Peek-a-boo, your boss might be tracking you

Peek-a-boo, your boss might be tracking you

Background

On Friday, 24 April 1992, Brian Kush reported to the RISKS1 List2:

Yesterday while driving through GA, my Cellular Phone rang. Since I was roaming I was not expecting a call. When I answered it, it was a recording welcoming me to Bell South Mobility and offered instructions on using there [sic] service. I have had this happen before and did not think anything about it. Though today I started to think. If the cellular phone company could sense that I had come into there area, they could track my movements all over the country on a carrier by carrier basis. They might even be able to track me with in a city/area by which antenna was picking up my signal. Right now the risk is rather low, but its something to think about.

While the risk of such real-time tracking may have seemed rather low in 1992, the view from 2017 is quite different. Mobile or cellular phone tracking was something indeed that many thought about, and it has become almost ubiquitous now, particularly when combined with location tracking via nearby known WiFi signals and seemingly ever-present GPS3.

In 1978, Edward Mike Davis4 of Tiger Oil wrote in one of his many stern memos (emphasis added):

You are expected to work a minimum of eight hours a day from Monday through Friday. If you do not want to eat the food that is prepared here, don’t do me any favors by eating it. Go out to lunch, and when you go out – you make sure that you sign out, and when you come back – you sign back in. You are given one hour for lunch. If business or some delayed reason prohibits you from coming back in that one hour – please have the courtesy to call so that we may know when you will be back or what the problem is. Then that way I won’t have to wonder whether you have been here eight hours or not.

It’s quite possible, given the tone and content of the Tiger Oil Memos5 that had GPS tracking of employees been available in 1978, Davis might have found it quite a valuable way of automatically determining whether his employees were actually at their designated places of work whenever they ought to have been.

Peeping Out

Introduction

We have now reached a point where reasonably fine grained tracking of our whereabouts is something that can be readily achieved with minimum effort by a variety of individuals. Certainly, anyone with access to your mobile telephone billing information will have historical visibility of your whereabouts at any time you made a telephone call. In a situation where an employer provides either a complete mobile phone package to an employee – or at least, in a BYOD6 environment, provides the SIM – then the employer will, in fact, have access to phone records that can provide them details of where you were at times you made calls.

On October, 2017, it was reported that Stonnington Council in Melbourne suspended 4 employees based on locational information in their mobile phone records which indicated they were outside their work area at a time they were meant to be working. In The Age, we are told7:

Three of the staff were employed as field service officers, enforcing Stonnington’s planning guidelines at pubs and nightclubs in the area, and often received penalty rates for working evening shifts. A fourth worker was also part of the council’s enforcement department, but worked day shifts.

Every time they made a call, sent an SMS message or accessed the internet, the council officers unwittingly left an electronic footprint that could be accessed by their employer.

The council is understood to have obtained mobile phone records dating back more than a year. It also claimed swipe card technology and CCTV footage from the Stonnington City Centre proved the men were not at work.

One employee’s mobile phone is believed to have pinged off a tower near Shepparton – more than 180 kilometres north-east of Stonnington in Melbourne’s inner south.

(It must be noted that additional commentary in the article also refers to other locations cited being on the border of Stonnington’s municipality and therefore potentially picked up by shared cell towers.)

Since this is an active case there was no official response from the Council or the union on the situation, though the president of Liberty Victoria8, Jessie Taylor was quoted citing the privacy implications of employers accessing such records9:

“Just because an employer can access that data doesn’t mean they should, and such breaches of an employee’s privacy are likely to lead to a significant erosion in the trust relationship and culture of a workplace,” Ms Taylor said.

and

“There is also a serious question about whether the council has breached its obligations under the Victorian Charter of Human Rights and Responsibilities. As a public authority, Stonnington council has an obligation to act consistently with human rights, including the right to privacy and freedom of movement.”

