Guardians of Data
A show where we explore the world of information law and governance; from privacy and AI to cybersecurity and freedom of information.
In each episode we will be speaking with experts and practitioners to unpack the big issues shaping the IG profession.
Guardians of Data
Employee Surveillance Without Losing Trust
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
In this episode we discuss workplace monitoring of employees.
Employers have always made use of the latest technology to monitor employees. In the past this would have involved things like CCTV and telephone monitoring and vehicle tracking. But new technologies, particularly AI, are taking employee surveillance to another level. Employers can now collect much more detailed information about what employees do, where they are and how they work. This is increasingly being used, with AI and algorithms, to allocate tasks and assess employee performance.
But just because we can monitor employees more, does it mean we should? Can surveillance really improve productivity? What happens to trust when employees know that every action can be measured? And as AI takes on more employee management functions, what are employers losing?
To help answer these questions, I'm joined by Professor Kirstie Ball from the University of St Andrews. Kirstie is an internationally recognised expert on workplace surveillance and the author of the report Electronic Monitoring and Surveillance in the Workplace which was published by the European Union in 2021. Kirstie is also the co-director and founder of the Centre for Research into Information, Surveillance and Privacy and has been a consultant to the UK's Information Commissioner.
The focus of this podcast is not the law on workplace monitoring. It's a conversation about what happens when surveillance changes the relationship between employers and employees. We talk about trust, dignity, autonomy and wellbeing; and about whether technology designed to improve performance can sometimes have the opposite effect.
Click the play button to jump in.
Please complete Kirsty's Survey
You are invited to complete this survey if you have used the ICO’s Data Protection and Worker Monitoring Guidance.
This survey asks you whether you have noticed any changes in your and others’ understanding of electronic monitoring as a data protection issue, and if you have noticed any changes in compliance since using the guidance. It takes five minutes to complete.
https://standrews.eu.qualtrics.com/jfe/form/SV_5cdnck6giupnLSu
Useful Links
Podcast - The Hidden Algorithms Behind Modern Policing
JRC report ‘Electronic Monitoring and Surveillance in the Workplace’
Saints Talk: ‘Employee Surveillance: Risks, Wellbeing and Justice’
GDPR and Employee Surveillance
ICO’s Data Protection and Worker Monitoring Guidance
ICO Guide to Workplace Monitoring
Podcast - Managing Workplace Data Protection Risks
This podcast is sponsored by Phaselaw - a purpose-built solution for document disclosures, like subject access requests and FOI requests. Instead of redacting PDFs one by one, or forcing litigation software to do a job it wasn't designed for, with Phaselaw you get collection, review, and redaction in one workflow. Teams across the World are using it to cut response times from weeks to days.
For Guardians of Data listeners, Phaselaw is offering a two-month free trial; run it on live requests, see what it does to your backlog, decide from there. No card, no commitment.
Hello and welcome to Guardians of Data. I'm your host, Ibrahim Hassan. In this podcast, we explore the world of information law and information governance, from privacy and AI to cybersecurity and freedom of information. Before we continue, click the follow button to ensure you never miss an episode. In this episode, we discuss workplace monitoring. Employers have always made use of the latest technology to monitor employees. In the past, this would have involved things like CCTV and telephone monitoring, as well as vehicle tracking. But new technologies, particularly AI, are taking employee surveillance to another level. Employers can now collect much more detailed information about what employees do, where they are, and how they work. This information is increasingly being used with AI and algorithms to allocate tasks and assess employee performance. But just because we can monitor employees more, does it mean we should? Can surveillance really improve productivity? What happens to trust when employees know that every action can be measured? And as AI takes on more employee management functions, what are employers losing? To help us answer these questions, I'm joined by Professor Kirsty Ball from the University of St. Andrews. Kirsty is an internationally recognized expert on workplace surveillance and the author of the report Electronic Monitoring and Surveillance in the Workplace, which was published by the European Union in 2021. Kirsty is also the co-director and founder of the Center for Research into Information, Surveillance and Privacy, and has been a consultant to the UK Information Commissioner. The focus of this podcast is not the law and workplace monitoring, it's a conversation about what happens when surveillance changes the relationship between employers and employees. We talk about trust, dignity, autonomy, and well-being, and about whether technology designed to improve performance can sometimes have the opposite effect. Let's jump in. Professor Kirsty Ball, welcome to Guardians of Data. Lovely to have you. Thanks for having me, Iberim. Really looking forward to this conversation because we often cover within the podcast privacy and data protection issues. We look at AI, we look at cybersecurity. But our conversation today is very much about ethics, it's about trust, it's about relationships. So we're taking the conversation outside of the law. So um it's going to be fascinating. Kirsty, when people hear the term workplace surveillance, they often think of CCTV or basic monitoring tools like electronic timesheets. If they have a vehicle, if they're doing driving for a job, then often the employer will install location tracking software. But what does surveillance look like in the workplace in 2026?
