Consultation on workplace monitoring technologies emphasises data protection challenges

The consultation seeks views on three potential policy options that employers would be required to comply with or consider when introducing WMT into a workplace. Our employment team have offered their expert opinion on the consultation noting the policy options proposed. Their recent commentary can be found here. 

Whether or not any of these policy options is adopted, employers that introduce, extend or continue using WMT must comply with their UK data protection obligations. Against this backdrop of the consultation and wider use of WMT in the workplace, Jade Kowalski, Partner at DAC Beachcroft comments:

"At the core of any discussion around workplace monitoring lies the collection and use of an employee's personal data. Organisations looking to implement some form of WMT must be aware of their obligations to employees and their responsibilities under data protection law. Any new mechanisms or principles for good practice resulting from the consultation must align with existing data protection law and guidance. 

The ICO's guidance on workplace monitoring is itself being updated following the Data (Use and Access) Act. However, the updated guidance is still at the drafting stage, and a published final version is still some months away. Employers should be taking steps to ensure that they are familiar with the available guidance to ensure that they are fully compliant." 

Background

WMT is accepted as a tool that helps to improve efficiency and organisational security in the workplace, as well as supporting innovation, training, and regulatory compliance. 

WMT can take many forms, including location tracking, biometric access, digital activity monitoring, and automated performance evaluation. However, estimates of its prevalence vary, and therefore, the government consultation seeks information on how WMT is currently used by employers, how its use is communicated to employees, and the perceived benefits and harms of such use. It then sets out and seeks views on three policy approaches to the future regulation of WMT.

The consultation identifies the risks where monitoring is poorly designed, poorly explained, or poorly governed. These include privacy concerns, loss of autonomy, biased or unfair outcomes, and difficulties for workers in understanding or challenging decisions made about them. 

Interaction with data protection law 

From a data protection perspective, the government expresses concern within the consultation document that existing legal requirements may not always be clearly understood or consistently applied. It says this creates uncertainty for employers that want to adopt WMT responsibly, while also creating risks for workers around transparency, fairness and trust.

The consultation document sets out eight proposed principles for the responsible use of WMT, which closely map to GDPR obligations and ICO guidance. The principles are as follows: 

• Purpose and rationale - requiring employers to be clear about why WMT is being used
• Transparency and understanding - giving workers clear, accessible and timely information about the use of WMT
• Worker engagement and voice - engaging meaningfully with workers, trade unions or elected representatives when WMT is introduced or relied upon in significant decisions
• Fairness and equality - ensuring fair use of WMT and avoiding discriminatory or disproportionate outcomes
• Necessity, proportionality, and privacy - considering whether less intrusive measures could achieve the same outcome, and only sharing personal data with those who really need access to it
• Human oversight and accountability - ensuring decision-makers understand the WMT systems they oversee and giving workers the ability to question and challenge decisions
• Dignity and wellbeing - considering the potential impact of WMT use on workers' mental health and wellbeing and taking steps to mitigate risks
• Accuracy, reliability and review - regularly assessing whether monitoring remains necessary and whether it is sufficiently accurate to achieve its purpose 

Bearing in mind the above, employers considering WMT must reflect on the detailed guidance provided by the ICO. The guidance refers to appropriate sections of data protection legislation such as the UK GDPR and the Data Protection Act 2018. As discussed within the consultation, data protection law requirements for WMT and associated personal data consider issues such as the lawful basis for processing provisions to ensure accuracy, security and limitations on retention. Additional requirements applicable to special category data and the obligation for employers to conduct Data Protection Impact Assessments. 

The ICO guidance below reflects the close alignment between existing data protection law and guidance with the government's proposed principles for WMT use. 

General data protection principles 

• Employers must be able to justify why the WMT is necessary and demonstrate that less intrusive alternatives are inadequate or unavailable. Monitoring should not be excessive when considering the purpose pursued.
• Workers' reasonable expectations of privacy must be considered, particularly where expectations of privacy may be increased when individuals are working from home than when they are present in a traditional workplace environment. Careful assessment is therefore needed for monitoring in domestic settings.
• Transparency is a fundamental requirement; employers should engage appropriately with employees or their representatives and, where device monitoring is considered necessary, ensure employees are informed. Covert monitoring will only be justified in exceptional circumstances and should be subject to strict controls and authorisation from senior individuals or management.
• Any information obtained via WMT must be protected by appropriate security measures. Appropriate security measures include ensuring confidentiality, preventing unauthorised access and maintaining appropriate governance arrangements around monitoring programmes.

Automated decision-making processes 

• As noted above, the ICO's guidance is in the process of being updated following the passage of the DUA Act. The guidance does not reflect the reforms made to automated decision-making, meaning that employers should consider both the existing guidance, but also the provisions relating to ADM contained within GDPR as introduced by the DUA Act.
• The provisions introduced by the DUA Act (contained within Articles 22A to 22D) move away from the previous regime covering certain forms of solely automated decision-making and introduce a more flexible, risk-based framework.
• Nonetheless, types of WMT commonly deploying the use of Automated Decision-Making include attendance and absence management or monitoring worker activity or workstation use. Therefore, it is crucial that employers ensure that they only deploy any ADM processes in line with the GPDR, and provide the appropriate safeguards such as meaningful human oversight, transparency, and the right for individuals to contest decisions. 

Specific data protection considerations 

• Any workplace monitoring that involves biometric data should be carefully assessed and employers should ensure that a lawful basis and condition for processing is identified. This includes examples such as facial recognition systems and fingerprint-based access controls.
• Employers must undertake a DPIA where monitoring is likely to result in a high risk to individuals' rights and freedoms. The ICO identifies several monitoring activities that are likely to trigger this requirement, including keystroke monitoring. The ICO guidance suggests that DPIAs should be undertaken even where not required, as a tool of additional accountability.
• Special consideration needs to be given to the type of monitoring being undertaken, such as device monitoring, communications monitoring, video and audio surveillance, vehicle tracking, access controls and network security monitoring. In these circumstances, the monitoring must be necessary, proportionate and limited to a clearly defined purpose, with less intrusive methods preferable.

Next steps 

The consultation itself is open until 30 September 2026, after which the government will consider feedback received for any substantive policy proposals. The timeline for the development of any policy proposals is unclear. Employers planning to introduce WMT should, in the meantime, carefully review the ICO's current guidance, UK GDPR and Data Protection Act 2018. Organisational awareness of these requirements will be crucial as interest in all forms of workplace monitoring technology now available increases. 

As stated by our employment colleagues, employers who use WMT are encouraged to contribute to the consultation to express their views and identify any practical concerns. That might include, for example, the difficulty of defining WMT, the fast-evolving nature of such technologies, and the potential additional burden on employers