Covert monitoring means monitoring that is deliberately carried out in secret, without the knowledge of the staff who are being monitored. Covert monitoring is very difficult for an employer to justify, and should only be used in exceptional circumstances. Your employer must have genuine suspicions of criminal activity, and must justifiably believe that notifying individuals about the monitoring would prejudice the prevention or detection of the criminal activity.
Your employer should carry out a careful privacy audit before engaging in covert monitoring. And staff should at least be warned in general terms that covert monitoring could be taking place, and the reasons why this might happen.
Monitoring exercises must be strictly targeted at obtaining evidence within a set timeframe. They should not continue after the investigation is complete, and any extra information discovered while monitoring covertly (for example, information about performance quality that only comes to light because of covert monitoring to investigate suspected dishonesty) should be disregarded, unless it reveals things that no employer could reasonably be expected to ignore.
The ICO guide for employers makes the position clear. It says:
"The covert monitoring of workers can rarely be justified. Do not carry it out unless it has been authorised at the highest level in your business. You should be satisfied that there are grounds for suspecting criminal activity or equivalent malpractice, and that telling people about the monitoring would make it difficult to prevent or detect such wrongdoing. Use covert monitoring only as part of a specific investigation, and stop when the investigation has been completed. Do not use covert monitoring in places such as toilets or private offices, unless you suspect serious crime and intend to involve the police."