Australia is the easiest place for workplace monitoring among 15 mostly Western countries surveyed, the security firm Forcepoint says, based on data collected by the legal firm Hogan Lovells.
Apart from Australia, Harriet Pearson and James Denvil looked at the US, Canada, the Netherlands, Spain, Germany, France, Italy, Finland, Singapore, Switzerland, Turkey, the UK, South Africa and Sweden.
Their intent was to examine potential legal issues for global workforce monitoring programmes.
They measured the degree of difficulty involved in monitoring the following in the workplace:
- temporal metadata (e.g., logon, logoff, session length);
- use of privileged access, such as to administrative accounts;
- use of applications;
- email communications;
- employer-provided devices;
- Internet browsing;
- capturing on-screen activities;
- keylogging;
- behaviour on social media and other channels; and
- employee-owned devices.
{loadposition sam08}For each category, they allotted scores ranging from one to five to indicate how easy or how difficult respectively it was for an employer to carry out these procedures. A low score meant it would be easy for the employer and a higher score meant that there more requirements to be met in order to carry out the monitoring of that kind of data.
The study assumes significance in view of the fact that Australia (on 22 February) and the EU (on 25 May) plan to introduce data breach legislation this year.
In the study, Australia was given a score of 21 overall, only behind the US as far as ease of monitoring for the employer was concerned.
Australia did not score a five in any area; the highest score was four, for monitoring behaviour on social media and other channels - where express consent was needed due to "at work” considerations in certain jurisdictions - and monitoring employee-owned devices, where express consent was needed in certain jurisdictions like NSW and the ACT.
The US had the lowest score, 20. In both the areas where Australia scored a four, the US earned three.
Finland was the top scorer, with 46 out of a possible 50. The country and only earned a score of three for monitoring temporal metadata and monitoring use of privileged access, such as to administrative accounts.
Other countries where employees were better protected from snooping by their employers were Germany (42 out of 50), France (41), Italy (43), and Switzerland (40). Surprisingly, the Netherlands, Spain (33 apiece) and Sweden (32) achieved much lower scores, though two of them are in the EU and Sweden is considered a good place to live and work.
The UK got a score of 32, Canada was given 30 on par with Turkey, which again was a surprising outcome.
Pearson and Denvil suggested that employers could ask themselves the following questions to assess how reasonable it was to implement a particular tool for monitoring employees:
- "Is the deployment of the tool or measure intended to address an identified cyber risk?
- "Will use of the tool or measure effectively address the identified risk?
- "Are there other tools or measures that could effectively address the risk in a manner that would have less of an impact on the privacy interests of workforce members?
- "Will the impact on the privacy interests of workforce members outweigh the benefits to the organisation?"
The study, titled Managing Workforce Cyber Risk in a Global Landscape: A Legal Review, can be downloaded here after registration.