The term “Electronic Performance Monitoring” (hereafter EPM) has its origin in the term “Electronic Work Monitoring,” which was introduced at the U.S. Congress, Office of Technology Assessment, 1987. The original term “Electronic Work Monitoring” refers to the “computerized collection, storage, analysis, and reporting of information about employees’ productive activities” (U.S. Congress, Office of Technology Assessment, 1987, p. 27), and this original conceptualization has been frequently used as a definition of EPM in the scientific literature over the past decades. This and related definitions (e.g., Grant and Higgins, 1989) mainly referred to the context of call centers in which performance monitoring was already an existing practice several decades before. However, early in the 1990s it became clear that EPM also plays a notable role in other industries. Corlett (1992), referring to the American engineer Frederick W. Taylor (1856-1915) and his concept of “industrial efficiency,” tellingly stated that the trend of EPM can lead to the “Taylorization of the office.” A major implication of this reference to Taylor was that the surveillance aspect of EPM along with a relationship of distrust between the organization (supervisor) and employee became the dominant perspective. What follows is that EPM use in organizations was typically perceived negatively, in particular with adverse consequences for employees.

Today EPM is a widespread practice in work environments. Managers frequently have access to their employees’ performance data, as well as other data on behavior which allows them to check, among other things, the working pace, the degree of work accuracy, log-in and log-off times, and even the number and duration of breaks (Aiello and Kolb, 1995; Oz et al., 1999; The Guardian, 2018). Importantly, EPM may lead to advantages, such as higher productivity, better resource planning, or increased staff safety (Martin and Freeman, 2003). However, disadvantages such as lower employee morale and satisfaction, as well as stress and the development of stress-related illnesses are also reported in the scientific literature (Aiello and Svec, 1993; George, 1996; Jeske and Kapasi, 2017).

Since the introduction of EPM, technology in general and also technology that enables computer-based monitoring has advanced rapidly. In a recent paper, Edwards et al. (2018) summarize the historical development of employee surveillance from a technology perspective. In essence, they introduce several stages of surveillance: Surveillance 1.0 stands for extensive analog monitoring, Surveillance 2.0 for the recording of keyboard activities, application usage and mouse clicks, and Surveillance 3.0 for the tracking of emails and website activity, resulting in access to data on “personal relationships, thoughts, opinions, preferences and interactions” (p. 5). In the recent past, ubiquitous computing and the Internet of Things (IoT) have made possible “real-time, ubiquitous and unobtrusive surveillance of employees […] by small cheap sensor technology capable of being embedded within the working environment” (p. 6), referred to as Surveillance 4.0. Today, we increasingly observe Surveillance 5.0, or the age of algorithms, in which “data analytics algorithms are designed to generally spot patterns in large amounts of data, enabling categorization and profiling [… enabling] automated or assisted decision making about hiring, firing and internal promotion or disciplining” (p. 6). Machine learning algorithms, big data, and artificial intelligence constitute the technological basis for this most advanced form of monitoring (Wenzel and van Quaquebeke, 2017; Yanqing et al., 2019).

Against the background of these most recent technological developments it is not surprising that EPM is experiencing a heyday. The Guardian (2015) characterized EPM as a “digital panopticon” which started off by monitoring emails and phone calls, and now even includes tracking of text messages, screenshots, keystrokes, social media activity, private messaging services, and face-to-face interactions with colleagues. In a more recent article, The Guardian (2018) further reported that EPM has become a significant privacy issue in particular in tech companies, but also in other industries. Similar reports can be found in many other magazines and newspapers including the German outlet Süddeutsche Zeitung (2019), which reported on the monitoring methods of Zalando, and The New York Times (2017), which reported on a company implanting microchips in employees.