Kirstie BallIt's really tempting to speculate about what workplace surveillance looks like in 2026. But we actually have one reliable data source on this in the European context, and that's from a survey called AIMWork, run by the Joint Research Centre of the European Commission. And this survey found that three out of four people who work are subject to at least one form of monitoring, and that monitoring or surveillance, as we call it, has extended across all occupations. And this survey said there were actually three main forms of monitoring prevalent in the workplace today. One is the physical monitoring of people, so that's the monitoring of their location and their whereabouts and their movements. And that was found particularly in trades work, in operators and driving type occupations. Then the second form of monitoring was activity monitoring. So that's the monitoring of computer activities. And that's more applied to managers, professionals, clerks, or people in offices. And finally, time monitoring. That's the number of hours worked. And pretty much everyone is uh subject to this. And that's the most common form of monitoring is working time monitoring. So we like to fantasize maybe about AI and monitoring sentiments and all those kinds of things, but there's some also really basic type of monitoring practices to do with location, to do with activity and to do with time.
Ibrahim HasanSo you're saying that it's being used across industries, whereas previously we've thought that probably areas like logistics and gambling, where there's a clear need for some form of surveillance, that's where it's mainly happening.
Kirstie BallThat's true. So gambling and logistics are still key industries where we find high prevalence of monitoring. But what the survey found was that actually spread across many industries. Probably the least monitored are things like agricultural workers, but everyone else, you know, public services, education, all sorts have at least one form of monitoring. But very interestingly, uh, the survey that I'm speaking about gathered data from 27 European countries, the EU 27, and found that one of the most intensively survived countries was Malta. So high on CCTV, high on internet monitoring, and high on call monitoring. Of course, that has a huge gambling industry. There's something like 300 gaming operators there. So the stalwarts, the gambling logistics contact centers, are very much still there. But what we've seen in the last 10 years really is a spread across all industries.
Ibrahim HasanThat's interesting. A country like Malta, I think it's about one hour from end to end, yet it's of them surveillance. So I'll have to bear that in mind next time I'm looking for some winter sun. If I can ask, is employee surveillance actually on the rise? Is there more of it? Or is it the case that we're just using new technologies?
Kirstie BallI think it's on the rise. First of all, because of the spread across industries, as we just discussed, but there's a number of other reasons as well. More can be datified in the workplace and more can be measured. And because of that, more activities and more insights can be calculated in real time, and that can deliver more fine-grained insight into what people are doing, actually offer real-time evaluations of what workers are doing as well. So, and we're familiar with this in the platform economy. So we think of gig work, your Uber drivers, your delivery riders, and so on. But those kind of techniques are now moving into the standard workplace. So making the whole practice of employee monitoring or surveillance kind of extend.
Ibrahim HasanAnd since your report was published in 2021, Kirsty, obviously we've had the rise of AI, particularly in the last couple of years. How has that influenced workplace monitoring?
