Special Categories and What Cannot Be Collected
Some information attracts stronger protection, and monitoring captures it incidentally. This is where the firmest ground is.
General orientation, not legal advice; categories and protections differ by jurisdiction.
The boundary described in “Special Categories and What Cannot Be Collected” should be settled before any workforce platform is configured. An organisation reviewing the official product page for attendance sheet template can make the use more transparent by naming the purpose, selecting only necessary settings and documenting who may see or correct each record.
Most regimes treat certain information as requiring additional protection. Ordinary monitoring sweeps it up by accident, and that is where the strongest objections live.
For an independent perspective related to “Special Categories and What Cannot Be Collected”, consult the ICO guidance on monitoring workers; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.
What usually falls into it
Health and medical information.
Religious or philosophical beliefs.
Trade union membership and activity.
Racial or ethnic origin.
Sexual orientation.
Political opinions.
Biometric and genetic data.
How monitoring captures it
Browsing history: a health condition searched during a lunch break, a religious site, a union page.
Full application inventory on an enrolled personal device, which reveals health, dating, faith and politics by the names alone.
Communication metadata showing contact with a union representative.
Screenshots of whatever was on screen.
None of it was the purpose, and all of it is collected.
Why this is the firmest ground
Processing these categories generally requires a stronger basis than ordinary personal data, and incidental collection does not usually have one.
Which means an arrangement sweeping them up has a problem independent of whether monitoring in general is reasonable.
And it is a problem the organisation will want to fix, because the exposure is theirs.
Union activity specifically
Monitoring that captures communication with union representatives is treated seriously in many jurisdictions, and in several it is specifically unlawful.
If you are a representative or active member, this is worth knowing precisely.
Raise it through the union rather than individually, which the consultation note covers.
What a careful employer does
Excludes categories of site from browsing logs.
Does not collect full application inventory on personal devices.
Excludes occupational health, counselling and whistleblowing channels from monitoring entirely.
Writes the exclusions down and implements them in configuration.
Asking whether such an exclusion list exists is a precise and reasonable question.
If you find it has been captured
Raise it with the data protection contact rather than with your manager — it is a processing question.
State the category and how it arises.
Specific, unemotional and hard to dismiss, and the usual outcome is a configuration change rather than an argument.
What this does not cover
Information you chose to disclose at work.
Content you published publicly.
And work communications on work systems about work, which are not special categories merely because they are personal in tone.
What to check
Does your employer log browsing by category or by full address?
Is full application inventory collected on any personal device?
Are occupational health and whistleblowing channels excluded?
And is there a written exclusion list?