If you’re reading this on a company laptop or device, there’s a good chance you’re being monitored by your employer.
Your company could have access to the websites you’ve visited today, the files you’ve opened, and even the individual keystrokes you’ve typed. Some employers continuously track the location of their employees through GPS. That means they can be monitoring employees’ movements outside of work hours. And that personal, deeply private message you sent to your spouse at lunch? It may get captured by the same software.
But employee surveillance technology, commonly known as ‘Bossware,’ can go much further, especially with artificial intelligence (AI) now in the mix. Some Bossware will capture video of you as you work on your computer so it can analyze your facial expressions and tone of voice to assess your attitudes, mood, and morale. Its predictive capabilities can even be used to assess which employees might lead unionization efforts or commit ethical breaches.
According to research from Top10VPN, the demand for employee surveillance software has grown 60% since 2019. According to data from the American Psychological Association, 51% of American workers surveyed say they know their employer uses technology to monitor them while they’re working.
At 35%, the reported numbers in Canada are smaller, but they are still growing each year.
There’s a reason the numbers above come from employees self-reporting they’re being monitored, rather than companies providing the same data. In both Canada and the U.S., there are limited or non-existent federal regulations on privacy protection for workers.
“There is little data documenting how widespread AI-powered worker surveillance might be in Canada. Unless employers are upfront about their practices, we don’t necessarily know,” President of the Canadian Labour Congress Bea Bruske told CTV News.
Against this opaque surveillance backdrop, the majority of employees log onto their computers each day to work, expecting some things will remain private.
“An employee will maintain a reasonable expectation of privacy with regard to their data, even when they use a device that is provided and administered by their employer, who remains the owner of this shell, if you will.”
“Just because an employee does not own the device — the tablet, the phone, the computer, whatever — does not mean that their privacy rights with respect to the data that is contained in this device are completely extinguished.” — Pierre-Luc Déziel
U.S. and Canadian federal governments have introduced legislation to protect worker privacy
In Canada, Bill C-27, originally introduced in 2022 but still in committee in spring 2024, is intended to modernize Canada’s federal private-sector privacy laws. It includes two key acts relevant to employee surveillance:
- Consumer Privacy Protection Act (CPPA): This act is intended to provide stronger protections for personal information and to give Canadians more control over their data. This includes enhanced consent provisions, the right to data mobility, the ability to request disposal of data, and transparency in the use of algorithms and AI.
- Artificial Intelligence and Data Act (AIDA): This is Canada’s first framework for the regulation of AI, focusing on responsible AI development. It mandates risk assessments for systems that could pose high risks to individuals or their personal data.
The bill, which will almost certainly incorporate amendments before it is ever passed into law, has been criticized for not going far enough in protecting the privacy rights, compared to frameworks like the EU’s General Data Protection Regulation (GDPR). The key area to watch here is whether worker protections are built into subsequent drafts of the legislation, particularly with respect to AI-enabled monitoring.
In the U.S., House Democrats introduced the Stop Spying Bosses Act in March 2024. If passed, it would “prohibit, or require disclosure of, the surveillance, monitoring and collection of certain worker data by employers.” The U.S. Department of Labor would also be mandated to establish a “privacy and technology division” to regulate workplace surveillance tech as part of the act.
Europe is further ahead with regulation of this issue. In January 2024, French Data Protection Authority CNIL fined Amazon €32 million for “excessive” monitoring of its employees’ activities and performance, which contravened GDPR regulations.
It should also be noted that in 2022, Ontario legislated that both provincially regulated companies and those with more than 25 employees must formally adopt and communicate their electronic monitoring policies to their employees. These policies have to include how, in what circumstances, and for what purposes the employer may electronically monitor employees.
Is employee surveillance counterproductive?
Few would argue that organizations have the right to monitor employee activity in some form, assuming that it doesn’t breach privacy laws and regulations (once they’re formally in place). But the real question is — does Bossware work? Is it driving the outcomes employers want?
The answer might be no:
“Many organizations make the mistake of adopting new surveillance technologies because they don’t know how to manage remote workers,” said Michigan State University professor, Tara Behrend, PhD.
“It’s a mistake because the tools aren’t measuring what’s really important — all the ways a worker is contributing to the organization and generating value,” added Behrend, who also is president of the Society for Industrial and Organizational Psychology (SIOP). “Our data has clearly shown that these productivity monitoring tools do not lead to better performance. They are counterproductive for the organizations that use them.”
There are also impacts on employee morale and mental health. A 2023 survey conducted by the American Psychological Association indicates that 45% of employees who are monitored by their employer report their workplaces negatively impacting their mental health, compared with 29% of those not monitored.
It may also serve to exacerbate racial profiling and bias, including amongst the most economically disempowered workers across society.
But does monitoring drive productivity? A study summarized in the Harvard Business Review suggests the opposite. “Monitored employees were substantially more likely to take unapproved breaks, disregard instructions, damage workplace property, steal office equipment, and purposefully work at a slow pace, among other rule-breaking behaviours,” wrote the authors.
This may be why Slack’s director of research and Salesforce’s lead on ethical AI suggests companies stay away from using AI for employee surveillance. Slack Director of Research Christina Janzer said Bossware could actually reduce productivity, according to insights surfaced in its State of Work report, a survey of 18,000 office workers across 10 countries.
“What we see is because executives are so focused on tracking activity metrics, employees are wasting a third of their time on performative time, so they are wasting a third of their time trying to appear productive just for the sake of appearing productive.” — Christina Janzer
Guidelines for employers: how to monitor more ethically and effectively
There are many areas where employers will see real-bottom line value and risk mitigation in these technologies. Employee monitoring software can detect unauthorized access to company systems and sensitive data. It can streamline processes and be used for employee coaching. In regulated industries, it can be a tool to ensure compliance.
But one of the biggest disconnects here is the lack of communication. While legislation may eventually require employers to be clear about how and when they are monitoring their employees, and what data they’re collecting and how they use it — right now most employees just don’t know. Forbes reports that only 32% of employees report receiving formal guidelines or policies about online surveillance in their workplace. So, companies can build trust simply by being clear about their approach to employee surveillance.
What should that approach include? In the absence of action by policymakers, Canada’s 2023 privacy commissioners offered (non-binding) guidance for employers that included a number of key principles:
- Inform employees of the electronic monitoring systems being used and explain their implications in clear and plain language.
- Be reasonable and proportional when collecting employee information, especially with highly sensitive biometric information like fingerprints, iris scans, and voiceprints. Make sure there are processes in place so that electronic monitoring isn’t used for anything but its defined purpose.
- Use monitoring technologies only when necessary. Do not use them to make significant decisions about an employee’s performance or employment prospects without a human involved.
- Conduct privacy impact assessments to identify risks to privacy and other human rights laws.
- Provide employees with clear information about how to object to the collection use, or disclosure of their personal information, how to challenge decisions made with it, and how to get access to their personal data.
But if the motivation behind Bossware is primarily enhanced productivity, organizations will have to continually wrestle with the balance between gathering data about how their employees act at work and damaging the employee-employer relationship.
Because one final stat jumps out above all else.
According to that Slack State of Work report, staff who felt trusted by their employer were twice as productive as those who did not.
That’s a huge gap — and there might be a lesson in it.
