Are Employee Pulse Surveys Anonymous? What to Show Your Union

What unionized employers need to know about survey privacy, employee trust and sharing results.

In this article

1. Anonymous and confidential are not the same thing
2. How your employees can be identified even if their name is not on the report
3. Why the union wants more than a privacy statement
4. Why it’s important to check your agreement and the law before sending out a question?
5. What do you need to show the union before launching the question?
6. Tips for involving union representatives in setting the questions
7. How do you make your union employee check-ins worth employees’ while?

Are employee pulse surveys anonymous? If you’re about to send one to a unionized team, you’ll quickly find out that "the vendor says so" is not good enough, once you hear your first information request from a steward.

Let’s say you roll out a five-question survey every Friday, and employees answer by signing in with their work accounts.

Four weeks later, the union files a grievance. It’s not objecting to the survey questions, but it wants to know who has access to the answers and whether a manager can link the responses to employee comments about the night shift.

From your point of view, this survey is meant to be an early-warning system. From your employees’ perspective, the weekly cadence gives management around fifty chances a year to link survey responses to employee rosters, absences, or even previous comments.

Even though workers aren’t explicitly questioning whether the survey is anonymous, that’s really the question they have in mind: What’s the risk to me if I trust this? And this is why you’ll find all those posts going around that tell employees not to answer workplace surveys.

So how do you move forward? Before launching your survey, it’s important to understand two things. First, is it possible for someone to link an employee’s answers to their person, even if their name is not on the report?

This includes your own administrators or the vendor’s support staff.

Second, what evidence (not just promises) can you present to the union so they can see what the questions are, what the data is, and what the results will be used for?

Anonymous and confidential are not the same

An anonymous survey does not keep any identifiable information that could link a survey response back to a person (this includes your tenant or the vendor’s logs and backups).

A confidential survey does keep that identifiable information, but restricts who can use it. For instance, a manager report may not include names to restrict who sees that link back to a person.

You can see how this makes a difference when considering employee authentication. If employees have to log in to the survey or use a unique token, you can ensure you’re surveying the right employee population, prevent duplicate responses, and calculate response rates based on specific teams. However, this may also mean there’s a record of the employee’s account or login information tied to their survey response.

Your survey can be both confidential and anonymous, but it needs to be specifically designed that way. Once you have a token or login from employees, you need to be able to check it, flag it as "used", and then store their survey responses in a way that you can’t link back to that token or login information. If your vendor simply stores all the survey responses in a data table with a respondent ID that they simply don’t display to employees, then they’re conducting a confidential survey, not an anonymous survey regardless of what the survey invitation says.

Ask your vendor about this and get their response in writing.

Even if names are removed, data protection authorities still consider it one step in the process. If a survey vendor or your administrators can re-link a record, or if there are other details within that record that can identify a respondent, then those records are still considered personal data.

This introduces all kinds of practical considerations. If access rights apply to your workplace, an employee could request a copy of their responses and you can no longer reply, "It’s anonymous". This is because those responses can be linked back to that employee.

Similarly, identifiable survey data may be subject to data requests related to an arbitration or legal dispute. If you’re operating within the EU, employee consent may not be a strong enough legal basis for processing employee data thanks to the long-standing view of regulators that the power imbalance between employer and employee makes consent a weak legal basis.

Consider how anonymous or confidential your survey truly is before promising either in the survey invitation.

Before launching your survey consider how you would handle the following edge cases: What if an employee includes a comment about harassment, a safety hazard, or a threat of self-harm? You’re no longer able to contact that individual in a truly anonymous survey, so your only options are taking action at the group level (e.g., talk to a group of individuals about improving safety) or asking people to report issues through the named reporting channels. On the other hand, a confidential survey would let you follow up, but that means that employees have already been informed that there is a link between them and their survey responses.

This is something you would need to decide, include in your survey invitation, and agree upon with your union.

When speaking with your vendor, be sure to ask detailed questions. Can support staff view individual participant responses while providing support? Is this access logged?

Can your system administrators export row-level data that includes identifiers? What will backups contain after an employee deletes an answer? How long?

Is free text sent to any subprocessor for translation or text analysis?

Once you have these answers, be sure to confirm that they align with your own workplace’s privacy settings, not just the settings in a vendor’s sales brochure.

If your vendor is conducting a confidential survey, be sure to call it that. That clear distinction, which a steward can verify if needed, provides a solid defense should anyone question it.

Under what conditions could an employee be identifiable even if their name does not appear on the report?

Setting a minimum number of employees responding to a report is the best way to limit identifiability. However, this is only a small measure.

For instance, if you specify a minimum number of 5 respondents for a report and your smallest reporting area (e.g., team) has 6 employees, you run the risk of identifiability.

