What do we need to consider when we monitor device activity?

not use logging tools indiscriminately and collect more data than you need, this guidance may be useful to understand proportionality and necessity. You should also read our guidance on law enforcement processing.

Developments in technology have led to an increase in the availability and affordability of monitoring tools with the capability to process large amounts of data. This can be particularly intrusive where workers are using their own devices.

Device activity monitoring can include capturing workers’:

• web browsing; • emails and messages; • documents; • use of applications; • screen captures; and • webcam captures.

Keystroke monitoring is classed as behavioural biometric data where a worker is identifiable because of their unique manner and rhythm of typing.

Device activity monitoring is likely to capture excessive amounts of worker information and special category data, such as emails about health conditions and emails to union representatives. Capturing webcam shots or footage are particularly unlikely to be justifiable.

If you are considering capturing the computer or device activity of workers, you should:

• Identify a lawful basis and a special category condition where appropriate. • Be clear about your purpose, fully document your justification for carrying out device monitoring, including what consideration was given to using less intrusive means. If you can achieve your aim in a less intrusive way, you should opt for this. • Carry out a DPIA. You are obliged to carry out a DPIA before undertaking any processing likely to cause high risk to workers’ and other individuals’ interests. You can use our screening checklists and read our detailed DPIA guidance to help you decide. Even where not mandated, a DPIA is good practice, the process with assist with your risk assessment and planning. • Consider consulting workers or their representatives. A representative sample of workers involved in assessing the necessity of monitoring and the accessibility of any policies around this should guide your plans.

Involving workers where risks may be high can help to address risks, concerns and help to build a trust-based relationship. The DPIA process includes a stage where workers are consulted.