Digital Surveillance at Work: Can Your Boss Monitor What You Do?

Cameras, email follow-ups, tracking visited websites… Digital surveillance is more present than ever in work environments. But are there limits to what an employer can do?

As a rule of thumb, in Quebec, an employer has the right to ensure employees respect their obligations. However, this right is not absolute. It’s restricted by fundamental rights and freedoms, like an employee’s right to their private life and the right to fair and reasonable working conditions.

What is digital surveillance at work?

Digital surveillance at work refers to the variety of technological measures that are used to track an employee’s online activities. Several measures are available, including:

• tracking the websites visited at work,
• accessing an employee’s professional email inbox,
• monitoring conversations in instant messaging applications (e.g., Teams, Lync),
• installing cameras or control software.

These measures may be used to verify productivity, protect confidential data, prevent fraud or ensure security. However, employers must always respect their employees’ fundamental rights and freedoms when using these measures.

Fundamental rights protected by the Charter

In Quebec, the Charter of Human Rights and Freedoms guarantees everyone’s right to fair and reasonable working conditions and to the respect of their private lives. Surveillance that is too intrusive or constant by an employer could violate these rights.

However, the Charter allows an employer to limit these rights. This is only allowed if the measure causing loss of privacy is justified, targeted, proportional to the benefit gained, and framed by clear policies.

The Protection of Personal Information

The Charter is not the only law that frames digital surveillance in the workplace. In 2023, the Act Respecting the Protection of Personal Information in the Private Sector was modified. Since then, there are stricter rules that limit how far an employer can take digital surveillance.

• Employers can only collect information necessary for their purposes.
• They must inform employees when such technological measures are used to identify, locate or profile them.
• To monitor more sensitive data (e.g., medical information), employers must get their employees’ express consent. In specific cases, like when it is done to prevent fraud or to ensure security, express consent is not required.

Past decisions by tribunals

Tribunals examine each instance of digital surveillance on a case-by-case basis, asking questions such as the following:

• Is the digital surveillance justified by a serious reason?
• Is it effective in achieving its intended purpose?
• Is it the less intrusive measure available?
• Is the loss of privacy proportionate to the benefit gained from the digital surveillance?

In the past, tribunals have decided that certain digital surveillance measures are legal, and others illegal:

• Internet surveillance: A city was using a software (Graylog) to track the websites visited by their employees anonymously and on a random basis. This practice was considered legal, since its goal was mainly to protect cybersecurity.
• Access to emails: After an employee sent a concerning message to his supervisor, the tribunal decided that targeted access to that employee’s email inbox was justified. However, in a different case, a rehabilitation centre searched all emails of select employees. This approach was considered too broad and arbitrary by the tribunal.
• Instant messaging: An employee was fired for falsely reporting her hours. Her conversations in an instant messaging application were used by her employer to prove the transgression. The tribunal decided that searching the employee’s messages was legal in this case, since the digital surveillance was targeted, justified and based on clear internal policies.
• Constant camera surveillance: Many decisions confirm that constant and intrusive surveillance at work can be excessive and violate employees’ rights.

All about balance

Digital surveillance at work is not forbidden. However, it must strike a balance between an employer’s right to protect their interests (security, productivity, conformity) and employees’ fundamental rights.