Blog

Digital systems have made workplace monitoring easier and more detailed, but also increasingly intrusive.

Employers can use Closed-Circuit Television (CCTV) cameras, review electronic communications, record calls, track access through biometric systems, and monitor activity on company devices. Although these measures may protect legitimate business interests, ownership of the workplace or equipment does not give an employer an unrestricted right to monitor employees.

South African law requires a balance between the employer’s operational interests and the employee’s rights to privacy, dignity, and fair labour practices. Monitoring must therefore have a lawful purpose, be proportionate to that purpose, and be conducted transparently and securely.

The Legal Framework

Section 14 of the Constitution protects everyone’s right to privacy, including the right not to have the privacy of their communications infringed. This right continues to apply in the workplace, although its scope may be narrower where an employee uses the employer’s premises, equipment or communication systems for work. The right is not absolute and may be limited where the limitation is reasonable and justifiable under Section 36 of the Constitution.

A central consideration is whether the employee had a reasonable or legitimate expectation of privacy. In Bernstein and Others v Bester NO and Others 1996 (2) SA 751 (CC), the Constitutional Court recognised that privacy is strongest in the personal sphere and generally becomes more limited as a person enters communal or business relationships. This does not mean that employees surrender their privacy at work. It means that the nature of the workplace, the type of communication, the employer’s policies, and the employee’s knowledge of monitoring will influence the strength of the privacy claim.

The Protection of Personal Information Act 4 of 2013 (POPIA) is also fundamental, because information gathered through cameras, email reviews, call recordings, access-control systems and productivity software will ordinarily constitute personal information. Its processing must therefore be lawful and reasonable, and must not unjustifiably infringe privacy. In the monitoring context, this means that information must be collected for a specific, explicitly defined and lawful purpose, and the monitoring must be adequate, relevant and not excessive in relation to that purpose. Employees should ordinarily be informed of the monitoring, its purpose, the information collected, and their rights in relation to it.

The Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002 (RICA) becomes relevant when communications are intercepted or recorded. The general rule is that intentional interception during transmission is prohibited, so an employer will need to rely on a statutory exception, such as interception with the required consent, interception by a party to the communication, or monitoring undertaken in accordance with the Act’s business-related exception.

The two Acts apply independently of each other. Compliance with POPIA does not cure an unlawful interception under RICA, and lawful interception under RICA does not remove the employer’s POPIA obligations regarding the resulting information.

CCTV and Video Surveillance

Employers may use CCTV for purposes such as protecting employees and customers, securing property, controlling access, preventing theft, investigating misconduct, and complying with safety requirements. Cameras may also be used to confirm events relevant to a disciplinary investigation. However, surveillance should be confined to areas where it is reasonably necessary.

Cameras in entrances, production areas, warehouses, parking areas, and cash-handling points may be justifiable because they relate directly to security and operational risk. Monitoring in toilets, changing rooms or similar private spaces would ordinarily constitute a serious and unjustifiable invasion of privacy. Similarly, continuous surveillance of an individual employee may be excessive where less intrusive measures could achieve the same purpose.

Employees should generally be notified that CCTV is in operation. A notice alone is unlikely to be sufficient, and it should be supported by a policy explaining the purpose of the cameras, whether footage is continuously monitored or merely recorded, how long it is retained, who may access it, and the circumstances in which it may be disclosed or used.

In Afrox Ltd v Laka and Others (J874/97) [1999] ZALC 14, the Labour Court held that an arbitrator’s refusal to consider relevant video evidence constituted a gross irregularity. The case confirms that properly presented surveillance footage may be important evidence in disciplinary proceedings. It does not, however, establish that all such recordings are automatically lawful or reliable. In Moloko v Commissioner Diale and Others (2004) 25 ILJ 1067 (LC), poor-quality video footage was regarded as unreliable. For video evidence to carry weight, employers must be able to establish its authenticity, continuity, clarity, and the circumstances in which it was obtained.

Monitoring Emails, Internet Use and Messages

An employer has a legitimate interest in protecting its networks, confidential information and intellectual property. It may also need to detect fraud, harassment, data leaks, malware or serious misuse of working time. These interests can justify monitoring traffic data, security alerts, websites visited and, in appropriate circumstances, the content of workplace communications.

