What if we are monitoring to prevent data loss or detect malicious traffic?

• recording attendance for payroll purposes.

This can form an important part of an employer’s security measures and audit trail but may also pose a risk to data protection rights and freedoms due to the level of knowledge and control over workers’ activities and movements.

You must be clear about your purpose for recording access and time information. You must not use the information for a different purpose unless it is compatible with your original purpose.

If you are using, or considering introducing, biometrics to control access, read our guidance on biometrics and access and time data.

Further reading – ICO guidance

Purpose limitation

Example

An employer restricts access to a server room to certain workers for security purposes to protect equipment and information. This is managed by a swipe card access control system which records the entrance and exit times of the workers who have the right permissions to enter. This means if equipment is stolen or interfered with, or there is unauthorised access to information, records kept by the system enable identification of workers who had access at the time.

The employer does not repurpose information about workers’ access and exit times, for example, for performance evaluation.

Organisations are likely to have a number of technical solutions in place to monitor and ensure the confidentiality, availability, and integrity of personal data. These can include solutions such as firewalls to monitor for or to prevent external threats as well as internal monitoring such as data loss prevention solutions.

You must consider the least invasive means possible when selecting solutions to protect against data loss or external threats. You should complete a data protection impact assessment (DPIA). A DPIA will help you to assess the risk and identify if less intrusive methods could achieve your purpose.