Kirstie BallSo, one of the big trends at the moment is the extension of algorithmic management practices from the labour platforms, as I've just mentioned, such as Uber and Delivery, into the regular workplace. And this is premised on artificial intelligence, that kind of automated calculation of what people are doing and when. And about one in ten people are algorithmically managed in some capacity. And there's different types of algorithm algorithmic management. You can use it, as I said, to allocate work, to evaluate work, and then to issue reward. My concern with that is its impact on the social fabric of work. So it really starts to alter the relationships between workers and their peers as well as managers, because one of the things that workplace that surveillance brings to the workplace is the ability to give accurate feedback. And in a constructive, well-performed, well-executed management worker relationship, that feedback can be really helpful to people as long as it's bounded and delivered in a constructive way. But if you're automating some of those processes, you're actually removing some of the social elements of work, some of those informal elements that really make performance management work. And what we're seeing across Europe now in the data is that workers have a greater need for social support because these techniques are actually removing the social elements to work and to kind of feedback on performance.
Ibrahim HasanI agree your point with regards to social interaction and almost social management more and more as we introduce technologies into the workplace, particularly AI, there are fewer opportunities for people to interact, to discuss, to receive feedbacks. Are we moving from monitoring to predicting workers' behavior? And how's that changing the relationship between employer and employee?
Kirstie BallThat's a very interesting question. There's no real data on that at the moment, but I think one of the ways in which these technologies are perhaps sold to employers is that it gives them that capacity to control and to predict and to preempt things like strategic workforce planning, things like recruitment as well. So one of the big preemptive kind of areas is recruitment. So where we perhaps target a labour market in particular, target a certain set of characteristics and then automate the allocation, automate shortlisting processes and so on. And this is largely about uh things like the cost of hiring and reducing that rather than making the hiring decision itself. But it means that as a candidate, you need to make yourself very visible to whatever the algorithm is looking for. And we see that, I mean, I I work a lot with people who are about to graduate and looking for work. And one of the conversations you have is how you can game the algorithm to get yourself on a short list. But there's also a preemptive dimension to electronic monitoring within the workplace. So we just talked about recruitment now. We've moved to within the workplace. Because if we think about location tracking, there's a preemptive dimension about predicting where people are supposed to be at particular times, what their driving behaviors are, what's acceptable and what's not. There's also a series of products called process mining products, which uses AI to look at workflow. So look at the back end of organizational systems and to look at who's doing what work, who's forwarding the right things, who's completing processes in a particular way, who's the fastest, who's the slowest, and then that's used to forward them work and requests accordingly. And so that's again a way of automating workflow and way of automating work allocation. But my point is that you're always going to need skilled people management because without that, you know, you're just going to have a huge turnover, you're not going to get quality people, you're not going to get quality management, and that's a bad work experience.
Ibrahim HasanAbsolutely. And on the face of it, for managers and for organizations, it's a cost-reducing exercise to get rid of human managers and have AI managers or algorithmic sort of managers doing the job. But in the end, if they're going to lose the trust of their employees or they're going to lose staff, then that's going to increase costs in the future. But is cost the driver here, or is there something else driving this increased surveillance in the workplace?
Kirstie BallIt's interesting that you mentioned cost. I think there's been some fairly high-profile incidences of large organizations downsizing layers of employees to replace them with AI and then massively regretting it. So I think there's IBM was one of them. I think Klan was one of them. I think Microsoft was one of them. What you lose is yes, you lose trust, but you also lose a huge amount of knowledge and the ability to kind of get your organization running how you want it to, with all that the kind of informal and tacit knowledge that is the oils the wheels in such a way. So yes, that's certainly a short-term strategy to reduce costs, perhaps not a long-term one. But if you come to workplace surveillance and the drivers of workplace surveillance, the thing to remember is that surveillance is an integral part of the employment contract. It brings it to life, it enables feedback to be delivered and performance information to be collected. So it's part and parcel of organizational life. So when you look at the main drivers to implement workplace surveillance or to kind of do it more exactingly, there's three things. First of all, organizations want to control their resource use. So they want to know exactly who's doing what and where and when and why and using what resource, because we live in a world of scarce resources and more resource use means less profitability. So that's the first thing. The second thing is that companies also need to check that they're compliant legally, and they need to ensure that no crimes have been committed on their property, on their information system. So that's another really important point of it. And finally, they need to protect their commercial interests. So they need to monitor to prevent the leaking of confidential information or client lists or protect their proprietary interests. So there's three main drivers from the company point of view, but it is absolutely central to organizing. It's part of the modern organization. The issue is obviously when it goes too far.
