The Workplace-Surveillance Technology Boom

This article originally appeared in Future Tense, a collaboration among Arizona State University, New America, and Slate. It's part of Privacy in the Pandemic, a Future Tense series.

There is an inevitability around the fact that heightened surveillance will be necessary to resume life in any state of normalcy. While there has been concern about overreach from the government and private tech companies offering surveillance solutions, less attention has been paid to another powerful group likely to expand their surveillance powers: employers.

Employers have always held sensitive information like workers’ social security information, salaries, and existing medical conditions. Some have also used technology like wearables, flagging tools, automated profiling, and remote activity trackers to further monitor their workers. In The Age of Surveillance Capitalism, Shoshana Zuboff says the workplace is “where invasive technologies are normalized among captive populations of employees.” Despite this, employers have largely escaped scrutiny for their extensive monitoring practices from both experts and workers themselves. Since the start of the pandemic, many companies have begun to even more aggressively track their workers’ productivity, and as workplaces start to open again, it is likely that the scale and types of data collected by employers will continue to increase to combat the threat of COVID-19.

Essential industries have already started putting in new measures. For example, Amazon and Walmart use infrared cameras to conduct temperature checks for their warehouse workers, and hospitals like Johns Hopkins and Mayo Clinic are using apps to track staff’s health conditions and possible virus exposures. These are in line with guidelines from the Occupational Safety and Health Administration requiring employers to track cases of COVID-19. Guidancereleased by the U.S. Equal Employment Opportunity Commission confirms that employers can legally check temperatures and screen employees regarding COVID-19 symptoms, as well as require workers to leave if they are sick.

Lots of other tracking tools are being developed and marketed to large employers in industries beyond the front line. There are mobile apps that ask employees to self-report their health symptoms and status, and data on their heart rate and pulse oximetry. Some, like those developed by Pegasystems or Cordata, also analyze or classify a worker’s “risk levels” based on responses. Others have integrated these questions into existing processes (Arcoro has included a self-reporting health form in its attendance app when employees clock-in for work), or have added questions about both symptoms and productivity to their surveys (like Appian).

Then there are systems that focus on tracing rather than health symptoms, collecting data on a worker’s location, movements, and proximity to others. The coworking space Knotel recently updated its app with the capability to check members’ whereabouts. Landing AI developed an artificial intelligence-enabled tool that analyzes video streams from security cameras and sends alerts when employees are not practicing social distancing. Estimote has created a “Proof of Health” wearable available as a lanyard, wrist watch, or card. The wearable conducts GPS location tracking and Bluetooth contact tracing, and collected information is centrally stored and displayed on a health dashboard that “provides detailed logs of possible contacts.” Companies like CenTrak and SwipSense supply RFID-enabled lanyards that record which rooms workers enter or exit, and whether they washed their hands or used hand sanitizer. Sewio has released a “real-time location system” that involves a comprehensive suite of sensors to install in the workplace, and portable signal transmitters for “asset tracking, fleet tracking, and people tracking,” as well as accompanying software to monitor all the moving parts.

There are free solutions available, too. For example, security and employment experts have predictedthat companies will require employees to download Apple and Google’s contact tracing app before they are allowed back to work. But Apple and Google’s tool at least mitigates the worst privacy risks by decentralizing and anonymizing the data collected. The same cannot be said for the solutions described above.

Whether or not these technologies are made explicitly mandatory by employers, in reality it is unlikely that employees will have a choice. Labor is rarely in a position of bargaining power in the workplace due to the United States’ at-will employment model, and that power imbalance has become increasingly skewed as job security feels precarious and jobless claims have seen a 3,000 percent increase. Employers could also use other incentives to encourage opt-in, like leaving workers with paying higher health insurance premiums if they choose not to participate.

Additionally, people have extremely limited privacy rights in their capacities as workers. Though there are stricter regulations regarding the collection and use of health information and other sensitive categories, employers are generally legally permitted to collect most types of data from their workers so long as there is a legitimate business reason. For example, there are few federal restrictions on employers’ collection and use of workers’ GPS data or other device data, and employers have full rights to any employer-owned equipment, including devices like laptops and phones, or accounts on communication channels like email or Slack. Estimote calls its technology “less invasive” because information is shared “only with your employer”—but how much of this information should employers have, especially without clear safeguards that the data will not be repurposed or used unfairly?

Research from Data & Society has found that data collected by monitoring technologies has been used to inform automated assessments about workers’ behaviors, qualities, or fitness for employment, increasing the potential for workplace discrimination. These technologies could also be used not just to monitor but to control workers. In a client alert, the law firm Ropes & Gray recommended that “employers might consider rules that, at least for the near future, do not allow employees who report to a physical workplace to engage in leisure or other activities with other than co-habiting family members.” Requiring contact tracing and location tracking could very well be used to enforce these kinds of restrictions, especially in states without extra legal protections against employer GPS tracking or regulation of off-duty conduct.

Even as surveillance is increased in the name of workforce safety, employees may not feel the benefits. There is currently no federal requirement that an employer advise their employees if a co-worker tests positive for COVID-19, and without guidance from a state’s Department of Health, it is up to each individual company to make the decision. Warehouse and health care workers have reported learning of infections from rumors or even news reports days after a coworker’s positive testing, even though there are easy ways to implement privacy-protecting notification systems rather than keeping employees in the dark. For example, individuals could be asked for their consent before any named disclosures, or general announcements could be made without disclosing the affected individual’s identity at all.

In late April, Republican senators announced plans to introduce a COVID-19 Data Protection Act. While few details have been released, the bill would apparently apply to any companies under the Federal Trade Commission’s jurisdiction (employers don’t seem to be exempted), and sets out several requirements to protect individuals whose data is collected for the purposes of tracking COVID-19 spread. If introduced as is, it could help mitigate some concerns about data misuse. One requirement is that all personally identifiable information be deleted or de-identified “when it is no longer being used for the COVID-19 public health emergency.”

However, the bill addresses only data collected for COVID-19 related purposes, and does not extend protections to other circumstances. Without holding employers to higher privacy standards for all the data they collect, workers will be left in ever more precarious situations as  power dynamics continue to shift away from them in the increasingly surveilled workplace.