Bossware: Spying or Support?

  • November 07, 2022
  • Joe Gill and Dustin Doroshenko

Employers struggled throughout the COVID-19 pandemic with a problem: were their remote employees working? Were those employees completing work deliverables or were they brushing up on their online poker skills? Without physical visibility, the concern was palpable. In their concern, employers turned to software. If all those remote employees were “always on”, there must be a means to track their digital comings and goings. And so, employers turned to something they didn’t fully understand: Bossware.

Bossware collects, sorts and stores data for an employer to review and use. Bossware features commonly include activity monitoring, screen recording or capturing, keystroke logging, and webcam or microphone recording in some cases. Some types of Bossware can even monitor employees invisibly – the employees are entirely unaware of what is collected. According to a 2022 study, 6 in 10 employers are now deploying Bossware in some form or another.

An employer’s collection and use of Bossware creatives privacy concerns

Collection and use of data produced by Bossware creates potential for infringement upon an employee's right to privacy. The Canadian courts have not tackled the issues related to an employer using Bossware adversely against an employee. However, there are several court and arbitral decisions related to an employer's infringement on an employee's right to privacy in analogous scenarios.

A case study in proper Bossware implementation

In Kone (a 2022 B.C. labour arbitration decision), the employer installed Bossware on employer-owned mobile devices that could track the location of that mobile device to verify employee attendance and payroll accuracy. The union alleged a breach of employee privacy and the matter was sent to arbitration.

The Bossware only collected data directly connected to the employer’s defined purpose – lost productivity and wages for employees who were not working (“time fraud”). Specifically:

  • location tracking was only active while an employee was at work and accumulating hours worked and only confirmed whether an employee was within the worksite or their approximate distance from the worksite (it did not track specific location); and
  • the application was not capable of live tracking or reporting - the collected information was merely relayed to the employer to provide whether the employee's company-issued mobile device was physically located on the worksite while that employee was logging hours worked.

The arbitrator determined that the employer's use of Bossware was not a breach of B.C. privacy legislation. In reaching that determination, the arbitrator considered:

  • the sensitivity of the information collected and the steps the employer took to minimize the impact of the degree of infringement on employee privacy right; and
  • the employer's ability to demonstrate a direct link between the information collected and the employer's objectives, coupled with the employer's exploration of alternative solutions, created a justified infringement on employee privacy rights.

Bossware implementation best practices

Employer’s need to consider employee’s privacy rights. Perhaps employers should also consider the work culture they are creating by implementing Bossware. Legally, an infringement or violation of an employee's privacy rights must be justified in achieving the goals or needs of the business. A broad generalizing statement, such as ensuring productivity, is not sufficient justification.

Some guidelines or best practices for employers include:

  • Clearly define the objectives of the Bossware (in advance of implementation) and ensure this aligns with the mission, vision and values of your business;
  • Develop a written policy around the Bossware covering “who, what, where, when, and why” and ensure everyone in the business is aware of that policy;
  • Invite employee and union collaboration on that written policy and discuss best implementation practices amongst employees (i.e., don’t adopt policy “under cover of darkness”); and
  • Limit the scope of operation where possible and only leverage Bossware for what is absolutely necessary to accomplish the objectives discussed above.

While remote work presents new challenges for employers, there are solutions available. Bossware can be used for good or for evil. Ultimately, this comes down to communication. Employers need to work with their employees to appreciate the employee’s concerns regarding privacy and the employer needs to clearly articulate its’ concerns around monitoring.

Joe Gill (he/him) is a technology, corporate finance, and tax partner with a particular focus on high growth technology companies at McKercher LLP.

Dustin Doroshenko (he/him) is an articling student in the Saskatoon office of McKercher LLP.