What Must Be Disclosed, and to Whom

The legal minimum, the practical minimum, and the gap between them — which is where most of the resentment lives.

The floor · Reference

Transparency obligations set a floor. Meeting only that floor produces a document nobody reads and a workforce that assumes the worst.

The legal boundary discussed in “What Must Be Disclosed, and to Whom” should also shape the configuration of workforce technology. When a team evaluates ethical employee monitoring for ethical employee monitoring, it should record the purpose, lawful basis, notice, access and retention settings before collection begins, then keep a correction route open for misleading records.

For an independent benchmark relevant to “What Must Be Disclosed, and to Whom”, consult the AuditBoard internal-investigation guide. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.

The usual legal minimum

That monitoring takes place. The categories of data. The purposes. The lawful basis. Retention. Who it is shared with, including suppliers. Rights, including access. A contact.

Typically delivered in a privacy notice, written in the language of compliance, and read by essentially nobody.

JurisdictionDisclosure requirements vary in form more than in substance. The categories below recur; where they are written down and how specific they must be differs.

What people actually want to know

Four things, and none of them is usually in the notice.

What is not collected, which is the part that reassures.

Whether their line manager can see individual records, which is the single most consequential difference between arrangements and is almost never stated.

Whether the data is used in performance or disciplinary processes, said plainly either way.

And what the system could do that has been switched off, with a commitment that any change will be announced.

The counterSome argue that detailed disclosure teaches people how to evade monitoring. True for a narrow set of security controls and false for almost everything else, including every productivity measure.

Who else has to be told

In several jurisdictions, employee representatives before deployment — and in some, their agreement is required rather than their opinion sought.

Where such a body exists and was not consulted, that is a substantive failure rather than a procedural one, and in some places it affects whether the monitoring can be relied on at all.

In practiceThe test that matters is not whether a notice exists but whether somebody could predict the contents of their own record from it. Almost no notice passes.

The gap, and what sits in it

An organisation can satisfy every disclosure requirement and leave its workforce believing that everything is read, that files are kept on individuals routinely, and that a manager can request a check on somebody they dislike.

Those beliefs are what people act on. Correcting them costs a page of plain writing and no organisation is required to do it, which is exactly the shape of the gap this collection is about.

The question worth putting to whoever owns the policy: could one of our people, from what we have published, correctly describe what we can see on their machine? If not, we have complied and told them nothing.

JurisdictionLocal rules differ on every point in this note. The shapes described recur; the specifics always require checking.

Who else has a right to know

In several jurisdictions, employee representatives before deployment, with agreement required rather than opinion sought. Where such a body exists and was bypassed, the failure is substantive and can affect whether the monitoring may be relied on at all.

NoteStated here as a general tendency rather than a rule. Counter-examples exist and the pattern is strong enough to plan around.

The notice nobody can find

Publication is satisfied by putting a document somewhere. Information is not. A notice in a policy library, linked from an intranet page nobody visits, has complied and informed nobody — which is a distinction the law does not always draw and people always do.

Source of the ideaThe reasoning here is standard in applied ethics and unusual in operational decisions, which is the gap this collection occupies.

The four things people want to know

What is not collected. Whether a line manager sees individual records. Whether the data reaches performance processes. What the system could do that has been switched off. None is usually in the notice and all four determine what people believe.

Publication against information

An organisation can satisfy every disclosure requirement and leave its workforce believing everything is read and files are kept routinely. Those beliefs are what people act on, and correcting them costs a page of plain writing that nothing requires.

Writing the notice people would read

One page, plain, listing what is collected and what is not, who sees it, how long it is kept, and what it is never used for. It satisfies the legal requirement as a by-product and it is the version that changes what people believe.

Also in this section