Surveillance of subordinates and the law

Video surveillance systems, monitoring network traffic, viewing corporate mail - in modern realities, almost every company, to one degree or another, monitors the actions of its employees at their workplaces. Someone seeks to protect themselves from corporate espionage and data leaks in this way, someone uses the collected information to optimize business processes and assess the productivity of hired employees, and someone primarily cares about the safety of their subordinates. But how legitimate is spying on staff, and where is the invisible line separating the control of good faith from the invasion of privacy? Let's try to figure it out.



In the introductory part of today's material, we will talk about the availability of monitoring and video surveillance systems, as well as Western Digital products for video recording devices. Then we will take a closer look at the peculiarities of Russian legislation in the field of tracking the actions of subordinates using the example of cases from real court practice. We have also prepared for you a small practical task for self-examination, so be sure to read the article to the end.

Spying on everyone and everyone, and let no one leave ...

With the advancement of the SaaS model, the process of organizing comprehensive control over the activities of your staff is easier than ever. In today's reality, you do not need to create a tracking system for employees' actions from scratch or order its development from third-party companies: just go to any industry portal, like the G2, open the section on the corresponding software, and choose the most suitable option depending on the required functionality , the specifics of your company's business processes and the available integration options. Modern monitoring software systems are able to plug even the most sophisticated spyware into their belts, offering customers a very rich set of monitoring tools, including:

• tracking launched applications and visited sites;
• monitoring of network traffic;
• ;
• , / ;
• , ();
• ( );
• - ;
• .

However, one should not consider such software only as a kind of "legal Trojans". Many of these solutions combine the functions of CRM, time tracking systems, support integration with popular task trackers, version control systems and error tracking systems, allow you to compose and process payrolls, and also provide a full-fledged API that greatly simplifies the process of integration into corporate IT- infrastructure. All this helps not only to more effectively use the tracking platform itself, but also to further optimize costs by abandoning highly specialized software with duplicate functionality.



Controlling personnel in physical reality is almost as simple as in virtual space, since the modern market offers many different ways of organizing video surveillance for every taste and wallet. Suppose you are the owner of a small company and want to monitor what is happening in a small office, consisting of a couple of workrooms. Then all you need is multiple EZVIZ network cameras (a subsidiary of HikVision), an EZVIZ Vault Plus storage router, a WD Purple hard drive, and one WD Purple SC QD101 microSD card per IP camera, thanks to which the video surveillance system will continue to function autonomously in the event of unforeseen situations.





The benefit of purchasing such a kit lies not only in its low cost, but also in the ease of installation and maintenance, which allows you to completely abandon the services of third-party specialists or engaged persons from among the company's employees. Since the EZVIZ brand was initially aimed at a wide range of consumers, including individuals, devices produced under this brand are distinguished by ease of use and boast a number of atypical features such as the ability to remotely control using a client application for an Android or iOS smartphone or use IP. - cameras as switches for negotiations with employees.



Specialized drives for video surveillance systems from Western Digital are also making their contribution.





If we talk about WD Purple hard drives, then in relation to the scenario we are considering, their main advantages are optimization of the use of cache memory depending on the number of processed video streams and control of the priority of execution of read / write commands, implemented at the level of the proprietary AllFrame AI firmware. This feature allows you to minimize the likelihood of skipping frames and the appearance of image artifacts when processing a significant number (up to 64) isochronous high-definition video streams. In combination with a wide range of supported equipment, the list of which also includes HikVision products, this eliminates the need for fine-tuning the equipment used: a video recorder, the role of which in our example is played by an EZVIZ router,he himself will perfectly "agree" with the hard disk without any of your participation.



As for WD Purple memory cards, their key feature is a guaranteed service life of 1000 programming / erasing (P / E) cycles, which is almost 10 times more than the "civilian" models. Thus, if, when using ordinary microSD cards, you had to replace them almost every 5-6 months, then a card of the "purple" line will serve you regularly for many years. Let's count.





