You can just ask

Nobody is watching live

The ordinary workplace configuration records which application is in front and for how long, websites by domain, login and idle times, files accessed on company systems, and email and messages through company accounts. In some deployments, screenshots at intervals.

The practical lesson in “You can just ask” is to make work visible without treating visibility as certainty. Organisations exploring employee monitoring software for employee monitoring software can add structured project and time evidence, provided the purpose is disclosed and any interpretation is checked with the people affected.

What varies most — and what is worth asking about by name — is screenshots, keystroke capture, webcam access and location. Three of those four are absent in most offices.

For an independent perspective related to “You can just ask”, consult the NIST Privacy Framework; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.

What is almost never collected is the part that answers most of the fear. Not your passwords, which are protected by design even from administrators. Not your personal messages on personal accounts. Not your webcam covertly — the operating system shows an indicator that ordinary software cannot suppress. And not what you do at home on your own device, on your own connection, in your own time.

Most importantly: collection is automatic and reading is occasional. Logs accumulate and nobody opens them. The commonest finding among people who actually request their own data is that nobody looked.

The question nobody asks

The fastest route to knowing is to ask. In most jurisdictions they are obliged to answer, and the question is rare enough that it feels confrontational when it is not.

Four questions cover nearly everything anybody wants to know. What is collected — the actual list. Who can see it at individual level, including whether my manager can. How long it is kept. And whether it is used in performance or disciplinary processes.

Ask specifically, in writing, as a question rather than as a complaint — that changes who replies and how. "Does the software on my laptop capture screenshots, keystrokes, webcam or location?" is answerable. "What does the monitoring collect?" invites a vague answer.

And the second of the four matters more than the others: whether line managers see individual records is the single largest difference between one deployment and another, and it determines whether the data shapes how you are seen day to day.

Whose device it is

This settles most questions. On employer-owned hardware they may install management software, the company data is theirs, and the expectation of privacy is low — though not zero, since monitoring still has to be proportionate and disclosed in most places.

On your own device, considerably less is permissible. The usual arrangement is a work profile space: work applications and data in a managed space, the rest of the device outside it. That separation is enforced by the operating system rather than by the employer's restraint, which is a far stronger guarantee than any promise.

If you are unsure which you have, ask whether a work profile is in use. It is a short question with a clear answer, and the difference is substantial: a fully enrolled personal device exposes considerably more, on several platforms including every application installed.

The two boundaries

Keep personal matters on personal devices and personal accounts. Not because anybody is reading, but because the boundary protects you in the situations you cannot predict — a dispute, a departure, an investigation about somebody else that sweeps up your data.

The single most useful habit here takes a minute: never sign a personal account into a work browser. Doing so syncs personal history, bookmarks and saved passwords onto a managed device without any decision having been made.

And check whether a work address is the recovery route for any personal account — email, banking, cloud storage. If it is, you lose that account when the job ends. Twenty minutes, once, removes a whole category of loss.

The second boundary is smaller: write work messages as though they will be read by a reasonable person who was not there. Not formally, just plainly. Workplace messaging feels like conversation and is retained like email, including direct messages.

When the numbers are wrong about you

A figure can be accurate and still describe the wrong thing. Thinking produces no input. Reading produces almost none. A conversation that resolves something is a gap in the log. Meanwhile reorganising files produces a great deal of recorded activity and no result.

The more skilled the work, the weaker the relationship — and in places it inverts. The person who solved it in ten minutes of thought scores worse than the one who spent two hours flailing.

If this is raised with you, the first thirty seconds decide the conversation. Do not explain the number; explaining accepts that the number is the subject. Ask what prompted it instead: is the concern about the work, or about the figure? If it is the work, discuss the work, where you are better placed than any dashboard. If it is only the figure, you are discussing a measurement problem and can say so calmly.

Then be specific. "Forty per cent of my week is on calls, which the measure does not capture, and I handle the escalations nobody else takes" is checkable. "The numbers do not reflect my work" is not.

