Employer spying on employee

Undervalued

Dakta said:

It would be interesting to hear the mechanics of how they've tracked the location as opposed to say, a work app reporting phone gps position - if it is IP based there does raise the question that whilst IP's are geographic I wouldn't want to rely on it - especially as you can use a VPN and I've investigated impossible travel incidents where people have appeared to be in Brazil where in fact they were just logging on before making coffee at home downstairs and just happened to have privacy software on their bring your own device. 

Some good and interesting points though, I think more info needed to really pin this down but the good thing is if it goes to disciplinary, or even an investigation you (or the subject of it) can request sight of evidence. It's a bit dubious about whether they have to provide full evidence pre-disciplinary but you can ask, and you should have the full report to review before so you should get some opportunity to get sight of the evidence, in which case it might reveal (or otherwise) if concerns about tracking are valid.

Some companies do actively use monitoring software on employee devices, in the absence of this I would have thought the likelihood of IT staff with access to sign in logs wouldn't correlate much to HR matters such as sick leave so in the absence of active monitoring there has to be something that has made this person a person of interest. 

Yes they can, in fact they can probably do it anyway by means of a subject access request although certain information might be able to be lawfully withheld. In the real world, unless somebody "whistle blows", it is difficult to know what has been withheld from a SAR.

However I would caution against poking the bear given the sick leave abroad situation. If they were dismissed and the company had breached IT / data rules the OP might be able to report them. However, that is unlikely to make the dismissal unfair and certainly won't get them their job back. So apart from a smug satisfaction where does it get them? 

Dakta

Fair comment - regarding the actual sickness it really depends on a lot more than we know. For example whilst I'd consider going abroad a very dubious affair typically when off sick, if you are off sick with stress, how mcuh of a crime is holiday therapy? It's a good question and I honestly don't know, so let's learn. 

Apparently, according to google (yeah I know) people can go on holiday as long as it's not incompatible with their reasons for being off sick - using this as a ref anwyay: https://www.davidsonmorris.com/going-on-holiday-while-on-sick-leave/

So depending on the merits of the case, it could be something, it could be nothing - if they've reported a broken leg and are dancing in Ibiza obviously...you know where it's going but on the other hand a holiday on sick leave is not otherwise necessarily that clear cut.

Subject access requests can be a funny business - though it is a legal right, however it may be worth waiting for an investigation as even if your data is retrieved it could take a month and an investigation process might run faster so it may be of limited value in a good case, I have seen companies try and ban/prohibit people under investigation from raising subject access requests during such investigations and this has led to to legal complaints as a breach of rights, but this is a separate matter and won't help the investigation directly.


So, if I, rightly or wrongly was the subject of this investigation/disciplinary process I'd want to know:

- the exact allegations against me
- the reasons I went off sick
- medical substantiation (have I attended appointments, is there a medical record, does it classify as a disability and what type)
- whether my travel was appropriate and whether I can justify it given the above HR information
- How my travel was identified (for example an infosec concern about potentially suspect account sign in activity has no relation to a sickness matter, so an investigation off the back of this 'could' be malicious in some contexts) , and how reliable the evidence is
- all further evidence relating to the allegation
- a copy of company acceptable use policies, particularly anything with regards to remote work, and bring your own devices

Only then really can you assess if there is merits to the accusation and how defendable it is, if it really is the case that someone just decided to jet off whilst using up sick leave rather than holiday time, expect a poor outcome.

DullGreyGuy

I'd very much hope you know the reason why you went off sick as the subject of the investigation of you being abroad whilst too ill to work 

It's also a large leap of faith to say it's malicious to inform a manager that one of their staff that's on sick leave is currently operating their device from overseas. 

Dakta

That's not what i said, but only the OP can look at the facts and see if there is something for it. Which in some cases, there can be.

For example, when ringing managers up to find out if people are on holiday due to sign ins, I never say where the employee is, because I can't say that because despite the indication I do not know. All I know is, if they are confirmed to be in that location I know the sign in is likely authentic. Basically the information is going the other way, I want to know the employees location, I am not providing it. That's it.  I can say a sign in was seen from an IP that appears to be from an area, but again you rarely actually know, and where people are using their own devices, their own networks and some mobile networks as well make geolocation really unreliable if the manager took that info off their own back, interpreted that their own way and say, suspended someone to investigate it and they subsequently lost out (say overtime) then the employee could rightly question why they've been subject to that on the back of something that isn't actually any kind of evidential merit, and if someone came back to me and asked why I told a manager someone was in that location I'd say 'nope, I didn't'. Because I didn't. Even if it turns out they were.

