Technological advancements continue to reshape our work environment. Nowadays, employers rely on Artificial Intelligence (AI) and other performance management tools to ensure the efficient tracking of employee performance and productivity, whether from a remote or in-office set-up. Programs now allow employers to analyze employees’ e-mails and even record employees at random intervals on workdays.
Verily, as technology becomes more intrusive, workplace boundaries become blurred. While these tools guarantee workplace efficiency, what becomes of an employee’s reasonable expectation of privacy?
In determining whether there is a violation of the right to privacy, the Supreme Court has used the reasonable expectation of privacy test which relies on two factors:
1. Whether by his conduct, the individual has exhibited an expectation of privacy; and,
2. Whether this expectation is one that society recognizes as reasonable.1
Ultimately, the reasonableness of a person’s expectation of privacy must be determined on a case-to-case basis as it depends on the factual circumstances surrounding the case.2
In this regard, the National Privacy Commission (NPC) has opined that the reasonable expectation of privacy test should be revisited following the promulgation of the Data Privacy Act of 2012 (DPA).3 On this score, the NPC has released Advisory Opinions balancing employer interests with employees’ right to privacy.
ON THE USE OF AI IN CALL RECORDING
The NPC, in its Advisory Opinion No. 2024-005, discussed how a certain company is considering the use of an AI program that will analyze call recordings and e-mails between its call center employees and customers.4 In doing so, the program will process personal data for the purpose of autoscoring employees’ interactions and ranking employees to identify opportunities for coaching and development.
Given this, the NPC explained that since personal information such as an employee’s name, voice, and speech pattern would be collected by the program, consistent with the requirements under the DPA, a legitimate interest must be established for the processing of such data.
In addition, the following conditions must be satisfied for processing based on legitimate interest, viz:
1. legitimate interest is established;
2. processing is necessary to fulfill the legitimate interest; and,
3. the interest is legitimate and lawful, and it does not override the fundamental rights and freedoms of data subjects.5
The NPC declared that the use of automated scoring to evaluate employee performance can be considered a legitimate interest since it directly contributes to the Company’s goal of improving its services and can enhance its overall performance.
ON THE INSTALLATION OF MONITORING SOFTWARE
Likewise, in NPC Advisory Opinion No. 2024-003, a Business Process Outsourcing (BPO) company sought the NPC’s advice as it intends to acquire monitoring software wherein web cameras with microphones will be turned on at random intervals to record short videos of the subject employee and his/her immediate surroundings.6
Similarly, the NPC advised that a lawful basis must be established for the processing of employees’ personal data and that the BPO may rely on either Section 12 (b) or 14 (f) of the DPA for the same.
Section 12 (b) of the DPA allows processing for the fulfillment of a contract with the data subject. The provision may be used if the employment contract provides specific provisions allowing the installation of equipment/software for furtherance of employment.
On the other hand, Section 12 (f) of the DPA allows processing if it is necessary for the legitimate interests pursued. The NPC then listed legitimate interests, such as management of workplace productivity and enforcement of company policies, that give reasonable cause for the preventive monitoring of employees.
ON ADHERENCE TO DATA PRIVACY PRINCIPLES
In both Opinions, the NPC emphasized that even if the companies have a legal basis for processing information, they are still required to adhere to the fundamental data privacy principles of proportionality, transparency, and legitimate purpose.
Following this, the means of processing the data should be necessary and lawful. For instance, if the Company’s goal is to identify trends across employee interactions, the personal data processed should only be used for that specific purpose. Similarly, in monitoring employees, the data collected should be proportional to the fulfillment of the purpose of monitoring.
The NPC further advised that the companies should properly inform employees of the specific purpose, method, and extent of the data processing and monitoring before utilizing such programs.
Given the changing technological landscape, our understanding of employees’ reasonable expectation of privacy continues to evolve. While the adherence to the data privacy principles remains fundamental when drawing boundaries at the workplace, the impact of technology thereon needs to be further explored.
1 Ople v. Torres, G.R. No. 127685, July 23, 1998.
2 Id.
3 National Privacy Commission, NPC Advisory Opinion No. 2018-90 (Nov. 28, 2018).
4 National Privacy Commission, NPC Advisory Opinion No. 2024-005 (May 21, 2024).
5 National Privacy Commission, MAF v. Shopee Philippines, Inc., NPC 21-167 (Sept. 22, 2022).
6 National Privacy Commission, NPC Advisory Opinion No. 2024-003 (April 2, 2024).
The views and opinions expressed in this article are those of the author. This article is for general informational and educational purposes only and not offered as and does not constitute legal advice or legal opinion.
Jen Kiana Louise N. Cardeño is an associate of the Labor and Employment Department of the Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW).
jncardeno@accralaw.com
