That companies use tracking techniques to supervise their employees' routines is nothing new, but with the growth of remote working - accelerated by the coronavirus pandemic - the use of monitoring software has become very popular. In a survey conducted by Resume Builder in 2023 with 1,000 business leaders in the US who lead predominantly remote or hybrid teams, it was revealed that 96% of these managers employ some form of employee monitoring software[i].
Through the use of these tools - which is also called bossware (a neologism derived from the sum of the words boss e software) - companies are able to track the activities carried out by their employees. Logging keystrokes, monitoring screens, recording microphone sounds, tracking email usage time and the number of emails sent are some of the techniques used.
In the US, networks such as Outback e KFC are already using tools with built-in Artificial Intelligence systems to evaluate their employees' performance. Facial recognition to identify the worker and audio transcription to detect whether the employee has tried to offer add-ons or enroll the customer in a loyalty program are some examples of the techniques used[ii].
The employers' justification for using bossware The usual view is that they are important for improving the company's productivity, evaluating workers' performance more assertively and improving operational efficiency. However, there are those who resort to these mechanisms out of distrust for their employees' productivity, using them as a means of maintaining strict control over their subordinates.
Considering the Brazilian context, it is essential to emphasize that monitoring work is an employer's right, as part of its management power. However, this power is not unlimited; the worker's privacy and dignity must be respected, among other things. Therefore, all monitoring must be conducted with caution.
Incidentally, the extent of the employer's power of control should be guided by the very nature of the activity performed by the employee. The activity will therefore serve as a criterion for assessing whether the monitoring carried out is reasonable or not.
In addition, it is essential to recognize that, when monitoring its employees, the employer will inevitably access and process their personal data, and therefore compliance with the provisions established by the LGPD is mandatory.
In this context, the company must be transparent about the monitoring it carries out. The LGPD requires that the purpose of data use and monitoring be communicated clearly, in an accessible way, to ensure that everyone understands it.
At this point, information about the processing must be made available in compliance with at least the requirements set out in Article 9 of the LGPD. In cases where the company provides work tools, it is also essential to formalize that this equipment is to be used exclusively for professional purposes. This is a good practice for aligning employee expectations and avoiding surprises. Similarly, in situations where the use of personal devices is permitted, it is advisable to establish clear guidelines on their use.
In addition to transparency, the employer must implement appropriate and strictly necessary measures to achieve its objectives. As recommended by Working Party 29 in its guide to data processing at work[iii], In order to ensure the safety of employees, companies must take measures proportionate to the risk posed by the work, avoiding the implementation of highly invasive measures. Reasonable and strictly necessary measures must be adopted to monitor the employee's work and safeguard the security of the business.
Another aspect that requires attention is the LGPD's determination that data processing can only be carried out within the hypotheses set out in the law. In this scenario, it is important to note that the use of consent should be avoided in employment relationships, as consent needs to be free, which is questionable in a relationship marked by subordination. In other words, collecting a worker's authorization to allow monitoring of their work is definitely not the best way to go. Normally, the legal basis used in these cases is legitimate interest, but it is worth mentioning that, according to the law, legitimate interest does not allow, for example, the processing of sensitive personal data, such as facial biometrics.
We therefore reiterate the need for employers to act with caution when selecting methods of supervising their employees, ensuring that they do not exceed the limits of legitimate supervision and avoiding abuse of their power of management.
Gustavo Carvalho Machado, Lawyer and Founding Partner of DMS Advogados. Master in Law and Innovation (UFJF). Postgraduate in Compliance and Corporate Integrity (PUC Minas) and Labor Law (PUC Minas). Bachelor of Laws (UFV).
[i] Available at: https://epocanegocios.globo.com/futuro-do-trabalho/noticia/2023/08/como-as-empresas-usam-softwares-para-rastrear-o-trabalho-remoto-dos-funcionarios.ghtml
[ii] Available: https://forbes.com.br/carreira/2024/02/restaurantes-usam-inteligencia-artificial-para-monitorar-desempenho-de-funcionarios/
[iii] Available at: https://ec.europa.eu/newsroom/article29/items/610169
