Is the coronavirus giving banks an excuse to spy on employees?
During a quarantine, when managers can't walk around and observe workers, banks, like all companies, rely on technology to monitor employees as best they can. They track productivity, watch for signs of fraud and even look for signs of burnout and stress.
Some monitor employees’ instant messages and emails, one legal expert says. Some use monitoring technology from companies like InterGuard, Teramind and Time Doctor that keep an eye on workers’ computer and app usage, keystrokes and overall productivity, according to a major research firm and a software executive.
Still others have employees turn on their web cameras in the morning and leave them on all day, so they can be seen at all times.
And companies are thinking about COVID-19 monitoring when employees return to work: measuring body temperature, watching for social-distancing rule violations, even potentially ordering blood tests to make sure contagious people go back home.
But how much employee monitoring is OK, and when does it cross a line?
Private eyes watching you?
In late February, Credit Suisse’s chief executive, Tidjane Thiam, was ousted by the bank’s board after he admitted that private investigators hired by the bank had been spying on two executives, the head of wealth management and the head of human resources. Thiam claimed he had no knowledge of the surveillance.
But as extreme as that case seemed, physical surveillance of employees is not off-limits, according to Trina Fairley Barlow, a partner at Crowell & Moring in Washington.
“Employers should let employees know what their policy is around employee monitoring, whether their work activities can be monitored and what sorts of things might be monitored, to reduce any expectation of privacy,” she said.
Activities outside of work are a little dicier. But for people whose jobs require them to travel and go place to place, GPS monitoring of their location is OK, Barlow said, especially if the employer has reason to believe that the employee was doing something job-related that was harming the company, such as providing confidential information to a competitor.
“The farther you are away from monitoring activity that could reasonably be related to their job, having people follow the person around on Saturday mornings to the grocery store and to their friends’ homes on the off chance that they might go see a competitor, it's problematic.”
Barlow and Brian Kropp, chief of research in the Gartner HR practice, both pointed out that employers can also watch employees outside of work if they have reason to suspect theft, sexual harassment or that someone who has filed for disability is not disabled.
“Those tend to be more about individuals and individual behavior rather than a systematic thing to apply across the board,” Kropp said.
Reading instant messages, emails
Another way to monitor employees working remotely is by reading communications like Slack messages and emails.
“From a legal perspective, a company has every right to monitor their employees in almost any way they want to,” Kropp said, including reading personal email, if it is sent on a company laptop. "They don't have the right to take pictures of you in the bathroom.”
Barlow noted that employers should make clear to workers what the company’s monitoring policy is so employees do not have an expectation of privacy in their emails or instant messages.
“I conduct investigations, and I find that employees aren't grasping this with respect to instant messages in the way that they do with email, because a lot of times that's where you find all the information,” she said.
Employers should be monitoring only for a legitimate reason, like fraud, securities worries or productivity issues, and the monitoring should be disclosed.
Monitoring software that tracks computer activity
According to Gartner, in the past eight weeks 16% of companies have bought software to track their remote employees’ use of their computer and applications.
Banks are buying such technology in four areas: time clocks, video monitoring, sentiment analysis of communications, and security and fraud monitoring tools.
“In the financial services space, as their employees have gone remote, companies have been pretty aggressive at buying that sort of technology,” Kropp said.
Part of the reason for this, he said, is that the financial services companies were the least prepared to have their employees move to working from home because they were too concerned employees might commit fraud.
One thing banks are looking at is productivity: Are people really working from home, or are they watching TV all day?
“The early evidence is at least for the jobs where it's easy to measure performance, like claims processing, performance is just about the same,” Kropp said. There are differences in the times that employees are most productive, he said. For some, mornings are better, for others afternoons.
“That could be just natural patterns,” he said. “It could be that they've got kids at home they’re schooling.”
One provider of employee monitoring software is Teramind, which has about 300 bank customers.
Since the COVID-19-driven quarantine began, 40% of Teramind's 2,000 clients have requested additional licenses to track more users.
“Putting employees in a work-from-home environment causes two problems,” said Eli Sutton, vice president of operations for Teramind. “The first and biggest one is the security of that user working out of their home PC. When you're working in an office, especially in financial services, software runs in the background to make sure that sensitive information is not leaked.”
The second problem is the potential for lost productivity, he said.
Teramind lets employees turn monitoring tools off for privacy. For instance, they could turn monitoring off during a lunch break.
It does not do anything that it feels crosses a line, Sutton said.
“We’ve had clients ask us to monitor employees’ webcams,” he said. “Since we haven't found any real-world reason to monitor the user’s webcam apart from just being a creep, to be honest, we don’t do it.”
Watching employees through PC cameras
In at least one bank, employees are required to turn their web cameras on first thing in the morning and leave them on all day so that people can see each other throughout the day. Does this cross any kind of privacy or ethical line?
“Even if it doesn't create a legal issue, it's certainly going to potentially create a morale issue,” Barlow said. “Are there other, less intrusive ways to get at the same issue? What about a weekly or daily call or chat where you check in with people?”
Through a webcam, employers can get a lot of non-work-related information about employees’ homes and children.
“That is certainly a time where you would think about, is there a less intrusive means?” Barlow said. “What are you seeking to accomplish by that?” There are laws in some jurisdictions about recording people without their knowledge. Policies and protocols should be in place for any such monitoring.
Contact tracing, health monitoring
Banks and other companies are also considering technology that monitors whether employees are staying six feet apart. Companies have a right to install such tracking apps on phones they issue, Kropp said.
“If it's through a private phone, then it's a different question, and it gets a little bit gray,” he said. “But this really comes down to, are you communicating about this and explaining it.”
PricewaterhouseCoopers is preparing to launch this month a phone app for employers that analyzes workers’ interactions in the office. The consulting firm's latest COVID-19 CFO Survey found that 32% of chief financial officers at financial services companies are mulling contact tracing as part of the return-to-work regimen.
As companies consider having people coming back to the office, there are questions that have to be answered: Should employees be required to get temperature checks each time they reenter the building? Do they need to get blood tests for COVID-19 on a regular basis? Do they have to show that they have antibodies to the virus? And is it fair to make employees fill out a family history to see how at-risk they are?
“The feedback from employees so far has been, I want you to test and monitor everyone to make sure that they're healthy, but don't test me,” Kropp said. “Employees are having a really negative reaction to the idea of being tested or monitored by their employer when it comes to their health.”
Here again, companies need to explain what data they are collecting, why they are collecting it and how they are going to use it. For instance, before they collect employee temperature data, companies should tell people that if they are above a certain temperature, they will not be allowed into the workplace, for their own safety.
Clearview AI, the controversial facial recognition technology startup that has been enabling police officers and companies to quickly identify suspects by matching photos and videos from phones and security cameras against images on the internet, is trying to pivot to contact tracing. However, it is getting pushback from Washington.
“Technology has an important role to play in mitigating the COVID-19 pandemic, but this health crisis cannot justify using unreliable surveillance tools that could undermine our privacy rights,” Sen. Edward Markey wrote in a letter to Clearview AI founder Hoan Ton-That.
There is little question employees can perceive monitoring of any kind as overbearing.
In 2017, Barclays in London put sensors from OccupEye under employees’ desks to see how much time they spent at their station.
“A lot of employees took the sensors off and threw them away,” Kropp said.