Return-to-Office Mandates and New-Age Employee Surveillance May Create a Privacy Disaster
At the turn of the new year, a JPMorgan internal memo informed its employees that they were ending remote work and returning to a five days a week in-office work schedule.[1] With its new New York headquarters set to open this year[2], the memo should not come as a surprise. Additionally, JPMorgan’s return-to-office mandate follows those imposed by Amazon and AT&T.[3] Similarly, the Trump administration also pushed a return-to-office mandate towards the end of January.[4]
But what exactly awaits employees at the office?
Following the COVID-19 pandemic, the rise of work-from-home, and improvements to employee surveillance technology, the shift to work-from-home prompted employers to use monitoring tools to track remote work progress, including keystroke tracking and website visitation information.[5] In response to this monitoring, employees used quick tricks to circumvent surveillance tools. One viral TikTok video showcased a mouse mover that remote employees can use to avoid getting that dreaded “Away” status on Microsoft Teams for their supervisor to see.[6]
However, the use of these monitoring tools has persisted post-pandemic, and with hiring at a downturn, companies want to maximize the productivity of the employees they do have.[7] As an example, JPMorgan Chase’s program called “Workplace Activity Data Utility” (WADU) is a collection of surveillance tools built during the pandemic.[8] WADU is known to assemble profiles of employees and tracks various virtual and in-office activities.[9] When employees log in through a virtual desktop interface (VDI), WADU tracks the amount of time they use certain applications, the length of Zoom calls (including whether one’s camera is on or not), and pulls from information on employee calendars.[10] In the office, WADU tracks employees’ ID swipes through certain doors and logins into work stations.[11] This data is aggregated into reports that managers may use in making personnel decisions.[12]
Programs like JPMorgan Chase’s WADU only scratch the surface of employee surveillance tools currently available in other industries. Originally made for hospitals and universities, HID Global’s OmniKey ecosystem creates a series of smart cards and readers, with the ability to track uses of entrances/exits, meeting rooms, elevators, and even parking.[13] Companies like Spacewell offer a discrete motion-sensing device that can be used under a work desk.[14] Some brain-computer interface (BCI) technology companies are also used in certain work environments. For example, certain train drivers in China wear caps with neurotechnology that signal to supervisors when the employees are fatigued.[15]
This nature of surveillance becoming commonplace in offices and retail environments creates grave employee health and privacy implications; increased employee monitoring is known to decrease employees’ mental health and hinders unionization efforts.[16] This surveillance also challenges the efficacy of privacy laws; the federal Privacy Act of 1974’s “No Disclosure Without Consent” rule protects only federal employee from non-consensual workplace surveillance by their agency employers.[17] However, non-agency employers may be subject to federal criminal interception statutes.[18] However, obtaining consent for the monitoring avoids criminal liability under the federal interception statute.[19] Various state laws expand regulatory privacy coverage to all workers but subscribe to a similar notice regime, for example, New York Civil Rights Law requires New York employers give notice to employees of their electronic monitoring practices before engaging in that monitoring.[20]
Current federal and state privacy law’s emphasis on a notice and/or consent regime does little to address the diminished bargaining power employees possess in negotiating the terms of their employment.[21] However, with more intrusive monitoring tools and return-to-office mandates, perhaps there will be new efforts to rework the existing workplace privacy law regime.
Footnotes
