含羞草社区

Technological advancements continue to reshape our work environment. Employers now rely on artificial intelligence (AI) and other performance management tools to ensure the efficient tracking of employee performance and productivity, whether from a remote or in-office setup. Programs now allow employers to analyse employees’ emails and even record employees at random intervals on workdays.

As technology becomes more intrusive, workplace boundaries become blurred. While these tools guarantee efficiency, what becomes of an employee’s reasonable expectation of privacy? In determining whether there is a violation of the right to privacy, the Supreme Court has used the reasonable expectation of privacy test which relies on two factors:

1. Whether by his/her conduct, the individual has exhibited an expectation of privacy; and
2. Whether this expectation is one that society recognises as reasonable.

The reasonableness of a person’s expectation of privacy must be determined on a case-to-case basis.

In this regard, the National Privacy Commission (NPC) has opined that the reasonable expectation of privacy test should be revisited following the promulgation of the Data Privacy Act of 2012 (DPA). On this score, the NPC has released advisory opinions balancing employer interests with employees’ right to privacy.

AI in call recording

The NPC, in its Advisory Opinion No. 2024-005, discussed how a certain company is considering the use of an AI program that will analyse call recordings and emails between its call centre employees and customers. The program will process personal data for the purpose of autoscoring employees’ interactions and ranking employees to identify opportunities for coaching and development.

The NPC explained that since personal information such as an employee’s name, voice and speech pattern would be collected by the program, consistent with the requirements under the DPA, a legitimate interest must be established for the processing of such data.

In addition, the following conditions must be satisfied for processing based on legitimate interest:

1. Legitimate interest is established;
2. Processing is necessary to fulfil the legitimate interest; and
3. The interest is legitimate and lawful and does not override the fundamental rights of data subjects.

The NPC said the use of automated scoring to evaluate employee performance could be considered a legitimate interest since it directly contributes to the above-mentioned company’s goal of improving its services, and can enhance its overall performance.

Installing monitoring software

Likewise, in NPC Advisory Opinion No. 2024-003, a business process outsourcing (BPO) company sought the NPC’s advice as it intends to a acquire monitoring software in which web cameras with microphones will be turned on at random intervals to record short videos of the subject employee and his/her immediate surroundings.

Similarly, the NPC advised that a lawful basis must be established for the processing of employees’ personal data and that the BPO may rely on either section 12(b) or 14(f) of the DPA for the same.

Section 12(b) of the DPA allows processing for the fulfilment of a contract with the data subject. The provision may be used if the employment contract provides specific provisions allowing the installation of equipment/software for furtherance of employment.

On the other hand, section 12(f) of the DPA allows processing if it is necessary for the legitimate interests pursued. The NPC listed legitimate interests such as management of workplace productivity and enforcement of company policies, that give reasonable cause for the preventive monitoring of employees.

Data privacy principles

In both above-mentioned opinions, the NPC emphasised that even if the companies have a legal basis for processing information, they are still required to adhere to fundamental data privacy principles of proportionality, transparency and legitimate purpose.

Following this, the means of processing the data should be necessary and lawful. For instance, if the company’s goal is to identify trends across employee interactions, the personal data processed should only be used for the specific purpose. Similarly, in monitoring employees, the data collected should be proportional to the fulfilment of the purpose of monitoring.

The NPC further advised that the companies should properly inform employees of the specific purpose, method and extent of the data processing and monitoring before utilising such software.

Jenn Kiana Louise N Carde?o is an associate in the labour and employment department of ACCRALAW

ACCRALAW

22nd to 26th Floors, ACCRALAW Tower, Second Avenue corner
30th Street, Crescent Park West, Bonifacio Global City
Taguig, Metro Manila, Philippines

 

Contact details:
Tel: +63 2 8830 8000 loc 8326
Email: jncardeno@accralaw.com