In 2019, the market research firm Gartner provided an outlook into the future of the employee monitoring market for 2020 (Gartner, 2019). They estimated that almost 80% of all companies will be using monitoring software to keep track of their organizational goals and their employees. In 2018, this value was 50% and hence a dramatic increase in the application of EPM can be observed. In 2019, the market research firm Accenture reported that 62% of surveyed C-level executives “said that their organizations are using new technologies to collect data on their people and their work to gain more actionable insights – from the quality of work and the way people collaborate to their safety and well-being – fewer than one-third (30%) are very confident that they are using the data responsibly” (Accenture, 2019). In 2020, as a consequence of the increasing home office adoption due to the COVID-19 pandemic, organizations have even increased the level of computer-based monitoring. Recent newspaper reports such as those by the BBC (2020) or Businessinsider (2020) indicate new ways of surveillance during COVID-19-induced home office hours. The MIT Technology Review (2020) confirms these developments. As another example, The Guardian (2020) writes: “Microsoft has been criticized for enabling ‘workplace surveillance’ after privacy campaigners warned that the company’s ‘productivity score’ feature allows managers to use Microsoft 365 to track their employees’ activity at an individual level” (note that Microsoft scaled back the corresponding features recently, Morse, 2020). Altogether, as documented in many articles, today EPM is predominantly perceived as a significant issue in the economy and in society that deserves attention. Fueled by the current COVID-19 pandemic and the resulting desire of employers to also keep track of employees’ activities in their home offices, EPM and the resulting technology-mediated surveillance practices have become an even more important topic in society today.

Considering this call for attention, we thought it might be useful to concisely document and systemize major insights from the academic literature on EPM and to integrate this empirical basis. Specifically, this article makes the following contributions. First, we developed a research framework to provide a conceptual basis on a critical topic from an abstracted point of view (summarized in Figure 2). Second, we reviewed the academic literature to structure what is known about EPM, particularly with respect to outcomes and moderators (summarized in Table 1 and Figure 3). Third, we reflect on important privacy, ethical, and cultural considerations. Fourth and finally, we outline opportunities to guide future research, including possible avenues for EPM design science research.

Because EPM research is fragmented and has been published in outlets across various scientific disciplines, including Information Systems (e.g., George, 1996), Psychology (e.g., Aiello and Kolb, 1995), and Human-Computer Interaction (e.g., Carayon, 1994), a documentation of the existing knowledge that could instigate a more cumulative research tradition in the future is even more critical than in less fragmented domains. Another motivation why we investigate EPM now is that the topic lost much of its relevance after the 1990s, but suddenly became relevant again due to technological developments in the very recent past (Edwards et al., 2018).

In order to review several decades of EPM research, we conducted a literature search for journal publications that have been published since the term “Electronic Work Monitoring” was coined at the U.S. Congress, Office of Technology Assessment, 1987 (the term “Electronic Performance Monitoring” became more prominent within the scientific community over time). The literature review was conducted based on existing methodological recommendations (Webster and Watson, 2002; Kitchenham and Charters, 2007; vom Brocke et al., 2009). Based on primary selected papers, we conducted an initial review, followed by backward snowballing, a second review of the associated results, and a subsequent forward snowballing. Figure 1 summarizes our search process.

Figure 2 summarizes our conceptualization of the EPM phenomenon. In the following, we describe the framework.

First, EPM takes place on four levels: individual, team/group, department, and organization (based on Grant and Higgins, 1989). The level of monitoring is correlated with the level of privacy invasion. As indicated in Figure 2, privacy invasion increases from organizational to individual. Regarding the type of monitoring, we distinguish private matters, work behavior, and performance. For example, in a call center it is technologically possible to record the number of an employee’s visits to the bathroom (private matter), his conversations with colleagues (work behavior), and the number of telephone calls and their duration (performance). Moreover, different technologies can be used for monitoring: smartwatch, smartphone, Laptop/PC, and camera. The most important outcomes that have been studied in the literature (for details, see the following sections) are stress, job satisfaction, motivation, trust, commitment, and performance. We use the framework in Figure 2 as basis for the following discussion of the extant literature and for an outline of potential avenues for future research.

As already indicated based on example studies in the prior sections, scientific research reveals potential moderating effects in the relationship between EPM use and outcome variables. We systematically analyzed moderation effects and summarized them in Table 1. As an example, the relationship between EPM use and stress is moderated by age. The notation “High Age: Mallo et al. (2007) [↑]” indicates that this specific study found that older individuals are more stressed than younger individuals through EPM use. In addition to Table 1, we summarize the moderation effects in Figure 3 (“No.” in this figure indicates number of identified studies). The six major outcome variables in EPM research are shown on the right side, and all moderation effects which we identified based on our comprehensive literature review are illustrated.