The Stonnington Council case is certainly not unique when it comes to employee tracking. In 2015, Myrna Arias sued her former employer, who had dismissed her after she uninstalled a GPS tracking app from her mobile phone that was being used 24×7 to track her whereabouts10:

[Her boss] admitted that employees would be monitored while off duty, and bragged that he knew how fast she was driving at specific moments ever since she had installed the app on her phone

Location-based tracking of staff can now be performed by a variety of mechanisms. Employees with mobile telephony may be required to to literally install GPS trackers. Alternately, employees might be required to use specific email clients which remain active in the background on a phone and be location aware. Location services also now feature in popular modern operating systems, such as Mac OS X and Windows. Employees with company provided vehicles, particularly in mobile service11 or delivery12 may have GPS tracking devices affixed to their vehicles to help coordinate and optimise delivery times. While GPS tracking of food delivery for services such as UberEats may seem an expected part of the service, it can also be noted that more traditional food delivery franchises, such as Pizza restaurants, also use GPS tracking of drivers to enhance the customer experience13 and potentially prevent disputes over whether ordered food was delivered on time, and hot.

From a practicality consideration, employee or contractor location tracking is becoming ‘part of the furniture’ in some industries, and is likely to continue to expand in its utilisation. As more businesses turn to mobile workforces and work/life blending14 becomes more common, it’s quite possible there will be increased attention from personnel departments within organisations to ensure employees are working an expected amount of time.

There are four key questions relating to location based tracking of employees, viz.:

  1. Is it ethical to track the location of an employee when they are not at work?
  2. Is it ethical to track the location of an employee at work?
  3. What, ethically, can location tracking data be used for?
  4. Is it ethical to track employees without their awareness?

Employee location tracking

Is it ethical to track the location of an employee when they are not at work?

It is likely quite reasonable to assume that even if there are valid reasons for an employer to track your location whilst you are working, there is nothing ethically valid about them tracking you when you are not working. An employee, who, having finished work for the week, or the afternoon, should, by rights, be entitled to have no more communication with or visibility to their employer until they return to work. (We are assuming in this case that an employee is not a rostered on-call employee.) Indeed, this can be considered for two distinct reasons: first, from a pure privacy perspective, an employer does not have a right to know what employees do outside of work hours15; second, an employer pays their employee for the hours they work, not for the hours they work and and the hours they don’t. (To become even a meaningful workforce request, an employer should be willing to pay staff for all hours they ‘need’ to track an employee, though this would not alter the overall ethical considerations.)

Typical considerations for employee tracking outside of business hours falls into the same broad spectrum of ‘requirements’ used by some businesses to justify social media monitoring of employees16. These come down to considerations such as ensuring employees are not engaging in behaviour the company considers to be inappropriate, or behaviour the company leaders feel, if associated with the company, might bring it into disrepute. Yet these are, by and large, farcical considerations, and represent unwarranted intrusions into the personal lives of employees. An employee for instance might routinely engage in sadomasochism parties with other consenting adults outside of business hours, but so long as no laws are broken, it should be of no business to the employer – regardless of whether specific individuals within the realms of the employer find this scandalous or not. (Such considerations were perhaps best summed up in a fictitious judicial ruling in the television series Absolute Power17 relating to a sex scandal, where it was noted (paraphrasing) “Simply because an event is something the public might find interesting does not mean it is in the public interest“. In this, the distinction between prudish and/or titillating voyeuristic interest and actual public interest is stark.)

Tracking an employee outside of working hours implies an intent to periodically examine what the employee is doing. After all, a common ethical consideration in business, particularly relating to personal and personally sensitive data is that data which does not need to be collected should not be collected18. Therefore, (1) any business failing to adhere to this is bucking the trend of acceptable business practices relating to information handling, and (2) any business which collects this information while requiring employees to undertake such an ethical undertaking regarding customer data must be intending to use that data. Since governments employ police services to enforce the law, any supposed intent of the business to use that data for ensuring employees are abiding by the law (e.g., not speeding) is simply vigilantism. Beyond that, any other intended use of such tracking is likely to relate to either personal beliefs of specific leaders (e.g., “employees shouldn’t visit union headquarters”, “employees shouldn’t attend rave parties”, “employees must not frequent brothels”, “employees must attend church every week”, or “employees should not frequent our competitor’s locations”) and represent an intended intrusive effect on employees. In this, we return to the definition of an invasion of privacy provided by David Vincent in Privacy: A short history19:

In the sense of the physical invasion of privacy, surveillance comprises five sequential events: the capacity to observe; the act of observation; comprehension of what is seen; intervention on the basis of that knowledge; and a consequent change of behaviour by the subject.

