Does your employer have the right to monitor you while working remotely? (ECHO June 10, 2022)

The popularity of monitoring software has significantly increased with the widespread adoption of remote work. Some of the features offered by these tools are particularly intrusive. In Belgium, the use of such software is strictly regulated.

Although remote work is no longer mandatory or recommended, most employees continue to work remotely either partially or fully.

This raises the pressing issue of how employers can monitor work performance.

On-site, monitoring employees is "relatively simple," but when they work from home, the task becomes more complex.

Empirical or “soft monitoring” methods include scheduling regular or last-minute calls, tracking email production and response times, and requiring employees to remain reachable during working hours via Teams, phone, or other tools.

However, the most effective control methods are IT-based, with a wide range of software available for closely monitoring remote workers' activities, such as Hubstaff, Activtrak, Timedoctor, Flexyspy, Slack, and CleverControl. Hubstaff, for instance, can take screenshots of workers every five minutes or track GPS data from phones. Time Doctor monitors employees’ tasks, the time spent on each, internet usage (sites and applications visited), and login/logout times. Teramind tracks online behavior (instant messaging, file sharing, etc.) and can block access to unauthorized content, such as social media or non-approved materials. It even includes a keylogging feature that records keyboard strokes and mouse clicks.

According to a 2021 study, 45% of remote workers in France were monitored using such tools.

In Belgium, the use of these tools is largely regulated by telecommunications secrecy laws, privacy laws, and notably the General Data Protection Regulation (GDPR) enacted in 2018. Additionally, the CBA 38 governs the introduction of new technologies.

Under Belgian law (articles 314bis of the Penal Code and 123 of the Telecommunications Act of June 13, 2005), no one may access communications to which they are not a party without the consent of all parties. Telecommunications, broadly defined, include emails, internet browsing, internal and external chat tools, and more. Exceptions exist, such as for ensuring network functionality, quality control in call centers, or verifying commercial transactions.

Moreover, GDPR imposes obligations of purpose, proportionality, and transparency, prohibiting invasive or continuous monitoring. It requires employers to conduct an impact assessment before implementing surveillance measures. While the Belgian Data Protection Authority (DPA) has not yet issued a position, its French counterpart (CNIL) has criticized specific features like keyloggers, permanent recording tools, or systematic screenshots, deeming them illegal except in exceptional cases.

In response to monitoring, employees have developed strategies to evade detection, such as simulating disconnections (“frozen face”), fake bugs, or using anti-monitoring software like Presence Scheduler, which ensures constant online status on Slack. For screen tracking, dual-window setups are used to mislead surveillance.

For mouse activity trackers, employees have devised creative solutions, such as mechanically moving the mouse with a fan or tricking the laser by placing the mouse in a transparent glass.

A Belgian insurance employee was dismissed after suspicions of fraud regarding their online presence were confirmed. Keylogging revealed no mouse clicks were registered throughout the day, even though the employee appeared to be online at all times.

While employers face potential criminal or administrative penalties for illegal monitoring, they may still attempt to submit illicitly obtained evidence to court under the current jurisprudence (Antigone ruling). Courts may accept such evidence if the employee had been adequately informed about the possibility of monitoring, adhering to the principle of legitimate expectations.

L'Echo, June 10, 2022