Ibrahim HasanYou mentioned resources. Many of these systems are obviously sold to employers on the basis that they're going to improve productivity. What does the evidence actually say about whether surveillance improves performance?
Kirstie BallThe relationship between workplace surveillance and enhanced performance is not straightforward. So the monitoring and surveillance works in tandem with other things. But one way it impacts performance is by enabling feedback to be delivered to employees based on what they've done. However, and this is a big however, the first thing you need to be clear about is what you mean by performance. And the second thing you need to be clear about is what you are measuring represents that performance. So that's the first issue. Surveillance kind of works in tandem with other things. And in order to pick to be effective, that feedback needs to be delivered in a way which takes place within the context of a constructive management worker relationship. So it has to be timely, it has to be specific, it has to be constructive, it has to be part of a two-way dialogue. And so monitoring can impact performance or productivity through the manner in which it is integrated into the performance management process. Now, the evidence, the research evidence says that there are various things that influence this that can actually detract from performance. For example, if you exceed your original purpose of monitoring, so if you have function creep, that starts to decrease trust and cause suspicion, which is going to impact performance ultimately. If you have a monitoring technology which gathers too much data, it's disproportionate, it's always on, people don't know where the data goes, then again, that's going to cause issues with motivation. Particularly, there's been a great research finding recently that said that if you're too draconian with your monitoring, there's evidence that actually prompts the behaviours it was put in place to prevent. So it can become completely counterproductive. We've already mentioned social support and the level of social support from managers or peers also influences the effectiveness of monitoring and the presence of an enforceable policy that everyone knows. So ideally, what should happen is that work monitoring just fades into the background and the management worker relationship in its constructive, productive manner would come to the fore. But if it becomes intrusive, it becomes excessive, then it can start to degrade workplace perceptions, it can start to degrade social relationships in the workplace, cause psychosocial risk, which then may have an impact on performance and may have an impact on people's engagement with the work process, and that may cause them to leave.
Ibrahim HasanSo I suppose what you're saying is fair and proportionate monitoring at work can supplement good management techniques and employee relationships. It can't replace that.
Kirstie BallThat's exactly what I'm saying, yes. And and I think what's really important to avoid is the monitoring being thought of as a silver bullet, the seductive kind of all-seeing way in which you can understand what people are doing. But without that strong performance management, constructive professional performance management in which we understand our employees and coach them and help them, as well as look at what they're doing in their tasks. Without that, then it's just bad practice, really.
Ibrahim HasanAbsolutely, I agree. You've mentioned some of the downsides to monitoring. I'd just like to look into those in a little bit more detail. What's the impact of surveillance you've found on employees' well-being?