In such a situation where an employer intends to track the location of employees outside of working hours, all five of these traits are likely to be met – first, the employer intends to observe; second, the employer does observe, by means of data collection; third, the employer by gathering those records intends to review them at some point and correlate them to other data points, such as locational or telemetric data; fourth, the employer intends to intervene in situations where observed behaviour is inconsistent with desired behaviour; and fifth, the employee may be counselled to perform alternate behaviour, may be dismissed for disallowing tracking, or may be subtly encouraged by knowing that observation is potentially taking place, to not engage in behaviour he or she might otherwise prefer to do.

Since tracking of employee locations outside of employment times is likely to warrant meeting the definition of an invasion of privacy, there would seem to be little ethical support for this practice.

Is it ethical to track the location of an employee at work?

Are there situations where it is ethical for a business to track the location of its employees? This perhaps requires some deontological thinking – a rule based approach to understanding when such tracking may or may not be appropriate.

There are certain types of work where there is a justifiable requirement for a business to know where at least some of its employees are at any given point of time. Courier, delivery and general postal service companies would fall into this broad category. Where customers (be they consumers or businesses) increasingly want real-time tracking of shipments, and will choose delivery services based on the provision of such information, tracking packages as they move between vehicles and storage facilities is becoming an essential business activity. Particularly at end-point interactions (pickup and delivery), packages will be optimally tracked at the vehicle level, which will in turn be associated with the employee who is rostered to work in that vehicle at a given time.

In this situation though the employee is not actually the subject or the purpose of the tracking – at least, not directly. Either the vehicle being driven is the subject (for route confirmation and/or optimisation), or as a container for content of the vehicle is (as a means of determining individual package location without using a sensor on each package). Thus, it would be reasonable to assume that during say, a lunch break, a delivery driver should be perfectly entitled to move away from the tracked vehicle in the confidence that they, themselves, are no longer being tracked.

Another situation where employee tracking might be required is in mobile service industries – for example, a computer services company that dispatches employees to customer locations in order to perform particular repair or consultancy work, usually billed by the hour. In such industries, it is not uncommon to experience disagreements between customers and businesses as to the number of hours worked on-site. Customers may dispute attendance logs that are not co-signed, and equally in situations where co-signed attendance logging is used, customers may insist on rounding up arrival times and rounding down departure times in agreed logs20. Businesses seeking to maximise accuracy and minimise disputes in billing might instead require employees to use time-sheeting software on mobile devices that records not only the time arrived at site, but also the GPS coordinates (and likewise for departure), so there can be no dispute at a later point in time.

While in such instances the employee is the business resource being tracked, it would again seem to be the case that tracking is not warranted during particular situations – e.g., when an employee is on his or her lunch break, their location is irrelevant to the business, so long as they are able to start again at the required time and the agreed location. Likewise, since such tracking is to confirm arrival and departure, ongoing on-premises location tracking would likely not be relevant, and should fall into the category of data which does not, technically, need to be collected.

While it might be argued that tracking employee physical location/movement is appropriate to confirm employees are working where or when they are paid to work, it could equally be argued that such granular monitoring would create an impression of micromanagement and lack of trust. Neither activity is typically deemed a worthwhile business process for ensuring adequate employee morale and retention. Management practices in fact normally suggest quite the opposite – that micromanagement will rarely achieve a favourable result, and that continuing, demonstrable lack of trust will leave employees extremely dissatisfied with their job.

What, ethically, can location tracking data be used for?

This should effectively fall into the same classification scheme used to determine whether or not customer private or personally sensitive information can be collected by a business. That is, the business should clearly articulate the intended uses of the data. In the case of mobile services for instance, the business might state that it will be used to confirm end-customer billing, but if it gives no other intended use of the data, it should not subsequently use it to (for instance), judge employee performance based on the amount of time taken to perform specific tasks that customers have engaged.

If, at a later point in time, the business intends to alter the intended use of the data, then fair notice should be given to employees, and the business should have also stated, at employment commencement (or when data began being gathered), whether or not future changes to data analysis would be retrospective against previously gathered data or forward-looking only.