If we assume that the video will be recorded continuously for an 8-hour working day in Full HD resolution with the highest possible picture quality, then about 50 gigabytes of video will be recorded on the memory card every day. For clarity, we convert the working resource of the card from the number of rewriting cycles to the more familiar TBW. This can be done using the following formula:



TBW = (Capacity × Number of P / E cycles) / 1000



For a 256 GB model, we get: TBW = (256 × 1000) / 1000 = 256 terabytes. This means that under the current load, the WD Purple memory card is guaranteed to work for 256,000 / 50 = 5120 days, or about 14 (!) Years.



In addition to extended working life, WD Purple microSD cards are moisture resistant (they can withstand immersion to a depth of 1 meter in fresh or salt water), can function properly in an extended operating temperature range (from -25 ° C to + 85 ° C) or survive a blow with force up to 500g. Thus, you can be 100% sure of the safety of the recorded data in the event of any emergency situations, such as a false triggering of the fire extinguishing system or impulsive actions by an employee of your company, if he suddenly wants to bathe the video camera in a glass of hot coffee or play football with an unfortunate device. ...



The latter may well happen in real life. After all, when it comes to total control, the boss and his subordinates inevitably find themselves on opposite sides of the barricades. This is understandable: even the most honest person, who has nothing to hide, will feel uncomfortable under the vigilant eye of the "big brother", in the role of which in this case is the employer. And everything that, from the point of view of the owner of the company, is a means of protecting the business and optimizing the workflow, in the eyes of employees looks like a treacherous interference with privacy, a violation of the right to privacy of personal correspondence and telephone conversations. Who is right in this situation? Only the current legislation designed to protect the rights and freedoms of citizens can unequivocally answer this question.

A letter in an envelope wait, don't go!

To be consistent and not get confused by legal nuances, let's start with the traditional model of labor relations, when employees work in an office using premises, equipment (computers, laptops, smartphones, tablets) and software provided by the employer himself. In such a situation, the following part 1 and part 2 of article 22 of the Labor Code of the Russian Federation apply . According to the law, the employer is obliged to provide employees with everything necessary for the performance of their labor duties. The employees themselves may use the provided equipment exclusively for business purposes. At the same time, the employer has the right to control the performance by the employee of the labor duties assigned to him, as well as how exactly the employee uses the equipment provided to him.



A logical conclusion follows from these provisions: the employer, having provided the employee with a computer necessary for the performance of official duties, has the right to install any software on it, including monitoring tools that track the user's actions. In turn, the subordinate himself can use the PC only for work purposes, otherwise sanctions may be applied to him. Let's look at a few examples.

Case 1

Employee N logged into his personal e-mail account from his work computer, after which he attached several official documents to the e-mail and sent them to a certain citizen X. This fact was tracked using the Internet traffic monitoring program, after which employee N was fired for disclosing information constituting a commercial secret. N set out to appeal against this decision, and also filed a counterclaim, claiming that the employer violated his right to privacy of personal correspondence. If the court ruled in favor of N, the dismissal would have been declared unlawful, since the information intercepted by the traffic filtering system would have received the status of “inadmissible evidence” as obtained in violation of the requirements of the Criminal Procedure Code and would have no legal force.



Nevertheless, in the situation under consideration, the court recognized the dismissal as completely legal. Since the computer is the property of the employer, the latter has the right to install any monitoring software on it, including those capable of monitoring and analyzing network traffic (this is how the information was obtained that helped to catch N). Since the program did not have direct access to the employee's mailbox, the evidence obtained in this way is absolutely legal and legally binding. On the contrary, if the employer got direct access to the employee's personal e-mail and found out about the transfer of files containing commercial secrets by looking at the Outbox folder, this would be a direct violation of Articles 23-24 of the Constitution of the Russian Federation and N's response would be satisfied.