According to Westin (1967), “privacy is the claim of individuals, groups, or institutions to determine for themselves when, how and to what extent information about them is communicated to others” (p. 7). An impairment of privacy is referred to as privacy invasion. This form of invasion does not only exist when employees rely on IT equipment in the organization to do their work (Kidwell and Sprague, 2009). Rather, privacy invasion is also a major phenomenon in home office contexts which frequently imply the use of private IT infrastructure. Therefore, recent EPM research (e.g., Ravid et al., 2020) and reports in practice (Satariano, 2020) have picked up this topic.

Based on our literature review, we identified six studies that examined privacy issues in the context of EPM. The first study examined monitoring in the context of technostress by means of a survey. Ayyagari et al. (2011) concluded that the extent of perceived anonymity and thus the inference about one’s own performance, correlates negatively with the perceived violation of privacy. Another study found that identification of an employee through monitoring results in more negative attitudes toward EPM (Carpenter et al., 2016). This result is in line with the finding that invasion of privacy has a negative impact on attitudes toward surveillance (Zweig and Webster, 2002) and that a higher intensity of surveillance leads to a higher perceived invasion of privacy than a lower intensity (O’Donnell et al., 2013). However, the possibility to exert control over surveillance increases perceived data protection and reduces the perceived violation of privacy (McNall and Stanton, 2011). Moreover, if perceived threats of attacks or perceived serious security risks exist, employees’ attitude toward surveillance becomes more positive (Workman, 2009). Next, we complement this summary of scientific findings on EPM and perceptions of privacy invasion with a practical example.

The example we have chosen concerns the storage of all sent emails in a Customer Relationship Management (CRM) system. The emails in such a system comprise personal and organizational messages and all emails are accessible to all authorized employees in the company (e.g., all CRM users). The privacy issue is caused by the fact that also personal messages (e.g., casual messaging with a client or private messages to a person outside the organizational context), are often accessible by a larger group of people. In addition, it is possible that other CRM users manipulate one’s personal messages (e.g., by deleting emails). Importantly, similar situations exist with many other types of organizational application systems (e.g., enterprise resource planning systems or process mining tools).

Even worse from a privacy invasion perspective, monitoring does not necessarily require use of dedicated application systems such as CRM. Rather, surveillance can also take place via (1) messaging software (e.g., instant messaging), (2) communication software (e.g., videoconferencing, intranet, voice over IP), (3) office programs (e.g., word processing, document management), (4) collaboration software (e.g., file sharing), or (5) workplace mobile IT devices software (e.g., smartphone, laptop) (Attaran et al., 2019). Based on these facts, however, one may not conclude that the use of EPM only has negative consequences for privacy. Rather, several ways exist to implement EPM systems in a way to ensure the privacy of employees. Thus, it is possible to leverage the possible benefits of EMP (e.g., increased productivity or safety) and simultaneously avoid its potential drawbacks, particularly perceptions of privacy invasion. Research suggests several procedures to successfully implement EPM. As stated by Chen and Pfleuger (2008) EPM systems create many ethical and privacy concerns about what is being monitored and through what technological means. This leads to the implication that first it should be clear which policies apply to the use of company property such as laptop or smartphone and the general scope of those policies should be transparent as well. Second, employees should be involved in the decision on monitoring policies (Alder and Tompkins, 1997). A study by Jiang et al. (2020) recommends that organizations should inform their employees which information will be subject to monitoring and how their privacy will be protected because such a procedure raises monitoring policy acceptance among personnel. A recent example of EPM that protects employee privacy while providing relevant information to the employer is MS Office 365 (after significant criticism regarding an earlier system version, e.g., The Guardian, 2020). It protects employee privacy by not providing any usernames and by only delivering aggregated data and not individual data (Microsoft, 2021). Also, it is recommended in the literature to find the “zone of acceptance” as discussed by Stanton and Stam (2006) in which employees do not question the fairness of organizational monitoring (Alder and Tompkins, 1997; Zweig and Webster, 2002). Employees typically feel concerned about their privacy when novel and significant changes appear but usually not because of routine information requests such as timesheets (Stanton and Stam, 2006), workplace communications (Best et al., 2006), or personal information (e.g., age) as they are considered “common practice” (Stanton, 2002). The same applies to information that could also be obtained from other sources (e.g., websites, CV) (Stanton, 2002). Thus, employees in several situations tolerate privacy invasion as offshoot of digital technology advances (Ayyagari et al., 2011).