We might also suggest there must be tangible determined benefit (certainly beyond “we don’t trust you”) in order to justify collecting such information. In the case of delivery companies and mobile service companies, the argument can be made that at least some form of location tracking, either indirectly or directly applicable to specific employees, might be deemed to be of essential business benefit. Beyond this, it would be pertinent if appropriate criteria were used to establish the purpose – the why – of keeping otherwise personal data about employee movements. In this, the Information Accountability Foundation’s document, Unified Ethical Frame for Big Data Analysis21 might contain a useful framework for such determinations.

In this document, the author points out a need for meeting 5 key criteria for data gathering in relation to big data analytics. While location tracking may not necessarily fall into the immediate category of big data analytics, the criteria can be considered to be equally applicable for other forms of data gathering. These criteria are:

  1. Beneficial – There should be tangible benefits to all involved. In a business context, this would apply to the customer, the business, and the employee.
  2. Progressive – If a less invasive way of performing a particular business function or service can be done without one which potentially invades privacy (i.e., location tracking), then that option should be favoured. (For example, in the case of delivery services, this would be where vehicles, rather than the employees driving the vehicles, are tracked.)
  3. Sustainable – Particularly in situations where the data is to be retained beyond a reasonably expected period of time, there should be a case for ongoing benefit being derived from retaining that data.
  4. Respectful – The data should be used explicitly for what has been stated it will be used for, and no more.
  5. Fair – The insights gathered from location tracking should not be used in a discriminatory or inappropriate fashion. (For example, it may be that older employees on delivery services could be observed to take longer to perform their deliveries, on average, than younger employees. If particular actions are taken on this basis it may very well be the case that data has been used for discriminatory purposes.)

Such criteria could readily be adapted to determine whether or not there are good/ethical reasons for monitoring, recording and acting on employee location data.

Is it ethical to track employees without their awareness?

No.

If a business intends to use location based tracking for its employees, this should be clearly defined in the terms of employment, including how and why the data will be used.22  Any attempt to track employee location without employees being aware of it should be considered unethical behaviour.

Conclusions

Location tracking, and specifically GPS, is a function so common in modern technology that people rarely give it a second thought. We are prompted by a myriad of applications that we install on our smartphones to confirm whether or not the application can monitor our location, either while we’re directly using the application, or even while it is in the background. Such services may enable us to find our friendsfind our phonefind a bargainremember a chore or even find a date. In each case though there is an implicit assumption that we, the people whose locations are being tracked, derive tangible benefit in addition to the business offering the service. They get our engagement or our money, and we get something in return.

A similar approach should also be considered when it comes to determine the whens and ifs of location based tracking of employees. If sufficient mutual benefit cannot be determined, perhaps then there is not sufficient justification (even if we’re told there is).

 

Footnotes

  1. Forum on Risks to the Public in Computers and Related Systems, Edited by Peter G. Neumann.
  2. RISKS Digest Volume 13, Issue 44, Monday 27 April 1992.
  3. Global Positioning System
  4. Obituary for Edward Mike Davis, Las Vegas Review Journal
  5. Tiger Oil Memos at Letters of Note
  6. Bring Your Own Device
  7. Stonnington council suspends staff after tracking them via phone records, Cameron Houston and Chris Vedelago, October 1 2017, The Age
  8. Liberty Victoria Homepage
  9. Stonnington council suspends staff after tracking them via phone records, Cameron Houston and Chris Vedelago, October 1 2017, The Age
  10. Woman fired after disabling work app that tracked her movements 24/7, James Vincent, May 13 2015, The Verge
  11. For example, installation and repair
  12. For example, courier, logistics or postal services
  13. Dominos Pizza GPS Driver Tracker
  14. Work. Life. Blend., Jonathan Fields
  15. Except perhaps under particular circumstances, such as in situations where interests of national security may involved – though this, too, may be argued as insufficient cause
  16. This is a topic we will cover in another article
  17. Absolute Power on IMDB
  18. For example, if a customer inquiry can be handled without needing to know the customer’s gender or date of birth, there is no ethical or business reason to record that information.
  19. Privacy: A short history, David Vincent, 2016, Polity Books, 978-0-7456-7112-3
  20. For example, a 10:14 am arrival time becomes 10:30 after the customer insists it will take at least 10 minutes for the engineer to get setup, etc.
  21. Unified Ethical Frame for Big Data Analysis, Martin Abrams, March 2015, Information Accountability Foundation
  22. This would include roles where ‘common sense’ would suggest such tracking is likely, such as delivery services.
%d bloggers like this: