Working from home can create an unusual privacy question. An employee may be performing work from a personal space, using a company-issued laptop or even a personal device, while the employer may have legitimate reasons to monitor work activity. The issue is how far that monitoring may lawfully go.
Employers may monitor computer screens, take screenshots, record keystrokes, track work activity, or use other monitoring tools in appropriate circumstances. The National Privacy Commission (NPC), however, does not treat the employer-employee relationship as an unrestricted license to monitor employees. Employee monitoring remains subject to the Data Privacy Act of 2012 (DPA), including the principles of transparency, legitimate purpose, and proportionality.
Employee Monitoring is Considered Data Processing
Monitoring software may involve the collection, recording, storage, or other processing of an employee’s personal data, which is why the NPC has treated computer and employee monitoring as processing covered by the DPA. An employer therefore cannot simply assume that installing monitoring software makes every form of surveillance permissible. As with any processing of personal data, the employer must have a lawful basis for the monitoring. Depending on the circumstances, this may include processing that is necessary for the performance of an employment contract or for the legitimate interests of the employer, subject to the requirements of the law.
The fact that monitoring serves a legitimate business purpose, however, does not end the analysis. The manner and extent of monitoring still matter.
Can an Employer Monitor a Company-Issued Laptop?
Yes, potentially.
In NPC Advisory Opinion No. 2018-084, the NPC considered whether an employer could conduct secret surveillance of an employee’s computer activities. In said opinion, the NPC recognized that monitoring employees using an office-issued computer may be allowable, provided that the processing has a lawful basis and complies with the DPA’s general data privacy principles.
The fact that the company owns the laptop, therefore, does not by itself authorize the employer to monitor everything the employee does on the device. The employer must still consider whether the particular monitoring activity is lawful, necessary, and proportionate to its stated purpose.
For example, an employer may issue an employee a company laptop and install monitoring software to check whether the employee is accessing company systems during work hours. The employer may have a legitimate reason to monitor the device for this purpose. If, however, the software also takes screenshots of the employee’s screen every few minutes and captures the employee’s private messages, online banking, or other personal activities simply because they happen to appear on the company laptop, the company’s ownership of the device would not by itself justify that level of monitoring. The employer would still need to establish that collecting such information is necessary and proportionate to a legitimate purpose.
What About Screenshots and Keystroke Logging?
Screenshots and keystroke logging deserve particular attention because they can capture information beyond what an employer may actually need to determine whether an employee is working. A screenshot, for example, may capture private messages, financial information, passwords, or data concerning other people, while keylogging record what an employee actually types, even those information that are not visible on the screen.
In NPC Advisory Opinion No. 2018-084, the NPC considered a monitoring system that would record employees’ keystrokes and take random screenshots of their computer screens. In evaluating the proposal, the NPC recognized that the proposed monitoring may be permissible, provided that it has a lawful basis and complies with the principles of transparency, legitimate purpose, and proportionality. In particular, the information collected must be adequate, relevant, suitable, necessary, and not excessive in relation to the declared and specified purpose.
For example, while an employer may have legitimate reason to monitor the activity of its employees, it does not necessarily justify taking screenshots every few minutes or recording every keystroke. Indeed, if the same objective can reasonably be achieved through less intrusive means, collecting all of that additional information may raise proportionality concerns.
What About Webcam Monitoring?
Webcam monitoring presents a different practical concern because it can capture not only what the employee is doing on the computer, but also what is happening around the employee. In NPC Advisory Opinion No. 2024-003, the NPC considered a system that would randomly activate employees’ webcams and microphones and record short videos, including audio, of employees and their immediate surroundings. The stated purpose was to provide an additional security measure against the mishandling or unauthorized disclosure of confidential information.
In its opinion, the NPC recognized that such monitoring may have a lawful basis in appropriate circumstances, including contractual necessity or legitimate interest. However, because webcam monitoring is more intrusive – in that it can extend into an employee’s private space and may capture information about family members, visitors, conversation, or other activities unrelated to work – the requirements of necessity and proportionality become more demanding. In this regard, the employer should be able to explain why observing the employee’s physical surrounding is necessary to address a specified purpose and why a less intrusive measure would not reasonably achieve the same objective.
Does the Employee Have to Consent?
Not necessarily. This is one of the more interesting points from NPC Advisory Opinion No. 2024-003. The NPC noted that consent may not always be the most appropriate legal basis for processing in an employment relationship because employees may not always be in a position to freely give, refuse, or withdraw consent given the relationship between an employer and an employee.