Kirstie BallThere's probably 50 years of research findings which speak to that question. There's also been some research done by the European Union Occupational Safety and Health Agency, EU OSHA, on this very question. And we can talk about the impact on well-being in terms of what we call psychosocial risks. So the impact on the psychological element of work and the impact on the social element of work. So when employee monitoring is done badly, so when it's excessive, it goes beyond its purpose, if it's done in an authoritarian or punitive way, or if too much information is gathered, it goes too far into people's personal data, for example. It can cause stress, it can decrease things like organizational commitment, it can decrease job satisfaction, a sense of justice and fairness in the workplace, a sense of trust. It can have a chilling effect, it can impact autonomy. So what we see is a decline in the quality of work, the qualitative nature of work, if we have monitoring that goes too far. And it can that works through people's attitudes towards work. But also on the social side, it can start to impact social relationships in the workplace. It can start to instill control-based organizational values. It can cause an increase in things like emotional labor. So this is a well-known phenomenon in work sociology. Emotional labor is the difference between how you feel on the inside and how you feel like you're meant to feel on the outside. So your external display of emotion and your internal feeling of emotion, how how distant those two are and have you how you have to work to reconcile those two as part of a job. So if you, for example, are working in a call center and you're told to smile down the phone, to connect with the customer and you absolutely hate every single minute of your working day, that emotional labor is going to be really high for you. It's going to be a lot. Same with identity work, we're expected to show an external professional identity at work, but perhaps we're feeling something different inside. And yet if surveillance is capturing those things and being evaluated on those things, that's going to cause a lot of strain to you. It's going to cause a lot of strain to your social relationships at work. And what you see as a result of this is resistance. And resistance may not be what we immediately think of. It may not be things like strikes or sabotage or quitting, but it can also be the little things, the kind of the humours, the external denunciation of the employer that can actually be very disruptive to relations in the workplace. So yeah, I would say that was probably a fair summary of all the impacts on well-being through the social elements and through the psychological elements as well.
Ibrahim HasanThat's really interesting. What I found talking to people who work in highly surveilled workplaces is that there's a, and I think you mentioned this, a breakdown of trust. So I know people working in an educational setting where the CCTV everywhere. Okay, fair enough. I suppose in this day and age, considering recent stories about what's happened at various nurseries, but then it gets to a stage where there's a lack of trust on the employer side as well. Every little action, did you do this? Did you do that? Yes, I did. Oh, let's check the CCTV. So it leads to that breakdown of trust. And then the job becomes almost performative. I'm doing this task, but I must do it in a way which can be seen by the camera. And that can't be healthy, can it?
Kirstie BallNo, and when we think about trust, trust is a complex concept, but we can break it down. It's got three components, which kind of tells us a little bit more about what's happening in the example that you just gave. There are three components to trust. We trust someone if we believe that they're competent. We trust someone if we believe that they are benevolent. So whether they're acting out of interest, out of everyone's interest rather than self-interest, and whether we believe that they have integrity, so they're acting according to a shared moral compass. And all those three elements were in your example there, and we understand why in the nursery environment the nursery worker will feel that they're not trusted because their competence is being questioned, their integrity is being questioned because of the way that they're being monitored on the CCTV, and their benevolence is being in question, their ability to act out of the interests of everyone in the organization or in the interests of their charges rather than themselves. And that's when we see surveillance playing a role in the decrease of trust. It starts to support those questioning of are we competent, are we benevolent? And actually, do we have the right moral values?
Ibrahim HasanAnd I suppose it is important to emphasize that we're not saying there should be no surveillance in the workplace. We're saying that it should be ethical surveillance, it should be fair, it should be proportionate.
Kirstie BallYes, absolutely. As I've said before, surveillance or monitoring is part and parcel of organizing. It's an organizing principle. It's bound up with the history of modern organizing. So as factories were invented, as the census was brought in to understand urban populations, and as urban populations need to be policed, the diffusion of military technology such as cameras came into civilian use and that's accelerated. And bureaucracy itself is premised on the gathering of use of information as part of competitive advantage. So there's that we can't be without surveillance. It's one of the fundamental social processes in modern society, but there is Good surveillance practice where it can facilitate feedback and performance development, where it stays within its original purpose, where it's people are properly supported if they're subject to it, and where the technology itself is proportional, it's accessible and transparent.
Ibrahim HasanThat's really interesting, Kirsty. What about dignity and autonomy in the workplace? How is that impacted when every action can be measured?