I'm not saying there's a definite point here but ask the question. Your future may depend on it.

Just as an edit point, i know I've touched on it but it's considered good practice to tell the manager the reason why you're calling (sign in from an unusual location and you have concern the account may have been compromised and want to check) but....it's bad practice to feed the manager the location - why? because some managers are lazy and if you tell them the location they will sometimes just go with it for an easier life. Yes it happens, don't give leading info. Ask them in an open way if they know where there colleague is, you're calling from infosec to find information not provide it.
 

Undervalued

Dakta said:

Fair comment - regarding the actual sickness it really depends on a lot more than we know. For example whilst I'd consider going abroad a very dubious affair typically when off sick, if you are off sick with stress, how mcuh of a crime is holiday therapy? It's a good question and I honestly don't know, so let's learn. 

Apparently, according to google (yeah I know) people can go on holiday as long as it's not incompatible with their reasons for being off sick - using this as a ref anwyay: https://www.davidsonmorris.com/going-on-holiday-while-on-sick-leave/

So depending on the merits of the case, it could be something, it could be nothing - if they've reported a broken leg and are dancing in Ibiza obviously...you know where it's going but on the other hand a holiday on sick leave is not otherwise necessarily that clear cut.

Subject access requests can be a funny business - though it is a legal right, however it may be worth waiting for an investigation as even if your data is retrieved it could take a month and an investigation process might run faster so it may be of limited value in a good case, I have seen companies try and ban/prohibit people under investigation from raising subject access requests during such investigations and this has led to to legal complaints as a breach of rights, but this is a separate matter and won't help the investigation directly.


So, if I, rightly or wrongly was the subject of this investigation/disciplinary process I'd want to know:

- the exact allegations against me
- the reasons I went off sick
- medical substantiation (have I attended appointments, is there a medical record, does it classify as a disability and what type)
- whether my travel was appropriate and whether I can justify it given the above HR information
- How my travel was identified (for example an infosec concern about potentially suspect account sign in activity has no relation to a sickness matter, so an investigation off the back of this 'could' be malicious in some contexts) , and how reliable the evidence is
- all further evidence relating to the allegation
- a copy of company acceptable use policies, particularly anything with regards to remote work, and bring your own devices

Only then really can you assess if there is merits to the accusation and how defendable it is, if it really is the case that someone just decided to jet off whilst using up sick leave rather than holiday time, expect a poor outcome.

Absolutely in some circumstances and you have given some examples. If it is clearly beneficial towards recovery them most reasonable employers would be happy to agree if asked.

However it is stupid and / or arrogant in the extreme for an employee to do so without telling their employer first. At best it is open to suspicion and it may well be a requirement of their contract or employment. Any annual leave requires the employer's permission regarding dates.

Also, almost any company sick pay these days is "discretionary" rather than a hard and fast entitlement so there is another reason to keep the employer on side.

Dakta

To be honest, I would be totally onboard with that because in that situation I'd be worried about what people would think if I were seen or even posted a photo snap up on social media that show me somewhere that isn't home. It isn't lost on me, but I don't think the lack of that degree if forward thinking or common sense should weigh against them really.

There just isn't enough info here to do anything except make suggestions, it might be a clear cut bang to rights case, no idea but there's something to think about if there are mitigating circumstances or an explanation etc. I do know, even the most well funded and staffed HR/Legal/Privacy departments often do not know their !!!!!! from their elbow so when facing disciplinary action I'd always run through an explaratory. 

kinger101

1.  Your personal phone is your personal phone.  If you don't want work apps on it, don't install them.  The company can issue you with a work phone which you can turn off outside of work hours.

2.  Whether someone had a legitimate reason for being abroad while "off sick" or not will largely be based on the facts.  If they were recuperating from stress, they would have a doctor's note.  If they were on a bender with the lads in Amsterdam, they wouldn't.

Dakta

I suspect op isnt going to provide any so dont think we can delve into it as much as id like.

Suppose the simplest answer to 'can my employee spy on me' would be yes, subject to circumstances.