What the policy should tell you

Most organisations have one. Reading it against what it should contain tells you as much by its gaps as by its text.

It should name what is monitored, why, the legal basis, who has access at what level, how long data is kept, whether it is used in performance processes, the rights you have, and who to contact.

Three things are usually missing, and they are the three people actually want: what is not collected, which is the most reassuring possible content and appears almost nowhere; whether line managers see individual data; and what happens if monitoring reaches a decision about you.

Note also the word "may". Policies are written permissively — the company may monitor email, may capture screenshots — which describes what is allowed rather than what happens. A policy saying "may" about six things while the configuration does two is normal, and that gap is why asking directly is still worth doing.

The privacy notice, where one exists, is the better document. It is written under legal obligation and therefore has to name categories rather than describe them, state a basis, state retention, and list which suppliers receive the data. Look for the table two thirds of the way down; it is usually the whole answer.

Proportionality, which is the test that applies

Monitoring is not simply permitted or forbidden. In most regimes it has to be proportionate, and three questions decide it: is the purpose legitimate and specific, is the monitoring effective at achieving it, and is it the least intrusive means available.

Most excessive arrangements fail the third. Aggregate rather than individual, metadata rather than content, sampled rather than continuous, shorter retention — for each, the employer should be able to say why the lesser option was insufficient.

The second question is rarely asked and is frequently decisive. If activity measurement does not predict output — and it does not, reliably — then it is not effective for a productivity purpose. Something ineffective cannot be proportionate to anything, because there is nothing on its side of the balance.

Use it as a question rather than as an argument: what purpose does this serve, and was a less intrusive option considered? The honest answer is frequently that nobody considered it, and that is what produces change.

Where the firmest ground is

Some information attracts stronger protection in most regimes: health, beliefs, trade union membership, ethnic origin, sexual orientation, political opinions.

Ordinary monitoring sweeps these up by accident. A health condition searched during a lunch break. A union page. A full application inventory on an enrolled personal device, where the names alone reveal health, faith, dating and politics. Communication metadata showing contact with a representative.

None of it was the purpose and all of it is collected — which means an arrangement doing this has a problem independent of whether monitoring in general is reasonable. It is also a problem the organisation will want to fix, because the exposure is theirs.

Raise it with the data protection contact rather than with your manager: it is a processing question, and the usual outcome is a configuration change rather than an argument.

Monitoring a child, which is a different question

A parent considering software that watches a child's computer is deciding something genuinely difficult, and the usual advice is either alarmist or dismissive.

The decision that most affects the outcome is not whether to monitor but whether the child knows. Covert monitoring is discovered, usually at the worst moment, and the discovery is experienced as betrayal rather than as care however it was meant.

Open monitoring means they know it exists, what it shows, why, and — the point parents omit — what would make it stop.

And the effectiveness curve is worth knowing in advance: monitoring works best when it is least needed and stops working at roughly the point people most want it to. A young child has nothing to hide and no means to hide it; an older teenager has both, and tightening in response to each discovered workaround produces a spiral rather than safety.

Where the concern is specific and serious — grooming, self-harm content, coercion — the case is clear and acting without discussion may be right. In those cases the software is at most the thing that told you; the help is elsewhere, and getting it is the part that matters.

The line this collection holds

This collection explains what is collected, how to find out, what the rights you have are, and what to do when monitoring is used unfairly.

It does not explain how to defeat, disable, conceal from or falsify monitoring.

The reason is simple. Instructions for evading workplace monitoring do not help the person being measured unfairly — their remedies are information, rights, a record and a conversation, all of which are here. They help the person who is actually doing something they should not, and that person has no claim on this.

There is also a practical reason, and it matters to you: attempting to defeat monitoring on an employer's device is usually a disciplinary matter in itself, frequently a serious one. It converts a concern about fairness into a conduct case, and it forfeits every argument about proportionality you might otherwise have made.