Kirstie BallI worry about the dehumanizing tendencies of some of the technologies and practices that we see today and how, particularly with the use of AI and very granular uh data about what people are doing, may tempt managers to see only the numbers rather than the person. And so it's really helpful to think about dignity in this context, because for me, dignity refers to the quality of interpersonal treatment that we have in the workplace. So, for example, in the context of surveillance and monitoring, whether colleagues are given a proper explanation about the surveillance that's going on in a language they can understand, whether colleagues are listened to, they're trusted, whether they're allowed to challenge the results of surveillance and given credible explanations as to the judgments that are being made. Monitoring also demands a lot of managers. So, in terms of their capacity to empathize with people they manage, their emotional intelligence, their coaching skills. So for an employer to ensure dignity in the workplace, it also means equipping managers with these skills. Moving on to autonomy, autonomy is slightly different. There's lots of layers to it. And so, in respect to monitoring, autonomy is really the extent to which people can manage their own visibility in systems and choose how they respond to monitoring. So we need to think about things like job design. Does it allow for autonomy in response to monitoring? So whether people can control the onset of monitoring, can they control where the data go? Do they have access to that? Are they fully informed about what happens in the system? It also refers to whether you can use your expertise or your experience or judgment to actually choose how to do a job rather than simply following rules and being told what to do. And so in roles which are more low-paid, intensive service work with low autonomy, you do get poorer outcomes, you get higher turnover, higher stress. Remote workers also need autonomy. They need that to complete their tasks because of competing demands in home environment. And platform workers also experience what you call an autonomy paradox. So platform work is sold on the basis that people could control when they work, work where you want. But once they're working, they have very little control over the algorithmic surveillance that allocates them tasks. So that's dignity and autonomy. There's certainly very live issues, and they kind of follow on from this discussion about trust.
Ibrahim HasanAnd I think in a way you have answered the question, but just to sort of summarize, what should be the guiding principles for employers when they are considering introducing new technologies which would allow them to monitor their employees? Is it just about transparency?
Kirstie BallTransparency is part of it, but there's a lot more to it than transparency. It's about how systems are set up, run, and governed. So there's probably three things we can think about. First of all, is how people are made visible in systems and what the consequences of that visibility are. So how they're represented in data, because underrepresentation is just as bad as over-representation. And whether the outcomes of being present in that system are fair, do they unfairly disadvantaged or advantage particular groups? So that's the first thing. We'd call that distributive justice. So the outcomes of data processing. Then we can think about procedural justice. So what happens if we suspect a problem with the process, for example, bias? We need to think about whether biases in data processing can be challenged. We also need to think about whether monitoring processes themselves are open, accountable, and transparent from the outset. So that's where your transparency comes in in your procedural justice side. And then we have to think about how people are engaged and informed about the systems that they work with. So we can think about this in terms of what we call interaction or informational justice. And we can ask questions like whether people can understand and exercise control over monitoring. Are they treated with dignity? Are they treated as people, not numbers? And do they have skilled, considerate management support? So three things there: distributed justice, procedural justice, and interactional and/or informational justice. Those be the principles for me.
Ibrahim HasanAnd when implementing these principles into practice, I suppose there's a role for the employee representatives and the unions to ensure that the employer is designing a system that everybody can trust.
Kirstie BallYes, absolutely. So I think unions or employee representative bodies have a number of roles to play in relation to this. First of all, is around consultation. Now, in Europe, many European countries regulate workplace monitoring through labour law as well as through data protection law. And labour law in Europe gives consultation rights to trade unions over monitoring. But obviously, not everybody is represented by a trade union, but that's the kind of spirit of it. That's not really the case in this country. So it's really on a company-by-company basis as to how people are actually involved, unless they are represented by a trade union that is actually really hot on electronic monitoring. So some trade unions, for example, have a really big role in supporting and informing their members. So they have a role to keep their members aware of the dangers of employee surveillance and supporting people if they are in a dispute or have been treated unfairly. And a really good example of that is the Union of Tech and Allied Workers. And that's the branch of the Communication Workers Union. They've done quite a bit of research on surveillance and they've got a whole website which informs their members about surveillance and what to look out for. They do advocacy and campaigning about the dangers of surveillance. And finally, there's the question of co-design. So co-design is good practice, so involving people in the setup of particular systems or in decisions about them. And there's an interesting initiative from the European Union at the moment called Industry 5.0. This is a discussion which is about securing human centricity in the workplace, agreeing on things like being empowered and having people can challenge it. There's transparency and implementation, there's all sorts of things to integrate people rather than have AI workplace systems imposed. So co-design is another area in which unions could get involved or employee representative bodies could do so.