If 5 out of 6 employees respond on a particular night, a manager could easily identify the responses by knowing who was on leave that week or who reported a particular issue at every team meeting.

Additionally, you’ll want to consider whether the minimum number of respondents applies for each question in the survey or the entire survey. For instance, if respondents have the option to skip certain questions, it’s possible a report could view responses from only 3 people while meeting the minimum response threshold.

Similarly, if a report can be generated based on multiple filter criteria, an individual may become more identifiable. If only one person on a shift has been at a company for less than a year, anyone capable of generating a report that applies those two filters might be able to easily identify that individual’s responses.

Additionally, the source of information for these filters is important. If attribute information is automatically associated with all survey respondents based on information in the HR system, there may be more risk. If self-reported demographics are used and employees can select "prefer not to say", the risk is reduced.

These are decisions you will need to consider and that your union will want to discuss. This also applies to language - if only one person on a particular site uses a Tagalog version of the survey, they can be identified by their language selection in the dashboard.

It’s also possible for someone to identify an employee using an interactive dashboard, even if they cannot view a subgroup small enough to be identifiable. If a manager can view a 20-person department, then view a report that includes that department minus one small team, they can easily infer what responses came from that small team.

To solve this problem, test your data reports based on overlapping content. Limit the number of different filter criteria a manager can select. Consider suppressing reports for the complement as well as the small subgroups.

Consider whether it’s possible to generate two reports that only differ by a very small number of individuals.

Comments present their own identifiability risk. Suppose a worker comments on an incident that only 2 people witnessed. Or they write something that their manager recognizes based on phrasing, spelling, or language use (e.g., they comment in a supervisor-specific question using a language that is different from all other leaders in their organization).

This is a scenario that can generate both very useful feedback and identifiability risk at the same time.

Consider how comments will be shared with managers. You may decide to suppress comments for small groups, ask HR to review and remove identifying details from comments before sharing, or share themes derived from comments rather than the original comment text. Your union will have thoughts on the best approach.

Make sure your employees are aware of the approach you choose before they input their own comments.

Finally, think about identifiability from metadata. Unique survey links, work account logins, IP address, and timestamp information are all useful for running a survey. But if a submission timestamp shows a survey was submitted at 3 in the morning from a site with just one night crew, that person becomes identified all on their own.

Bruce Schneier makes the case in Data and Goliath that metadata can be as revealing as what a person actually says. And since digital support services rely on metadata, it’s harder to strip. But in the context of your survey, the easier route would be to only keep information you need to operate your survey. You could store the date of submission rather than the exact time or release your survey results in a batch after the survey closes instead of publishing results as soon as they are received.

Your weekly surveys present another identifiability challenge. A manager may not worry about identifying someone from a single comment about the night shift. But if they receive four weekly reports with the same comments for four consecutive Fridays that coincide with a schedule change for someone, identifiability is a real risk.

This is true despite each individual, weekly report maintaining the minimum threshold requirement.

This doesn’t mean you shouldn’t conduct weekly surveys. But you do have to review the privacy impact of those surveys with the understanding that all the data collected over time is one dataset, since it involves the same people. You might consider rolling data over a certain period (e.g. four weeks) instead of generating weekly reports.

You may also choose to hold comments until you have a number of comments, so individual weekly comments are not easily identifiable.

Why the union wants more than a privacy statement

From the union’s side, a weekly request for views on work feels like structured monitoring with a friendlier interface.

As Richard Freeman and James Medoff explain in What Do Unions Do?, one of a union’s main functions is to serve as a collective voice that brings concerns forward that individual workers won’t raise on their own out of fear of being singled out. A pulse survey that asks for these concerns through a management-controlled channel introduces worries among stewards that their role will be undermined.

Workers will wonder whether a manager will be able to use their survey answers in conjunction with attendance records or use a weak team result to evaluate a supervisor. There will also be concerns that management will use the survey to deal directly with employees on matters covered by the collective agreement. In the US, this is called direct dealing, which is an unfair labor practice when an employer bypasses the union when discussing terms and conditions of employment.

To avoid these issues, be sure that your survey does not include any questions about the union, union stewards, or the union negotiations. The NLRB has long placed restrictions on when an employer can poll employees to determine their level of support for a union, so even a question that sounds innocuous to someone in HR may raise alarm for a steward. While your survey may include free-text fields to gather responses, you should reach an agreement in advance that any union-related comments will not be forwarded to line managers.

These aren’t issues you can easily overcome by adding a few sentences about how well-intentioned your efforts are.

One key question the union will have is about how open comments related to pay, scheduling, or staffing will be handled. Will HR properly enter those comments into the agreed-upon process? Will a manager promise changes that should happen at the bargaining table?

