United Arab Emirates (UAE) Employee Monitoring Laws: What Are Employers Allowed and not Allowed Doing in the Workplace?
Q: Do employers have the right to monitor employees’ computers, such as desktops, laptops, servers and their Internet activities?
A: Yes, employers have this right.
Employers have the right to monitor their property used by employees in the workplace, but only in case of employees’ awareness and agreement, especially when any personal data pertains to an individual’s private or family life. If employees do not give their consent, then it is prohibited to monitor them during working hours. (According to several UAE Federal Laws: Constitution of the UAE (Federal Law 1 of 1971),Penal Code (Federal Law 3 of 1987 as amended),Cyber Crime Law (Federal Law 5 of 2012 regarding Information Technology Crime Control), and Regulating Telecommunications (Federal Law by Decree 3 of 2003 as amended)).
«There is no specific data protection legislation in the UAE. The concept of ‘Personal Data’, as understood in the EU, is not reflected under UAE Federal Law. The corresponding concept within UAE Law encompasses notions such as ‘secrets’, ‘photographs’, ‘the privacy of the individual or family life’ and ‘private life or family life secrets of individuals’. As such, while no UAE Federal Law explicitly states that the collection of personal data requires express consent, if any such data pertains to private or family life then, in certain circumstances, the consent of the individual(s) concerned may be required.». (By Kate Lucente and John Townsend in ‘Data Protection Laws of the World’, May 2015).
Q: Do employers have the right to monitor keystrokes, email’s content, and screens?
A: Yes, employers have this right, but only if employees give their consent (see above).
Employers have the right to monitor company’s property, such as: computers, phones and other electronic devices as well as email’s content or keystrokes provided to the employees, as well as email address in case of employees’ full awareness and consent.
«If the collection and processing of any personal data pertains to an individual’s private or family life then the consent of the individual may be required in certain circumstances. A failure to obtain such consent would constitute a breach of the Penal Code (Article 378) and could also be a breach of the:
– Cyber Crime Law if the personal data is obtained or processed through the internet or electronic devices in general (Articles 21 and 22), and
– Telecoms Law to the extent that data is obtained through any means of telecommunication, including through a telecommunications service provider, or any other electronic means. In addition, the facility should be made available for such consent to be withdrawn at a later stage (TRA Consumer Protection Regulations, Article 12.5).
The Cyber Crime Law criminalizes obtaining, possessing , modifying, destroying or disclosing (without authorization) electronic documents or electronic information relating to medical records (Article 7). Additionally, unlawful access via the internet or electronic devices of financial information (e.g. Credit Cards and Bank Accounts) without permission is an offense under Articles 12 and 13». (By Kate Lucente and John Townsend in ‘Data Protection Laws of the World’, May 2015).
Q: How employees are protected in this situation?
A: There are such laws that protect employees’ sensitive data.
Employees are protected by UAE Federal Laws, as they have the right to personal privacy. If employees don’t agree with processing their personal sensitive data then it’s not allowed for employer to monitor them. According to UAE Federal Laws employers must inform employees about monitoring in the workspace before implementing it and also ask for their consent.
«Employers have a right to monitor their computers but it becomes a grey area when monitoring an employee’s social media activity as employees have a right to privacy.»(By Triska Hamid in ‘The National Business’-‘UAE online laws: Know your place in cyber space’).
«In the DIFC, there is a data protection law, which gives some clarity on an employer’s obligations with respect to employee’s personal information. Employers require employee consent to process their personal information and certain information is recognized as being sensitive personal information. If an employer wishes to monitor communications, then it should have a clear policy on doing so and inform employees as well as obtain their consent» (By Sara Khoja, Partner, Employment Group at Clyde & Co in Dubai, told Emirates 24|7).
Q: What professional lawyers suggest?
A: They suggest providing clear monitoring policy, making notifications about monitoring in the office and ask employees’ permission before implementing it.
Professional layers recommend to provide clear monitoring policy to all the employees, according to local federal laws, get their consent for monitoring any personal data during working hours before implementing the monitoring software in order not to violate human rights.
«Lawyers suggest monitoring websites and ensuring offensive material is deleted quickly. Some companies may be tempted to outsource their online presence to a service provider, which can take away from the daily hassle, but it is necessary to have a good agreement and an outline of policies with them.»(By Triska Hamid in ‘The National Business’-‘UAE online laws: Know your place in cyber space’).
WorkTime – Respectful Employee Performance Monitoring – www.worktime.com
This article provides general information only. This information is for general understanding only and not to be used as legal advice. To receive professional legal advice, please consult your lawyer.