Black mirror: Employee surveillance technology is becoming more pervasive and invasive. But does Bossware even work?

Photo by Shubham Dhage on Unsplash

If you’re reading this on a company laptop or device, there’s a good chance you’re being monitored by your employer.

Your company can have access to the websites you visited today, the files you opened, and even individual keystrokes. Some employers constantly track the location of their employees using GPS. This means they can monitor employees’ movements outside of working hours. And that personal, deeply private message you sent to your spouse over lunch? It can be intercepted by the same software.

But employee surveillance technology, commonly known as “Bossware,” can go much further, especially when combined with artificial intelligence (AI). Some Bossware programs capture video of you working on your computer so they can analyze your facial expressions and tone of voice to assess your attitude, mood and morale. Its predictive capabilities can even be used to assess which employees may be leading union efforts or committing ethical violations.

According to research by Top10VPN, the demand for employee monitoring software has increased by 60% since 2019. According to data from the American Psychological Association, 51% of surveyed American workers say they know that their employer uses technology to monitor them at work.

The number reported in Canada is 35%, which is lower, but continues to increase year by year.

There’s a reason why the above numbers come from employees who self-report that they’re being monitored, not from companies sharing the same data. In both Canada and the U.S., federal laws protecting employee privacy are limited or non-existent.

“There is little data documenting how widespread AI-powered employee surveillance may be in Canada. We don’t necessarily know that unless employers are open about their practices,” Bea Bruske, president of the Canadian Labor Congress, told CTV News.

Against this opaque surveillance backdrop, most employees log into their computers every day for work, expecting some things to remain private.

Pierre-Luc Déziel, a law professor at Laval University who specializes in privacy, told Radio-Canada that:

“An employee will have a reasonable expectation of privacy in relation to his or her data, even if he or she is using a device provided and administered by the employer, which, if this happens, remains the owner of that shell.”

“Just because an employee doesn’t own a device – whether it’s a tablet, phone, computer, or anything else – doesn’t mean their privacy rights with respect to the data on that device are completely extinguished.” —Pierre-Luc Déziel

The federal governments of the United States and Canada have introduced regulations to protect employee privacy

In Canada, Bill C-27, originally introduced in 2022 but still pending in committee in spring 2024, aims to modernize Canada’s federal privacy laws in the private sector. It contains two key legal acts regarding employee supervision:

Consumer Privacy Protection Act (CPPA): This Act aims to provide stronger protection for personal information and give Canadians more control over their data. This includes improved provisions on consent, the right to data mobility, the ability to request deletion of data, and transparency in the use of algorithms and artificial intelligence.
Artificial Intelligence and Data Act (AIDA): is Canada’s first artificial intelligence regulatory framework, focused on the responsible development of artificial intelligence. It mandates risk assessments for systems that may pose a high risk to individuals or their personal data.

The bill, which will almost certainly include amendments before it comes into force, has been criticized for not going far enough in protecting privacy rights compared to laws such as the EU’s General Data Protection Regulation (GDPR). A key area to watch is whether worker protections will be included in future draft regulations, particularly in relation to AI-enabled monitoring.

In the US, Democrats in the House of Representatives introduced the Stop Spying Bosses Act in March 2024. If passed, it would “prohibit or require the disclosure of surveillance, monitoring, and collection of certain employee data by employers.” Under the bill, the U.S. Department of Labor would also be required to establish a “Division of Privacy and Technology” to regulate workplace surveillance technology.

Europe is a step further in regulating this issue. In January 2024, the French data protection authority CNIL fined Amazon €32 million for “excessively” monitoring the activities and performance of its employees, which is contrary to GDPR regulations.

It is also important to note that in 2022, Ontario passed legislation that requires provincially regulated businesses and those with more than 25 employees to formally adopt and communicate their electronic monitoring policies to employees. These policies must specify how, under what circumstances and for what purposes an employer may electronically monitor employees.

Is employee surveillance counterproductive?

Few would argue that organizations have the right to monitor employee activity in some form, assuming it does not violate privacy laws and regulations (once they are formally implemented). But the real question is – does Bossware work? Does it deliver the results employers expect?

The answer may be no:

“Many organizations make the mistake of implementing new surveillance technologies because they don’t know how to manage remote workers,” said Michigan State University professor Tara Behrend.

“It’s a mistake because the tools don’t measure what really matters — all the ways an employee contributes to the organization and generates value,” added Behrend, who is also president of the Society for Industrial and Organizational Psychology (SIOP). “Our data clearly showed that these productivity monitoring tools actually do this NO lead to better performance. They are counterproductive to the organizations that use them.”

This also impacts employee morale and mental health. A 2023 study by the American Psychological Association found that 45% of workers monitored by an employer say their workplace negatively affects their mental health, compared to 29% of workers not monitored.

Additionally, research has shown that closely monitoring employees limits their autonomy, creates fear of job insecurity and is “extremely stressful.”

It may also increase racial profiling and bias, including among economically disadvantaged workers throughout society.

But does monitoring increase productivity? A study summarized in the Harvard Business Review suggests otherwise. “Employees were monitored extensively more will likely take unapproved breaks, disregard instructions, damage workplace property, steal office equipment, and intentionally work at a slow pace, among other rule-breaking behaviors,” the authors wrote.

Perhaps that’s why Slack’s chief research officer and Salesforce’s Ethical AI leader suggest that companies stay away from using AI to supervise employees. Slack’s chief research officer Christina Janzer said Bossware may actually reduce productivity, according to findings from the State of Work Report, a survey of 18,000 office workers in 10 countries.

“What we see is that management is so focused on tracking activity metrics that employees are wasting a third of their time on productivity, and therefore they are wasting a third of their time trying to appear productive just for the sake of appearing productive.” —Krystyna Janzer

Guidance for employers: how to monitor more ethically and effectively

There are many areas where employers will see real economic value and risk reduction from these technologies. Employee monitoring software can detect unauthorized access to company systems and sensitive data. It can improve processes and be used for employee coaching. In regulated industries, this can be a compliance tool.

But one of the biggest disconnects here is the lack of communication. While legislation may eventually require employers to clearly define how and when they monitor their employees, and what data they collect and use, currently most workers simply don’t know. Forbes reports that only 32% of employees say they have received formal guidelines or policies in their workplace regarding online supervision. Companies can therefore build trust by simply being clear about their approach to employee supervision.

What should such an approach include? In the absence of action from policymakers, Canada’s 2023 Privacy Commissioners proposed (non-binding) guidance to employers that included a number of key principles:

Inform employees about the electronic monitoring systems in use and explain their implications in clear and plain language.
Collect employee information judiciously and proportionately, especially for highly sensitive biometric data such as fingerprints, iris scans and voiceprints. Ensure processes are in place to ensure that electronic monitoring is not used for purposes other than those specified.
Use monitoring technology only when necessary. They should not be used to make significant decisions about an employee’s performance or employment prospects without human intervention.
Conduct privacy impact assessments to identify risks to privacy and other human rights laws.
Provide employees with clear information on how to object to the use or disclosure of their personal data, how to challenge decisions made based on them and how to access their personal data.

However, if the motivation behind Bossware is primarily increased productivity, organizations will have to constantly struggle with the balance between collecting data on how their employees behave at work and damaging the employee-employer relationship.

Because one final statistic jumps out above everything else.

According to Slack’s State of Work report, employees who felt trusted by their employer were twice as productive as those who didn’t.

This is a huge gap – and there are lessons to be learned from it.