Or will comments just sit in a dashboard that neither side takes action on, which would teach members that the survey was a performance?

Date of launching the survey also matters. Starting up a new weekly survey during union negotiation discussions will feel like a tactical move, no matter what the intention is. If the survey is launched after conversations with the union well in advance of negotiations, it can be viewed in a different light.

This may feel frustrating if your intention is to identify problems early, but on the bright side the union’s scrutiny gives you a chance to spot gaps in your plan before asking employees to put their trust in it.

Research on employee voice shows that people are worried about whether anyone will actually listen and take action. Gallup’s workplace research has consistently found that only a minority of employees strongly agree that their opinions count at work.

Check the agreement and the law before you send a question

There isn’t a one-size-fits-all legal answer for unionized workplaces.

Check your collective agreement(s) to identify any language related to monitoring, consultation, personal data, introducing new technologies, and airing workplace concerns. An employee experience survey questions working conditions, which may implicate several provisions. Your union may argue that a clause meant to cover monitoring provisions (e.g., CCTV, GPS tracking) applies to survey platforms as well.

Ask your local employment and privacy law experts to review the survey plan. Rules on collecting employee data, consulting worker representatives, and communicating directly with bargaining-unit members vary by jurisdiction. If there’s a works council with co-determination rights, the council may have to sign off on the rollout of the technology itself.

In Germany, for example, the introduction of any technology capable of monitoring employee behavior or performance is subject to co-determination. And survey tools undergo this process as a matter of course.

When you’re seeking advice from legal counsel, provide them with the actual questions you plan to ask, the reports you’ve configured, and the list of filters you expect managers to use. This will help them assess whether there are any legal ramifications. A general description of an "engagement survey" won’t highlight the fact that a manager may filter comments from the night shift by length of time at the company or that there’s a question related to an ongoing collective bargaining negotiation.

Ask your privacy team to review the operational data the vendor collects. This could include invitation lists, logins, IP addresses, or timestamps. For each data point collected, identify the purpose, who has access to the data, and when the data is deleted.

If your jurisdiction requires a data protection impact assessment, a weekly survey of an identifiable population of workers is a strong candidate for one.

Keep in mind that this isn’t a review of the vendor’s standard privacy page. This is a review of the survey you’re planning to run.

There’s some room for judgment on the cadence of surveys. It makes sense to conduct a weekly pulse during a three-month restructuring, but it doesn’t make sense to ask for that as a permanent pace from a stable team.

What to show the union before launch

How can you provide enough information to satisfy a union rep’s request for due diligence?

Put together a short information pack that includes a sample of the survey (so they know what questions employees will be asked) and a set of proposed rules for how you’ll handle the survey results. This information pack should include:

• Survey questions: Provide the full list of questions, including optional questions, open comment questions and any questions you anticipate adding later. Agree on a follow-up process if questions need to be added at the last minute (e.g., week 9 of 10).
• Survey purpose: Specify what workforce problem the survey will address and whether survey responses will be used in any way for disciplinary actions, individual performance decisions, restructuring. This matters for reassuring the union, but only promise that these things won’t happen if your data access and reporting rules actually prevent them. Otherwise, you’re setting yourself up for a future grievance.
• Privacy rules: Identify whether the survey responses will be anonymous or confidential. State the minimum number of responses required to report on a specific question, whether minimum response requirements apply to all questions, what filters can be combined, where demographic attributes come from, and how you’ll handle comments that identify someone.
• Escalation rules: Include information on what will happen if someone reports harassment, a safety risk, or a threat in their comments, and who will make these decisions. This likely will be the only situation where there is a conflict between anonymity and duty to act, so your union reps should be aware of this before they get involved in a real case.
• Data access: Describe where responses are stored, who will have access to responses at the row level, who will have access to group reports, and who will have access to exported data (and in what form!)
• Vendor information: Provide your data-processing agreement and other relevant security documents. This should also include a list of the vendor’s subcontractors (subprocessors) and identify whether any subprocessor is responsible for handling free text responses.
• Data retention: Provide data retention periods for raw responses, reports, login or other details. Describe the data deletion process, including what happens to data stored in backups.
• Survey cadence: Describe how often employees will be surveyed, how long the survey remains open, and the date when you’ll review whether the current cadence is working.
• Sharing survey results: Agree on which group survey findings the union will receive and when. Apply the same small group protection process to data shared with the union.
• Follow-up process: Describe who will review survey results, how employees will be informed about what happens to survey results, and how union employees can raise issues related to the collective agreement.

If possible, walk your union reps through the actual data path rather than simply drawing it out for them.