Company ownership of an email account, computer or cellphone does not by itself authorise unlimited access. Monitoring must still comply with the Constitution, POPIA and, where communications are intercepted, RICA. A policy should distinguish between routine security monitoring and access to the content of communications. Content inspection is more intrusive and ordinarily requires a stronger justification.

In Protea Technology Ltd v Wainer and Others 1997 (9) BCLR 1225 (W), the Court considered recorded telephone communications and the employee’s expectation of privacy. The phone calls in question concerned the employer’s business and affairs, specifically an alleged breach of a restraint of trade agreement and a failure by the employee to devote his full attention to the company. The employee knew that calls were being recorded, which weakened any claim to a legitimate expectation that the conversations would remain private. The case illustrates the importance of prior notification, although notification alone will not validate monitoring that is excessive or undertaken for an improper purpose.

Employers should be particularly cautious with personal email accounts and private messaging applications, even when accessed on a company device. The fact that a device belongs to the employer does not turn every private communication on it into business information. Targeted access may be justified where there are reasonable grounds to suspect serious misconduct, but indiscriminate reading of private messages is unlikely to satisfy proportionality and purpose-limitation requirements.

Telephone Calls and Recordings

Calls may be recorded for purposes of quality assurance, training, transaction verification, regulatory compliance or investigation. Employees and external callers should ordinarily be informed that calls may be recorded and why.

RICA distinguishes between a person recording a communication to which that person is a party and a third party intercepting the communication. Participation in a conversation may provide a statutory basis for recording it, but the recording and subsequent use of the information remain subject to POPIA and general privacy principles. An employer should not assume that a broad clause in an employment contract permits the secret recording of every workplace conversation.

Biometrics and Access Control

Fingerprint, facial-recognition and voice-recognition systems are increasingly used for timekeeping, identity verification and access control. Biometric information is particularly sensitive because, unlike a password or access card, it cannot easily be changed if compromised.

POPIA treats biometric information as special personal information, and processing it is generally prohibited unless an applicable statutory authorisation exists. An employer must be able to demonstrate why biometric processing is necessary and why a less intrusive system, such as an access card or personal identification number, would not adequately achieve the purpose. Where biometric processing is justified, the system must include strong security safeguards, restricted access, suitable retention periods, and procedures for responding to a data breach.

Consent should be approached carefully in employment relationships because the imbalance of bargaining power may call into question whether it was freely given. Employers should therefore identify a proper lawful ground for processing rather than relying mechanically on a consent form.

Permissible Uses and Legal Limitations

Monitoring may lawfully support workplace security, occupational safety, access control, network protection, quality assurance, legal compliance, and the investigation of suspected misconduct. It may also provide evidence in disciplinary or legal proceedings. However, information collected for one purpose should not automatically be repurposed for an unrelated reason, as this would undermine the purpose limitation on which lawful monitoring depends.

In NUMSA and Another v Rafee NO and Others (JR1022/12), an employee refused to allow access to a cellphone allegedly containing unauthorised photographs of the employer’s production line. The Labour Court accepted that the employer had a legitimate interest in protecting confidential production information, particularly because the employee had been given time to remove unrelated private material before handing over the phone. The case demonstrates the importance of a focused, proportionate approach rather than unrestricted inspection of an employee’s device.

Evidence is not necessarily excluded from civil or labour proceedings merely because it was . Nevertheless, unlawful monitoring can expose an employer to regulatory action, civil claims, reputational damage, and challenges to the fairness or reliability of the evidence. In Harvey v Niland and Others (5021/15) [2015] ZAECGHC 149, the Court considered unlawfully obtained Facebook communications and emphasised that admissibility involves weighing privacy against other competing interests and the requirements of justice. Employers should not treat possible admissibility as permission to collect information unlawfully.

Implementing Lawful Monitoring

Ultimately, lawful monitoring requires more than installing technology. It begins with a privacy-impact assessment to establish whether monitoring is necessary and proportionate, followed by consultation where appropriate, and a clear monitoring policy that is communicated to employees. Once monitoring is in place, employers should minimise collection, restrict access, and retain information only for as long as necessary.

Monitoring should be a measured response to a legitimate risk, not a system of continuous surveillance merely because technology makes it possible.