What can my employer monitor or collect about me at work?

What the law requires

Employers have to follow the Privacy Act 2020 and the Employment Relations Act 2000 when they collect information about staff. The Privacy Commissioner’s guidance makes four points:

• Employers should set out what they collect, and how it’s used and stored, in workplace policies or your employment agreement.
• They may only collect what they need for their functions, and they must be able to justify it. They’re “not allowed to collect your information just because they can.”
• They should be open with you about what they collect and why.
• Collection must not be unreasonably intrusive.

Employment law adds a duty of good faith, which makes secret or disproportionate monitoring risky for employers.

Common situations

Work email, accounts and devices. Usually justifiable for security, confidentiality and investigating specific problems, if there’s a policy you’ve been told about. Treat anything on a work account as visible to your employer.

Internet use on the work network. Usually justifiable to protect systems, if you’ve been told.

Keystroke logging, constant screenshots, webcam monitoring. Hard to justify for most roles. Ask what the purpose is and whether something less intrusive would do.

Personal social media. Employers can see what you post publicly, like anyone else. Demanding access to private accounts, or monitoring your personal life, is very hard to justify.

Personal phones. If you use your own phone for work, ask what the employer’s device management software can see. Good set-ups only manage work apps and data.

CCTV. Acceptable for security and safety in work areas when signposted. Not acceptable in toilets, changing rooms or break areas.

Location tracking. Tracking work vehicles during work hours is usually justifiable with notice. Tracking personal phones or outside work hours usually isn’t.

Covert monitoring. Only defensible in narrow circumstances, such as investigating suspected serious wrongdoing where telling the person would defeat the purpose.

What you can do

1. Check your employment agreement and workplace policies on monitoring and use of work devices.
2. Ask your manager or the privacy officer what’s collected and why. Every organisation must have a privacy officer.
3. Ask for the information your employer holds about you, including monitoring records. Use our request letter builder. They must respond within 20 working days.
4. Complain to the Privacy Commissioner if you believe the collection is unnecessary or inappropriate and raising it internally hasn’t worked.
5. Talk to your union or Employment New Zealand if monitoring is being used against you in an employment process.