Q: In the HR industry, monitoring software appears to be increasingly popular. How and when is this legal?

A: Forms of monitoring, like keeping tabs on employee web browsers or logging keystrokes, is legal due to the U.S.'s "notice approach" — as opposed to a "consent approach" — to privacy rights.

"If an employer notifies an employee that it will have the right to monitor all work-provided resources such as email, instant messaging, web browsing and use of company-provided laptops, that notice is generally all that is needed," said Mark McCreary, partner at Fox Rothschild and co-chair of the firm's privacy and data security practice. "That notice can occur in something like an employee handbook, or a login screen each time the employee logs onto their computer." McCreary added that this approach is what he considers a best practice.

In a Digital.com survey on employee monitoring, 14% of employer respondents said they haven't told employees that they're being monitored. That may be because notice is not required in all jurisdictions. "While the case law may vary, generally speaking as long as the service or equipment being monitored is company-provided, there is a strong argument that the employer does not need to give notice," McCreary said. 

As for personal email and private social media accounts, the question of whether employers can or should monitor these behaviors on a work laptop becomes "much more difficult," he added. Legally speaking, no, an employer can't force an employee to provide a password to their personal email or Twitter account. But if the employer has given notice that all activity on company-provided equipment will be monitored, a strong argument for monitoring nonwork activities exists there.

"The question really becomes whether the employee has a right to expect privacy in a certain situation," McCreary said. "To expect privacy on a company-provided laptop is a difficult argument to win in my view."