Controlling employer monitoring smart working : a CNIL priority in 2022

The CNIL has included smart working surveillance in its priority control themes for 2022, along with commercial prospecting and the cloud. The priority themes represent one third of the controls carried out by the CNIL each year. Indeed, the tools for monitoring the work of smart workers have developed and the CNIL found it necessary to check the compliance of employers’ practices with the General Data Protection Regulation (GDPR).

Smart working is only a way of organizing work, and the employer has the power to supervise and control the performance of the tasks entrusted to the employee. But this new digital terrain and these new work tools necessarily impose new rules on the employer.

The devices implemented by the employer must remain proportionate to the objective pursued and must not infringe the employee’s rights and freedoms, for example his right to privacy. The employer must inform the employees and consult the staff representatives for transparency of the surveillance systems within the framework of a social dialogue. The Labour jurisdictions prohibit permanent surveillance, except in exceptional cases due to the specificity of the task performed by the employee. The CNIL therefore advises employers to give priority to monitoring the tasks performed rather than the working time, and to ask employees for regular reports in order to move away from constant surveillance.

The CNIL also reminds that if the employee uses personal tools for smart working, the level of security and confidentiality of personal data must be the same regardless of the equipment used. This can nevertheless make it difficult for the employer to access professional data, hence the need for the employer to properly frame the use of personal tools. Finally, regarding videoconferencing, the employer can only force an employee to activate his camera in certain specific situations such as an HR interview or a meeting with clients. To promote the protection of personal data, the CNIL encourages the use of tools allowing the blurring of the background when the camera is activated.

The CNIL will therefore carry out numerous controls on smart working this year, which may be carried out remotely, on site, on hearing, on documents in case of complaint from an employee or on its own initiative. The CNIL has the possibility to give formal notice to the controlled company to comply with the GDPR within a period of 6 to 12 months, to sanction financially or to withdraw certifications, reminders or injunctions under penalty payment. Finally, the CNIL may decide to make its decisions and sanctions public.

It is therefore necessary to be vigilant in the implementation of tools to control the work of the smart worker, and it is recommended to pay particular attention to the drafting of the texts framing smart working in this respect.