Open the manager dashboard as a manager would see it and apply the filters that will be available to them. Then pull a report for the smallest shift/job group or unit on your team. If a steward can identify their shift or unit in the report while you’re meeting, better to find that out now than after you’ve launched.

Do the same for the employee invitation. If you say ‘anonymous’ in the invitation, make sure that actually corresponds to the data your vendor stores. If you say the survey will take ‘five minutes’, time a frontline worker going through the survey on their phone to make sure that’s accurate.

Your union will likely ask for changes. That’s a good thing! It’s better to make changes before you launch than after.

Once your employees answer a question, you can’t take the responses away by removing the question.

Finally, the follow up section is how you’ll be judged by employees, so it’s important not to gloss over. Make sure you provide the union with a date when the first results review will happen and a process for reviewing what issues (if any!) made it through the agreed process.

How Sparkbay can help you set up a pulse survey that will be shared with the union

Sparkbay allows you to set the phrasing of survey questions and dashboard content. This way, you can share the exact version of the survey questions with union representatives and make any changes to problematic items before distributing them to employees.

Sparkbay also hides survey results for groups that have too few responses.

The default minimum is 5 responses, and it can be raised for your account if you want extra protection.

This gives you a concrete number to discuss with union representatives, though it’s possible you’ll want to set rules for comments and overlapping groups.

Sparkbay also automatically maps report access to the organization’s org chart.

This means that each manager only has access to survey results for their teams, rather than all managers having access to everyone’s survey results.

You can discuss the content of dashboard reports in conjunction with these access rules when preparing for meetings with union representatives.

Discuss and agree with union representatives on which group comparisons will be used and which results will be shared back to employees.

If you’re interested in learning how Sparkbay can help you build a more engaged workforce, you can click here for a demo.

Let union representatives help set the questions

Once you’ve developed the question pack, share the draft questions with employee representatives.

When you review the wording together, they’ll catch any questions that may sound neutral from an HR perspective, but are negatively received by a particular shift due to their ongoing frustrations with this issue.

They can also help ensure that the survey focuses on a different issue than what they may be trying to renegotiate in the collective agreement. For instance, your survey may want to focus on understanding whether people receive ample notice of schedule changes. The union won’t want to use this survey to renegotiate rules around schedules in the collective agreement.

You’ll also want to pilot your survey with an employee group that easily meets the minimum threshold for individual reporting requirements.

After reviewing the invitation, number of responses, and reports generated from the pilot survey, you and your union representative can decide whether to move forward with a larger roll-out of the survey.

If the pilot survey produces comments that easily identify workers, you and your union rep can agree to change the way you handle comments before the next roll-out.

Similarly, if you see there’s a much lower response rate for a particular shift compared to others, this may be a sign that they don’t yet trust the privacy protections of the survey, and that pushing for a greater response rate may do more harm than good.

Keep in mind that you don’t need joint approval from the union for every small wording change, unless your collective agreement states otherwise.

It is, however, important to establish a process for review of changes and a process for resolving disputed questions.

Establish a regular time with your union representatives to review survey results and planned actions.

According to research from Gallup, the majority of the variation in employee engagement between teams is due to the manager. Therefore, it’s critical that managers have a meaningful role in addressing issues raised by their teams.

At the same time, it’s equally important that union representatives understand there are strict limits on what survey results managers can view.

Make the first check-in worth answering

Before the first survey is distributed, make sure someone who wasn’t involved in the creation of the survey, ideally from the privacy or internal audit team, tries to break every privacy claim using the invitation, the vendor settings, and the reports.

Give them a concrete brief. For example, ask them to pick one real person on the smallest shift and try to find their answers. Can they figure out who submitted a comment by changing filters or comparing two reports?

Can they find a response based on a login record, timestamp, language choice, or something they exported? If the answer to any of these is not a clear no, hold off on launching until privacy can be guaranteed.

Agree with the union on the first date that group findings will be shared. Let employees know when they can expect to hear back, even if that first communication is that the issue needs more time to work on.

If you’ve decided on a weekly survey, be ready to revisit the pace after the pilot program.

Just because a question made it into the survey during a brief period of change, doesn’t mean it has to be asked every week on a rolling basis.

Make sure that when you conduct your survey, you’ve completed the following check:

• Have we accurately described the survey as anonymous or confidential based on what the vendor actually stores?
• Have we tested the survey by using small groups, item-level response counts, combining filters, differencing reports, language choice, and comments?
• Have we shared the survey questions, data gathering rules, escalation rule, and report access with the union?
• Have we had our configured setup reviewed by counsel and the privacy team so that it is compliant?
• Have we agreed on when employees and the union will see survey results and actions?

If you’re interested in learning how Sparkbay can help you build a more engaged workforce, you can click here for a demo.