Monitoring, and where the law constrains it

There is no single answer and the differences are large

What an employer may monitor, on what basis, with what notice, and with what consultation differs substantially between jurisdictions. An arrangement that is routine in one country requires consultation with employee representatives in another and is unlawful in a third.

Where you operate in more than one, the position for each part of your workforce is governed by where those people are.

Four questions every regime asks in some form

Is there a legitimate purpose? Protecting contractually covered information is one. Curiosity is not.

Is this the least intrusive way to achieve it? Collecting file activity to protect files is proportionate; collecting keystrokes to achieve the same thing is unlikely to be.

Do the people know? Notice requirements exist widely and vary from a general policy to specific prior notification.

Is it limited? To working systems, to what is needed, for as long as needed.

An arrangement that answers all four well is defensible in most places. One that answers none is defensible nowhere.

Weak in employment, everywhere

Regimes that rely on consent generally treat it as questionable between employer and employee, because it cannot be freely refused. An arrangement resting on a signature in a contract of employment is resting on the weakest available basis.

Purpose and proportionality are the stronger ground, and they require having thought about the questions above rather than having obtained a signature.

The position this site takes, and why

Monitoring people without their knowledge is unlawful or heavily restricted in many jurisdictions, generally permitted only in narrow circumstances such as an active investigation into specific suspected wrongdoing, and frequently only with specific authorisation.

We do not supply it and this site does not describe how to do it. That is partly a legal position and partly a practical one: it is discovered, and the discovery costs more than whatever it found.

Where an organisation believes it faces circumstances requiring something of this kind, the route is legal advice and a documented authorisation, not a product configuration.

People can often ask what you hold about them

Several regimes give individuals rights of access to personal data held about them, and monitoring records are personal data. Requests arrive, sometimes from people in dispute with the employer, and the process for answering them should exist before the first one.

Retention limits interact with this: data kept longer than the stated purpose requires is both a compliance problem and a larger disclosure obligation.

Write down why, before deploying

The purpose, what is collected, why less would not do, who sees it, how long it is kept, and what it will not be used for. In some jurisdictions a formal assessment of this kind is required for systematic monitoring; where it is not, doing it anyway produces the document that answers every subsequent question.

It also produces the notice described in the blog entry on what staff are told, at no additional cost.

Stated plainly

This entry describes the shape of a legal question across jurisdictions. It states no rule, and the differences between countries are precisely where a general summary is most dangerous.

Take employment and data protection advice in each place you have staff, before deployment rather than after.

Consultation before deployment, in some places

Several jurisdictions require agreement or consultation with employee representative bodies before systems that monitor performance or behaviour are introduced. Where that applies, deploying first and consulting afterwards is not a recoverable sequence.

Establish whether it applies to any part of your workforce during planning.

Elsewhere in insider risk

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.