Ibrahim HasanThat's interesting. I read previously that there were calls by some of the unions for specific legislation around this area. A lot of it is governed by data protection legislation, and that has those principles of good surveillance already built in. We're talking about fairness, transparency, accountability, necessity, and proportionality. Do you think there is a case for one all-encompassing piece of legislation which governs this area or is the GDPR enough?
Kirstie BallThat's a very interesting question. And I just preface my response with that I am not a lawyer. We see examples of employee surveillance laws around the world. New York State has one, and Australia has one. The challenge that we have everywhere else is a piecemeal approach in which different legislative codes are kind of butting up against each other and there isn't any overarching framework. So it is a problem. And I don't know what the solution is. I think that the UK ICO, Love Emma Hate Em, have done a good job with their employer guidance. The GDPR guidance is good, but I think the reform needs to come with practice. So it comes with how data protection professionals and HR managers are connecting and how the different bodies of law which relate to monitoring are explicitly connected together. So that would be equality law and data protection law. And it could also be labour law. I mean, labour law is articulated in Europe in these terms, but not in the UK. But I think we may think more clearly about protected characteristics and outcomes for those groups, particularly in things like recruitment when it comes to equality law, for example. So a bit of a woolly answer, I'm afraid, but uh there are initiatives to draw together things in the digital economy. But I think when relation to monitoring, you have got a unique problem with data protection, equality, and labour law, and how the different kinds of bodies of staff and the stakeholders that relate to these different bodies of law connect to each other.
Ibrahim HasanYou say it's a willy answer, but actually it encapsulates the law in this area. I mean, we just talked about data protection law in some areas, particularly public authorities doing surveillance. There's overlaps with the Regulation of Investigatory Powers Act, but there's also some regulations relating to email, internet, and telephone monitoring, the lawful business practice regulations. So the law in this area is woolly. For my part, I would welcome one all-encompassing piece of legislation which builds in all these key principles. I think that would provide much more clarity to both um employers and employees. Well, we're on the subject of the law.
Kirstie BallBritain or the UK has some really specific provisions for surveillance in particular sectors. So in the public sector, it has very specific rules about CCTV application. But also the financial services sector has an absolute raft of compliance legislation which legitimates things like phone monitoring in particular, so that regulatory compliance can be ensured. It's something very specific to the UK. But we do like to be specific. We like to be specific with the ICO guidance and we like to be specific in relation to particular sectors. And as you said, the regulatory of investigatory powers act is also relevant.
Ibrahim HasanThe issue very much is that the more guidance we have as people who work in this area, it's useful for us and it's useful when we're advising or talking about this area. But what I find is that when it comes to employers, you see increases the confusion, and sometimes there's a lack of clarity as to when exactly which legislation or which code of practice takes precedence. So I would still prefer to have one all-encompassing piece of legislation. You mentioned the ICO's guidance, very useful document, and I know that you had a role to play in that. Is there any plans, do you know, to update that in the light of new technologies? Are you involved in any way?
Kirstie BallI have fed back in the consultative process about the guidance. I know there was a questionnaire released recently, but so far I'm not officially involved in any revamp of this guidance. I'd be more than happy to do so. I did have a little bit of involvement in the 2023 guidance because I submitted evidence based on the 2021 report that we're talking about. And I'm actually trying to gather data from data protection professionals. I have a little survey who've used the existing guidance. It's a five-question survey. And I was hoping we could share that with your listeners if that's okay.
