Lawful, proportionate, and told to nobody

The floor, mistaken for the ceiling

Somebody asks whether a monitoring proposal is lawful. Counsel says yes. The meeting moves on.

The legal boundary discussed in “Lawful, proportionate, and told to nobody” should also shape the configuration of workforce technology. When a team evaluates the official product page for employee monitoring software with screenshots, it should record the purpose, lawful basis, notice, access and retention settings before collection begins, then keep a correction route open for misleading records.

That yes is a narrow and correct claim: the arrangement is unlikely to attract a penalty, on the facts presented, under the law as it stands. It is not a claim that the measure is wise, that it will work, that people will accept it, or that the organisation will be glad of it in three years.

For an independent benchmark relevant to “Lawful, proportionate, and told to nobody”, consult the NIST Cybersecurity Framework. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.

Counsel answered what they were asked. The questions that go unasked — should we, what will this do, what are we making normal, what happens when it is used for something else — are not legal questions, and all of them determine the outcome.

What the law leaves open

Regulation governs whether data may be processed, for what, and with what notice. It does not reach the tone of the policy, whether anybody actually looks at what is collected, what happens when something is flagged, whether people are told the outcome, the vocabulary the system uses about them, or whether the arrangement ever ends.

Those are the parts that are experienced. Two employers with identical compliance positions can produce entirely different working lives, and the difference sits wholly in the ungoverned space.

Which means the silence is filled by whoever wrote the defaults — a supplier, optimising for demonstrations, in another organisation, years ago.

Why consent cannot carry the weight

Nearly every arrangement collects an agreement, usually signed on a first day among other documents, by somebody with no alternative on offer.

It is good evidence that the person was told. It is not agreement, because refusal was not available — which is why several regimes treat employment consent as an unreliable basis rather than as a weak one.

And the people for whom refusal is least available are not randomly distributed. The contractor whose next engagement depends on this one. The agency worker. The person whose right to remain is tied to the job. The person two months into probation. They are also, reliably, the people under the heaviest arrangements.

What follows is not that monitoring is illegitimate. It is that the burden of justification sits with whoever is imposing — and in most organisations it sits the other way round, with the objector expected to construct a case against something they cannot see.

The costs on no account

The chilling effect is not that people stop doing things they should not. It is that they stop doing things they are entitled to do, because they cannot predict how it will be read.

Reporting problems early, because a problem is visible in the numbers. Asking for help, because asking is a record of not knowing. Volunteering for difficult work, because difficulty produces anomalous patterns. Using occupational health, the assistance line, a representative — each leaves a trace, and people are unsure who sees traces.

And the mechanism is uncertainty rather than prohibition. A clear rule produces compliance with a known boundary; vagueness produces over-compliance, because the safe move is to stay well inside wherever the line might be. Which means a vague arrangement changes behaviour more than a specific and broader one.

The arguments on the other side

Safety where observation prevents harm. Protecting other workers, because an employer that cannot investigate a complaint cannot protect the complainant. Regulated recording obligations. A narrow investigation with a stated basis. Security against external threat.

All five are good arguments and none is in dispute here. What they share is a named harm, a defined population, a specific signal, and a limit — and none of them justifies standing, general, open-ended observation of everybody, which is what they are routinely used to support.

What a decision actually requires

What specifically are we trying to find out. What would we do differently with the answer. What is the least we could collect and still answer it. Who is affected and what will it be like. What happens when it is used for something else. When does it end. What would we say if this were described accurately in public. Who could have said no. And who decided, by name.

Nine questions, one page, an hour. It produces the assessment several jurisdictions require, the specification the supplier needs, and the document that answers a challenge in three years — one piece of work serving three purposes, almost never produced because nobody asks for it until afterwards.

Then four commitments, all free and none required: say what is not collected, say who can see individual records, announce changes before they take effect, and keep the promises you make — which argues for making fewer.

And once a year, half a day: every measure listed, with the question reversed. Not is there a reason to stop, which requires somebody to build a case for removal. Is there still a reason to continue.