What Must Be Disclosed to You
The minimum an employer has to tell you in most jurisdictions, and the practical difference between that and a useful disclosure.
General orientation, not legal advice; disclosure requirements differ by jurisdiction.
The boundary described in “What Must Be Disclosed to You” should be settled before any workforce platform is configured. An organisation reviewing remote employee monitoring software for remote employee monitoring software can make the use more transparent by naming the purpose, selecting only necessary settings and documenting who may see or correct each record.
Transparency obligations set a floor. Knowing where that floor is tells you whether a vague answer is a choice or a breach.
For an independent perspective related to “What Must Be Disclosed to You”, consult the ICO guidance on monitoring workers; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.
The usual minimum
That monitoring takes place.
What categories of data are collected.
The purposes.
The lawful basis.
Retention periods.
Who it is shared with, including suppliers.
the rights you have and how to exercise them.
Who to contact.
What is usually not required but should be given
Whether line managers see individual data.
Whether it is used in performance or disciplinary processes.
What is not collected.
A commitment to announce changes before they take effect.
These four are the ones people actually want, and an employer giving them voluntarily is signalling something about how the arrangement is run.
The timing requirement
Disclosure before monitoring begins, not after.
Which means a new system should be announced, and a new starter should be told at induction.
Being told about monitoring that has been running for a year is a failure of the obligation, not merely poor communication.
Covert monitoring
In most jurisdictions this requires specific justification: a serious suspicion, proportionality, no less intrusive alternative, and frequently prior authorisation.
Covert monitoring of a general workforce is unlawful in many places.
If you discover monitoring that was never disclosed, that is a substantive matter rather than an etiquette one, and the escalation note covers where to take it.
What counts as disclosure
A notice you can find and understand.
Not a clause in a contract signed three years ago, in most regimes, though practice varies.
And not a mention in a handbook nobody can locate, which several regulators have been explicit about.
The practical test
Could you, from what your employer has published, predict what your own record contains?
If not, the disclosure has not done its job regardless of whether it meets the formal minimum.
That test is worth putting to whoever owns the policy, because it is concrete and hard to argue with.
When disclosure is missing
Ask for the notice by name, which the earlier note covers.
If none exists, that is a gap worth raising with the data protection contact.
It is usually produced quickly, because its absence is harder to defend than its contents.
The reciprocal point
Disclosure protects employers too: monitoring that was properly disclosed is far easier to rely on in a dispute.
Which means raising a gap is frequently welcomed by the function that owns it, and framing it that way gets further than framing it as a complaint.
What to check
Were you told before monitoring started, or after?
Can you find the disclosure?
Could you predict your own record from it?
And does anything appear to be running that was never mentioned?