveillance measures that are considered extremely harmful, such as tools that scan and monitor the websites that employees visit, tools that control the webcams installed on the employees’ computers, and tools for monitoring the employees’ whereabouts. The main risks that arise from these surveillance measures are the invasion of privacy, potential data leakage, and the employees’ loss of control over the information about them.
The draft emphasizes that the surveillance tools selected must be compatible with the purpose of the surveillance and must not be used for anything beyond that purpose. The employer must also consider how severely will the privacy of the employees be harmed, and refrain from using surveillance tools beyond working hours. The employer must ensure that information collected incidentally about members of the employee’s household is not stored in the databases.
The draft explains that employees must be informed about technological monitoring tools that are used when they work remotely. The notice must also include the purposes for which the surveillance is conducted. If severe harm to privacy is envisioned, the employer must provide notice at an elevated standard of transparency, explaining the reasons and justifications for the monitoring and the use of the information obtained. Monitoring is also subject to employee consent, which may be explicit or implicit. If consent is not given, the employer must refrain from collecting personal information.
Click here to read the draft guidance (In Hebrew).