Regarding data protection it has been suggested anchoring a holistic data protection concept within the organization (Holthaus et al., 2015). This concept is based on two pillars: technical/organizational data protection and strategic/organizational data protection. In the first pillar, the technical implementation of measures by means of data protection concepts or procedure directories is pursued in order to ensure data protection. The second pillar pursues the objective of anchoring data privacy and data security in the organization in the long term through instruments such as employee training or target agreements. Based on the implementation of such a concept, it is intended to achieve a sustainable and holistic anchoring of data privacy throughout the entire organization.

The use of EPM systems at the workplace should always involve ethical considerations because it is related to such topics as stress-related illnesses, fairness judgments, and privacy rights (Rosenberg, 1999). Following ethics conceptualization in philosophy, Alder (1998) differentiates two groups of ethicists in the context of workplace monitoring: teleological and deontological. Teleological ethics refers to a concept of morality that derives moral obligation from what is good, or desirable, as an end to be achieved (Alder, 1998). Frankenna (1973) describes this kind of ethics tellingly: “An act is right if and only if it or the rule under which it falls produces or is intended to produce at least as great a balance of good over evil as any available alternative, an act is wrong if and only if it does not do so” (p. 14). The teleological approach is mostly used by business groups that defend the use of monitoring systems to measure worker performance. In sharp contrast to this view, deontological ethics argues that the morality of an action, or behavior in general, should be based on whether that action or behavior itself is right or wrong (if compared to existing rules), and not based on the consequences of the action or behavior (Frankenna, 1973). The dominant ethics perspective in the EPM literature is that it is more useful to not tussle over whether the teleological or deontological is right or wrong; rather, a more useful approach is to focus on how EPM can be designed and used in an ethically sound way.

Another important factor that influences acceptance of EPM use and possible consequences is culture. Culture in general can be defined as a set of shared beliefs, values, and behaviors in social interaction, and organizational culture can be defined as the operating system combining a socially constructed reality including organization’s beliefs, perceptions and values (Alder, 2001). Organizational culture has a significant impact on performance and effectiveness (Deal and Kennedy, 1982; Barney, 1986), predominantly mediated by altered employee attitudes and motivation, as well as by changed individual productivity (Wilkins and Ouchi, 1983; Cooke and Rousseau, 1988; Warrick, 2017).

The most prominent work on culture in societal and organizational contexts was published by Hofstede (1980). In its most recent version, his cultural dimensions theory comprises six dimensions of culture: power distance, individualism, masculinity, uncertainty avoidance, long term orientation, and indulgence. Hofstede’s model has been applied in the EPM context. However, only two out of the 132 reviewed studies directly focus on culture (Alder, 2001; Panina and Aiello, 2005). In essence, these studies report that negative reactions toward EPM can be expected in individualistic cultures, because people in such cultures are more sensitive in terms of privacy invasion if compared to less individualistic cultures (Alder, 2001; Panina and Aiello, 2005). Furthermore, people who live, or work, in a low power distance culture have a tendency to reject EPM as monitoring constitutes signal of distrust, see also Chang et al. (2015). Also, it has been shown that managers in an uncertainty avoidance culture tend to use EPM systems within their organization, because the information generated by EPM reduces uncertainty (Panina and Aiello, 2005). Finally, Alder (2001) found that bureaucratic cultures respond more favorably to monitoring systems in comparison to supportive cultures. Altogether, our analyses show that examinations on EPM use from a cultural perspective holds significant research potential. Despite the few mentioned studies, there is a paucity of corresponding research.

