§ Michael FabricantTo ask the Secretary of State for Trade and Industry what assessment she has made of the implications of services available to employers to track automatically the movements of staff using their mobile phones, with particular reference to the European Commission Directive on Privacy and Electronic Communications. [162622]
§ Mr. TimmsThe Privacy and Electronic Communications Directive (2002/5 8/EC) applies a number of privacy safeguards to value added services based on traffic and location data, including a requirement for informed consent from subscribers or users of the communications service involved, and, in the case of location data services, a requirement that subscribers or users must be able to withdraw their consent on a temporary as well as a long term basis, each time they connect to the network or make a phone call or other form of communication. The Directive was implemented in the UK by the Privacy and Electronic Communications (EC Directive) Regulations 2003, which came into force on 11 December 2003, following public consultation on this and other aspects of the Directive earlier in the year.
The Directive recognises that there needs to be a degree of flexibility in determining whose consent should be obtained in cases where the subscriber to a service is a different person from the user—for instance, where a business subscribes to a mobile phone service on behalf of employees. In their guidance on the Privacy and Electronic Communications Regulations, the view of the Information Commissioner's Office (ICO) is that in the case of a corporate subscriber, a person holding himself out as capable of making decisions on the part of the company is likely to be able to give consent, unless the communications provider has reasonable grounds to believe otherwise.
This does not remove the need for businesses and other organisations to ensure that they are complying with their own obligations to employees. The ICO have advised us that any use by employers of the data obtained from this kind of system for monitoring purposes must be conducted in accordance with the Data Protection Act and they provide detailed advice in Part 3 of the Employment Practices Data Protection Code, which is specifically concerned with monitoring at work.