Accordingly, an employer may in appropriate circumstances rely on another lawful basis under Section 12 of the DPA, such as (i) necessity for the performance of a contract; (ii) or legitimate interest. This does not mean, however, that an employer can dispense with all privacy safeguards simply because it does not rely on consent. The processing must still comply with the DPA’s other requirements.
What Should Employers Do Before Installing Monitoring Software?
Employers considering employee-monitoring software should not begin with the question of what the software is technically capable of doing. The more important question is whether the particular features are justified by the employer’s legitimate business purpose. To this end, before implementing a monitoring system, the employer should identify exactly what it intends to monitor and why.
For example, an employer concerned about the unauthorized disclosure of confidential information may have a legitimate reason to monitor access to company files or the transfer of documents. That does not necessarily justify recording every keystroke or taking screenshots of an employee’s entire screen at regular intervals.
Similarly, an employer concerned about whether employees are working during scheduled hours may consider activity logs or system-access records. It should not automatically assume that continuous webcam surveillance is necessary simply because employees work remotely.
A practical assessment may therefore begin with the following questions:
- What problem is the employer trying to address?
- What information does the monitoring system actually collect?
- Does the system collect information unrelated to work?
- Can the same objective be achieved through a less intrusive method?
- Who will have access to the information?
- How long will the information be retained?
- What happens when an employee uses the device for personal matters?
- What happens when the monitoring captures information concerning family members or other persons?
The employer should also consider whether it is monitoring all employees or only particular employees or activities, and whether there is a legitimate reason for that scope. The objective is not necessarily to eliminate monitoring. It is to ensure that the monitoring method is appropriately tailored to the problem the employer is actually trying to solve.
In practice, the more useful inquiry is not simply whether an employer can monitor an employee’s computer. It is whether the employer can explain why it needs to monitor, what it needs to collect, and why the particular method it chose is reasonably necessary to achieve that purpose.
What Should an Employee Do if the Employer is Already Monitoring the Computer?
Employees who discover that monitoring software has been installed should likewise avoid assuming that the monitoring is automatically unlawful simply because it involves personal data.
The employee should first determine what the employer is actually collecting.
For example, there is a material difference between software that records:
- Login and logout times;
- Access to company systems;
- Files downloaded from a company server; and
- Security events,
and software that:
- Takes random screenshots;
- Records every keystroke;
- Records webcam footage;
- Activates a microphone;
- Tracks personal browsing activity; or
- Captures the employee’s home and other persons in the household.
The employee should review the company’s privacy notice, employee handbook, remote-work policy, acceptable-use policy, or any separate monitoring policy. The employee may also raise the issue with the company’s Data Protection Officer and ask what personal information is being collected, for what purpose, and how it is being retained and used.
If the monitoring appears to extend beyond what the employer has disclosed, or if the employee believes that the processing violates his or her rights under the DPA, the employee may consider seeking legal advice on the appropriate remedies.
Final Word
Employee monitoring is likely to become increasingly common as employers continue to use remote and hybrid work arrangements and adopt technology designed to monitor productivity, security, and compliance.
The Data Privacy Act does not prevent employers from protecting legitimate business interests. It does, however, require those interests to be pursued within the boundaries of lawful, transparent, necessary, and proportionate data processing.
For employers, the safest approach is not to ask how much employee activity technology allows the company to observe, but how much information the company actually needs to achieve its legitimate purpose.
For employees, the fact that monitoring occurs does not automatically mean that the employer has violated the law. The legality of the monitoring depends on its purpose, legal basis, scope, transparency, and proportionality.
Ultimately, an employer should be able to explain not only what it is monitoring, but also why it is doing so and why that particular method is necessary.
Kristoffer Monico S. Ng is a Philippine lawyer whose practice focuses on labor and employment, corporate and commercial law, tax, energy law, and civil and criminal litigation. He advises businesses and individuals on legal risk, regulatory compliance, taxation, dispute resolution, and complex commercial matters, representing clients before courts, quasi-judicial agencies, and administrative bodies, while also providing strategic legal advice outside the courtroom. He also regularly writes on developments in Philippine jurisprudence and regulation, providing practical insights on legal issues affecting businesses and individuals.
If you require legal advice concerning data privacy, employee monitoring, employment policies, or any other legal matter within these practice areas, you may reach him through e-mail at nico@nlaw.ph to discuss your particular circumstances.
Suggested Article:
In a previous article, we discussed the ₱85 wage increase under Wage Order No. NCR-27 and the practical issues employers face following the issuance of the TRO. Read our discussion on what employers should do with payroll, amounts already paid, and potential overpayments while the case remains pending: