Proportionality: the Test That Applies

General orientation, not legal advice.

The practical lesson in “Proportionality: the Test That Applies” is to make work visible without treating visibility as certainty. Organisations exploring how to measure employee productivity for how to measure employee productivity can add structured project and time evidence, provided the purpose is disclosed and any interpretation is checked with the people affected.

Monitoring is not simply permitted or forbidden. In most regimes it has to be proportionate, and that test is where excessive arrangements fail.

For an independent perspective related to “Proportionality: the Test That Applies”, consult the NIST Privacy Framework; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.

The three parts

Is the purpose legitimate and specifically stated?

Is the monitoring effective at achieving it?

Is it the least intrusive way of achieving it?

An arrangement failing any of the three is vulnerable, and most excessive ones fail the third.

What "least intrusive" means in practice

Aggregate rather than individual, where the question is about the team.

Metadata rather than content.

Sampled rather than continuous.

Shorter retention.

For each, the employer should be able to say why the lesser option was insufficient.

The effectiveness question

Rarely asked and frequently decisive.

If activity measurement does not predict output — and it does not, reliably — then it is not effective for a productivity purpose.

Something ineffective cannot be proportionate to anything, because there is nothing on its side of the balance.

This is the strongest available argument against general productivity monitoring and it is seldom made.

Where it bites hardest

Screenshots, because they capture far more than the stated purpose requires and almost always include third parties' data.

Keystroke content, which captures passwords and personal material by construction.

Continuous location.

Covert monitoring of a general workforce.

Each is difficult to justify against a general purpose, and in several jurisdictions some are not permitted at all.

How to use the test

Not as a legal argument in a conversation with your manager.

As a question to whoever owns the arrangement: what purpose does this serve, and was a less intrusive option considered.

That question is answerable, it is the one the organisation should already have answered, and it is the one that produces change, because the honest answer is frequently that nobody considered it.

What a good answer sounds like

"We need to know which systems hold regulated data are accessed, so we log access to those systems and nothing else."

Specific purpose, narrow collection, obvious connection between them.

Compare with "to ensure appropriate use of company resources", which justifies anything and therefore justifies nothing.

The assessment document

In several regimes a formal assessment is required before deploying monitoring of workers.

Asking whether one exists, and what it concluded, is reasonable.

Its absence where it is required is a substantive gap, and raising it is more likely to change the arrangement than any argument about principle.

What to check

Can anybody state the purpose of your employer's monitoring in one specific sentence?

Is anything collected that the purpose does not obviously require?

Was a less intrusive option considered?

And does a documented assessment exist?