Why monitoring is covered by data protection law
If you record when someone starts work, where they were, what their camera shows, or how active they were, you are processing information about an identifiable person. As the employer you are the data controller and responsible for how it is used. Any software provider you use acts as your processor on your instructions.
The core principles
- A lawful basis: you need a valid reason, such as performing the employment contract, a legal duty, a legitimate interest, or consent.
- Transparency: people must be told what you collect, why, for how long and who sees it.
- Purpose limitation: use data only for the purpose you gave.
- Data minimisation: collect no more than you need.
- Accuracy: keep data correct and let people fix mistakes.
- Storage limitation: delete data when it is no longer needed.
- Security: protect data against loss and misuse.
Be careful with biometric and sensitive data
Face data used to identify a person is biometric, which the law treats as sensitive. That raises the bar. You need a strong justification, clear information to staff, and usually explicit consent. You should also offer a reasonable alternative to anyone who cannot or will not use it. Do not use biometric data for anything other than what you told people.
Tell your staff before you start
Write a short notice in plain language and give it to everyone before monitoring begins. Cover what is tracked, why it is needed, how long records are kept, who can see them and how people can ask questions or complain. Update the notice when your practice changes, and record that people have read it.
Consent that means something
Consent is only valid if it is freely given, specific and can be withdrawn. In an employment relationship there is an imbalance of power, so rely on consent carefully and have another lawful basis where you can. Keep a record of who agreed to which version of your notice and when, and make withdrawal possible.
Keep monitoring proportionate
- Limit it to working time and work-related purposes.
- Do not watch people in private spaces or outside working hours.
- Prefer the least intrusive option that meets your goal. Attendance records may do the job without camera analysis.
- Never use monitoring to harass or discriminate.
- Do not make decisions solely from an automated score. A person should review it.
Registration and impact assessments
Controllers and processors are generally expected to register with the Office of the Data Protection Commissioner, and high-risk processing such as large-scale monitoring or biometric use may require a data protection impact assessment. Check the current requirements for your size and sector.
Respect people’s rights
Staff can ask to see their data, correct it, object to its use or ask for deletion in some cases. Have a simple way to receive and answer these requests within the time the law allows, and keep a record. Good monitoring software helps, with a self-service page where people can see what is tracked and download their data.
A short checklist
- Write the notice and share it.
- Choose and record your lawful basis.
- Do an impact assessment where needed.
- Register with the regulator if required.
- Collect only what you need.
- Set a retention period.
- Restrict who can see the data.
- Review automated results by hand.
- Be ready to answer staff requests.