Findings
3 Written policy not recorded where the law asks for one
New South Wales allows computer surveillance only under a written policy notified in advance, the ACT data surveillance only under one, and Ontario asks employers with 25 or more employees on 1 January for a written electronic monitoring policy. In the UK the ICO expects monitoring policies that match what actually happens.
For HR: Which written policy covers this practice, and when were staff told of it?
Where it comes from, location by location
- Written policystatutory requirementComputer surveillance only as a written policy on staff computer use allows, and only after the employee has been told of it in advance so they can be taken to know and understand it. NSW WSA s 12
- Written policystatutory requirementBlock an email or website only under an email and internet policy notified in advance, and send a prevented delivery notice when an email is stopped. NSW WSA s 17
- Written policystatutory requirementData surveillance only under a notified policy saying how computer resources may be used, what is logged, who sees the logs, and how compliance is audited. ACT WPA s 16
- Written policystatutory requirementA written electronic monitoring policy covering all employees, in place before 1 March, saying whether the employer monitors, how and in what circumstances, the purposes, and the dates it was prepared and changed; kept for three years after it ends. (when you say 25 or more employees in Ontario on 1 January) Ontario ESA 41.1.1(1)Ontario ESA 41.1.1(2) para 1Ontario ESA 41.1.1(2) para 1 iOntario ESA 41.1.1(2) para 1 iiOntario ESA 15(8.2)
- Written policyofficial guidance, not lawMonitoring policies that set out the nature, purpose and extent of monitoring, brought to workers' attention and matching what happens. ICO monitoring guidance para 1.12(b) official guidance, not law