The future development of EPM systems is influenced by various trends in practice and science including increased perception of privacy concerns (e.g., Bélanger and Crossler, 2011; Carpenter et al., 2016; Chory et al., 2016), changes in legislation, lifelogging as a behavior to track one’s own life based on digital technologies such as smartwatches (e.g., Weiss et al., 2016; Fischer and Riedl, 2019), altered user behavior to increasingly share private data (e.g., on social media platforms), and technological developments, such as IoT, machine learning, big data and artificial intelligence (e.g., Wenzel and van Quaquebeke, 2017; Ande et al., 2019; Yanqing et al., 2019).

Against the background of these developments, it is likely that EPM adoption will grow substantially in the future. When EPM is applied correctly, it is possible to reduce the potential negative effects such as those reviewed in this article (e.g., increased stress, as well as reduced job satisfaction, motivation, trust, commitment, and performance; see Table 1). However, as indicated in this article, clear-cut research findings on the consequences of EPM use are the exception rather than the rule. What follows is that the relationship between EPM use and outcomes is usually moderated by a range of factors, most of which should be studied more systematically in the future (please refer to Table 1 as a starting point). Therefore, many research opportunities exist. In addition to moderation effects, mediating factors in the relationship between EPM use and outcome variables should be focused on too. This would help to develop a better understanding of why and how EPM use or specific types of EPM use (e.g., a combination of different levels and types of monitoring along with corresponding technologies, see our framework in Figure 2), may exhibit specific effects or not. As a starting point for answering why- and how-questions, we documented theories which have been used in extant EPM literature. Based on analysis of the 132 reviewed papers, we identified 14 theories. For a summary, please see the Supplementary Material.

We also emphasize that EPM also offers great research potential for design science scholars. In essence, behavioral insights as presented in this article can be used to build EPM systems. Specifically, a focus on technological rules as described by van Aken (2004) could be a viable avenue for future design science research studies. The logic of technological rules can be described as follows (van Aken, 2004, p. 227): If you want to achieve OUTCOME X, then DESIGN Y will help. Design does not only refer to system attributes (e.g., features or user interface), but also to organizational context design decisions. An example: If you want to achieve high job satisfaction, then comprehensive announcement of EPM before implementation in the organization will help. Note that employee and supervisor attributes (e.g., their personality), among other factors, may also exert influence on outcome variables.

Designers and engineers should keep in mind that the example only states one design element, namely comprehensive announcement. However, in reality the design of an EPM system would consider a configuration of factors and not just one factor. The three design elements of our EPM framework in Figure 2 (used technology, level of monitoring, type of monitoring) and the moderators in Table 1 may serve as a starting point for organizational designers and engineers to build and effectively implement an EPM system.

Once an EPM system or different system versions have been developed, the artifact(s) should be evaluated. As indicated by March and Smith (1995), evaluation refers to how well an artifact works, and metrics have to be used to assess the performance, utility, quality, effects, and/or efficacy of the artifact (Walls et al., 1992; Hevner et al., 2004; Gregor and Jones, 2007). The outcome variables in Table 1 (see also Figure 3) may serve as metrics in evaluation studies. Figure 4 outlines our EPM design science framework. The illustration shows the design science research activities “build” and “evaluate” and assigns the three design elements used technology, level of monitoring, and type of monitoring (Figure 2) along with moderator examples (the full list of moderators is shown in Table 1) to the build activity and the six outcome variables to the evaluate activity.

Electronic performance monitoring is a scientific topic which has existed since the 1980s when PCs and ICT became widely introduced in the economy. As a consequence of the recent technological developments related to machine learning, big data, and artificial intelligence, among others, it is not surprising that EPM is experiencing a heyday. Surveillance of the digital workplace, therefore, has recently become a major topic. In this article, we developed a framework to conceptualize EPM (Figure 2), reviewed the scientific literature on six major consequences of EPM use along with moderation effects (Table 1), and outlined how these insights could be used to design and implement EPM systems (Figure 4). Moreover, we discussed possible privacy issues, as well as ethical and cultural considerations. It is hoped that the present work instigates future studies which ultimately lead to EPM systems that are beneficial to both employees and organizations. It will be rewarding to see what insight future research will reveal.

RR conceptualized the study and was responsible for funding acquisition. TK reviewed the literature under supervision of RR. TK and RR wrote the manuscript together. Both authors contributed to the article and approved the submitted version.

The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.