Case 2

Employee Z was fired for violating the civil servant's code of ethics and regulations on the use of office equipment. During the audit, the employer found that Z used work mail for personal correspondence, and also discussed the actions of his colleagues with strangers. The employee was dismissed due to the loss of confidence in the civil servant in accordance with paragraph 1.1 of Part 1 of Art. 37 of the Federal Law of the Russian Federation of July 27, 2004 "On the State Civil Service of the Russian Federation".



Z filed an appeal and lost the process. The judge took into account the available evidence, which was the act of inspection of the workplace and the content of the e-mail. Here, too, there are absolutely no violations: the employer had access to the employee's office mailbox and could view all ongoing correspondence legally. And it was the employee who committed the violation, as he used his official mail to conduct personal correspondence.

Case 3

After being legally fired, employee O filed a lawsuit against the employer because she could not get access to the work computer and corporate e-mail, and demanded compensation for moral damage in connection with the violation of the rights to privacy and confidentiality of correspondence, because she used her account including for communicating with friends and relatives, and her account was transferred to another employee (in this case, the password was changed). The court ruled that there was no violation, since the corporate account a priori belongs to the company.



We summarize all of the above:

• , , , e-mail . , , , .
• , / . , . .
• , . , (, -). (, ) , , ( 272 ).

«» ,

Everything is clear with the correspondence, but what does the law on video surveillance say? According to the already mentioned part 1 of Art. 22 of the Labor Code of the Russian Federation , the employer has the right to establish a video surveillance system in order to ensure safety in the workplace, the safety of inventory, control over working conditions, prevent various violations and illegal actions, as well as to monitor the performance of employees of their duties.



However, there are a number of restrictions dictated by Article 23 of the Constitution of the Russian Federation.guaranteeing the human right to personal secrecy and inviolability of private life. What does this mean in practice? Suppose you own a large business and own a vast office complex. You can conduct video surveillance in the open space, conference room or at the checkpoint, but you are not allowed to install video cameras in the break room, dressing room, toilets and other similar premises. At the same time, in accordance with Article 6 of the Federal Law "On Operational Investigative Activities" , it is strictly forbidden to use hidden cameras for filming: video surveillance must be conducted openly, and information plates must be installed in the cameras' visibility zones.



Consider a couple of illustrative cases illustrating the legality of video surveillance in workplaces.

Case 4

After installing the video surveillance system, employee A refused to work under the new conditions and filed a lawsuit against the employer, considering this a violation of his right to privacy and personal data protection. The court, however, did not see any violations in the employer's actions, since in this case video surveillance is carried out in order to control the employee's labor activity, and not in order to establish the circumstances of his private life. For the same reason, by virtue of clause 5 of part 1 of Article 6 of the Personal Data Law, the employer has the right to collect and process the employee's personal data (which include his video images) without additional consent, since the corresponding changes in working conditions were reflected in local regulations (LNA), and the employee was additionally notified under the signature about the installation of the video surveillance system.

Case 5

In order to ensure safe working conditions and counter terrorist threats, a video surveillance system was installed in the clinic. Doctor D interpreted this as an interference with his personal life. Despite the notification about the prohibition to interfere with the work of video cameras, the doctor, coming to work, blocked the lens of the camera mounted in his office with foreign objects. For these actions, D was brought to disciplinary responsibility: he was reprimanded and entered into a personal file.



In an effort to appeal this decision, D filed a lawsuit to declare the corresponding order of his superiors illegal and naturally lost the process. The court ruled that video surveillance in doctors' offices was installed in order to ensure security on the territory of a medical and preventive institution, and personal data of employees are processed only to the extent necessary to achieve this goal, which means that the employee's constitutional rights to privacy have not been violated. On the contrary, by obscuring the view of the camera, the doctor directly violated the LNA norms, therefore, the reprimand in this case is absolutely legitimate.

