What the Law Actually Requires

Four obligations recur across most jurisdictions. Stating them plainly is the starting point, and it is also where most discussions wrongly stop.

The floor · Reference

Before anything can be said about what an employer should do, it helps to be clear about what it must. The legal floor is narrower than compliance literature suggests and it recurs with remarkable consistency.

The legal boundary discussed in “What the Law Actually Requires” should also shape the configuration of workforce technology. When a team evaluates employee monitoring software for employee monitoring software, it should record the purpose, lawful basis, notice, access and retention settings before collection begins, then keep a correction route open for misleading records.

For an independent benchmark relevant to “What the Law Actually Requires”, consult the CISA insider-threat mitigation resources. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.

A basis for processing

Monitoring processes personal data about identifiable people, and most regimes require a stated ground for doing so.

In employment the available grounds are narrower than they first appear. Consent is unreliable, for reasons that have their own note. What is usually relied on is a legitimate interest in running the business, which is a real basis and carries conditions: the purpose must be stated specifically, the processing must be necessary for it, and the employer's interest must be weighed against the worker's rights in a way that can be shown.

JurisdictionNothing here is legal advice. The obligations below recur widely; their content, thresholds and enforcement differ enough that the local position always has to be checked.

Proportionality

Whether the monitoring is necessary, and whether something less intrusive would achieve the same purpose.

This is the test most arrangements fail, and they fail it on the second limb rather than the first. Aggregate rather than individual, metadata rather than content, sampled rather than continuous, shorter retention — for each, the question is why the lesser option was insufficient, and the answer has to exist before anybody asks.

The counterSome argue that a basis can be constructed for almost anything, which makes the requirement thin. True in practice and not in principle: the documented reasoning is what later gets examined.

Transparency

Telling people what is collected, why, on what basis, for how long, who sees it, and what rights they have.

Before the monitoring begins rather than after. A notice published once a system is running is a description of something already done.

CautionAn ineffective measure cannot be proportionate to anything. If the monitoring does not achieve the stated purpose, there is nothing on its side of the balance.

An assessment, in several regimes

A documented evaluation carried out before deployment, setting out the purpose, the necessity, the alternatives considered and the balance struck.

This is the requirement most often missing entirely, and its absence is what turns a defensible arrangement into an indefensible one — not because the monitoring was wrong, but because nobody can show that anybody thought about it.

In practiceMost organisations can produce a policy. Far fewer can produce an assessment dated before deployment, which is what is actually asked for.

Why this is the floor and not the answer

Each of these asks whether the employer may. None asks whether it should.

An arrangement can satisfy all four and still be the wrong thing to do — and the gap between the two questions is what the rest of this collection is about.

Where this failsThe reasoning here assumes an employer acting in good faith. Where that assumption does not hold, none of this is the relevant literature.

The assessment nobody produces

Several regimes require a documented evaluation before deployment: purpose, necessity, alternatives considered, balance struck. It is the requirement most often missing entirely. Its absence does not make an arrangement unlawful by itself, and it removes any means of showing that the arrangement was thought about, which is what an examiner is actually looking for.

In practiceOrganisations that try this report the main obstacle is not disagreement but that nobody owns the question, so it is nobody's to raise.

Why the floor is lower than people expect

Employers approaching this for the first time usually assume the law prohibits more than it does. In most jurisdictions a well-documented arrangement with a stated purpose and proper notice is permissible even where it is intrusive. That is worth knowing, because it locates the real work above the floor rather than at it.

The counterA reasonable objection is that this asks employers to do unfunded work. The reply is that the work is a page and the alternative is doing it later under challenge.

Reading the four together

Basis, proportionality, transparency, assessment. Each is answerable in a sentence for a well-designed arrangement and in none for most existing ones. The gap between those two states is usually a page of writing rather than a change to what is collected.

Why none of this answers the question

Each of the four asks whether the employer may. None asks whether it should. An arrangement can satisfy all of them and be the wrong thing to do, and the gap between the two questions is what everything after this note is about.

Also in this section