Surveillance is a delicate matter

In September 2017, an event took place that had a tremendous impact on world judicial practice in the field of monitoring by superiors the actions of subordinates during the performance of their official duties, which was reflected, among other things, in the legislation of the Russian Federation. We are talking about the review of the case "Barbulescu v. Romania" by the Grand Chamber of the European Court of Human Rights. Let us briefly recall the essence of the matter.

Case 6

Employee B was fired for using a business account in Yahoo's messenger for personal correspondence, and his immediate supervisor was able to track messages in chats in real time. B, considering this incident a gross violation of the right to privacy of personal correspondence, appealed first to the local court, and then to the ECHR. All of the above instances recognized the employer's actions as legal. However, the Grand Chamber did not agree with this conclusion, nevertheless seeing certain violations in the actions of B's ​​superiors. According to the judgment of the ECHR, issued on September 5, 2017, the employer is obliged to:

• Notify the employee in advance that his activities will be monitored.

In this case, the subordinate must be informed about the type of control (video surveillance, monitoring program installed on the working PC) and its depth (analysis of browser history, tracking correspondence in real time, desktop streaming, etc.).

• Choose a proportionate degree of control over the employee, depending on the job duties performed by him.

The employer is obliged to choose such a control option for subordinates that would protect his legitimate interests, but at the same time would not be excessive. So, for example, if an employee has access to confidential information constituting a commercial secret, installing a multifunctional monitoring program on his office computer that can track almost any user actions and filter network traffic is quite justified. At the same time, installing such software on the smartphone of an ordinary courier who delivers food is an excessive measure: it is enough to track his movements during working hours using GPS.

• The employer can only interfere with the personal life of the employee to the extent necessary to monitor the performance of his job duties.

As we found out above, if an employee conducted personal correspondence from a work computer and the sent e-mail or messages in the messenger were intercepted and read by the superiors, this is not a violation of the privacy of correspondence, and the information obtained in this way can be used as evidence in court (for example, in the event that there was a disclosure of information constituting a commercial secret). However, at the same time, the employer must take all possible measures to prevent the disclosure of information about the employee's personal life and the content of his correspondence that is not relevant to the case, limit the circle of persons who can view and evaluate the nature of the correspondence, and avoid excessive citation of personal letters in disciplinary investigation documents. ...



All of the above is also true for Russian legislation, but the first point requires some clarification. In accordance with the laws of the Russian Federation, the usual notification of control using video surveillance or specialized software has no legal force, which means that it cannot regulate the labor relationship between the employee and the employer. In this case, according to Article 8 of the Labor Code of the Russian Federation , the adoption of the corresponding LNA is required. This can be either a separate document (for example, "Regulations on the control over the professional activities of employees"), or a special section or clause in the current local normative act regulating the use of corporate mail, the introduction of a trade secret regime, etc. This need is indicated , in particular, the decree Of the Constitutional Court of the Russian Federation No. 25-P dated October 26, 2017 . After the adoption of a new LNA or changing the existing one, the employee, in accordance with Part 2 of Art. 22, art. 68, art. 86 of the Labor Code of the Russian Federation , must be familiar with this document under signature.



Finally, it remains for us to discuss the legal aspects of monitoring subordinates in the remote work mode. However, let's bring a bit of interactivity to today's material. Since we have already reviewed many cases involving work in the office, try to answer a few questions on your own about monitoring employees at a distance. If you have carefully read today's article, you can do this without much difficulty. So let's get started.

1. Can a video surveillance system be used to control an employee who is at a remote work? If so, on what grounds? If not, why not?
2. Is it possible to use specialized software for monitoring a PC or laptop provided to an employee by an employer for performing professional duties at a remote work? If so, on what grounds? If not, why not?
3. Is it possible to use specialized software for monitoring personal devices of an employee that he uses during remote work? If so, on what grounds? If not, why not?

When you're ready, just look under the spoiler to test yourself.