Ibrahim HasanAbsolutely, most welcome. If you share the link with us, we'll ensure that it goes into the show's notes. What else is happening, Kirsty, in the policy world when it comes to workplace surveillance that our listeners should know about?
Kirstie BallThere's a number of things. So in Europe, there's a thing called the Platform Workers Directive, which is going to have some resonance in this country that came into force in 2024, and that has implications for algorithmic transparency and data protection, alongside the presumption of employment for platform workers. This is very important for platform workers and how they organize. This is a group of people that require help from trade unions and organizing bodies to actually increase their algorithmic literacy to challenge some of the quite exacting working conditions that they are subject to on the labour platforms. So that's the first thing. And I'm involved in a number of things as well. So the EU is now consulting on an analysis of the impacts and potential policy options for an EU initiative addressing algorithmic management at the workplace. So I'm involved in a project there. And the US are really interested in this area too. Now, they have very weak privacy legislation for the workplace. So I've advised the Government Accountability Office of the US Congress and their employment committee are looking at improving privacy rights for workers. So yeah, lots going on.
Ibrahim HasanBrilliant and um interesting times. Finally, Kirsty, for employers, HR leaders, and privacy professionals in terms of workplace monitoring, what would be your call to action?
Kirstie BallI would say talk to each other about how you identify and mitigate the harms of intrusive, excessive, or authoritarian workplace surveillance, take into account the stated purpose of the surveillance, how your technology is configured, have you got appropriate policy in place and are people trained in it? And have you trained your managers to support surveilled staff?
Ibrahim HasanExcellent. Kirsty, it's been a fascinating conversation. Thank you very much for your time. If our listeners want to continue the conversation with you, learn more about your work, how could they do that?
Kirstie BallWell, you can find me on LinkedIn. That's Kirsty Ball, K-A-R-S-C-I-E-B-A-L-L on LinkedIn. Happy to connect there. But I've actually done quite a few things online, talks-wise, that make the work accessible because I'm very aware that the 2021 report is absolutely huge. It's free, it's online, and it's called Electronic Monitoring and Surveillance in the Workplace, but it is a big read. So I've done a talk called Employee Surveillance, Risks, Wellbeing, and Justice through my employer at the University of St. Andrews, which you can find on YouTube. There's also a free summary of my long report in the journal Surveillance and Society. Now, that again is an academic journal, but it's free and open to everybody.
Ibrahim HasanBrilliant. Thank you very much for your time. Hopefully, we can have another discussion once the updated report comes out. I certainly hope so. That's all for this episode of Guardians of Data. A big thank you once again to Professor Kirsty Ball for sharing her insights. Kirsty's key message is that workplace surveillance isn't inherently a bad thing. It can help organizations manage resources, provide feedback, and meet legal obligations. But surveillance should support good management, not become a substitute for it. As it becomes more sophisticated, particularly with AI and algorithmic management, there is a real danger that employees become reduced to data points, with algorithms deciding what they do, how they perform, and ultimately how they are treated. This could lead to less trust, less autonomy, poorer well-being, and weaker relationships between employees and managers. So Kirsty's call to action is a simple but important one. Managers, HR professionals, and privacy professionals need to have a conversation about workplace surveillance. They need to consider why they're monitoring, how the technology is configured, whether there is an appropriate policy in place, whether employees understand what is happening, and whether managers are properly trained to support the people being monitored. Before deploying any new surveillance technology in the workplace, the question to ask is not what can it tell us about our employees, but rather what kind of workplace are we creating by using it? If you enjoyed this episode of Guardians of Data, please share it with colleagues and others who work in information governance. It's a great way to help grow the IG community and support professional learning. Don't forget to check out the show's notes for more resources on surveillance, including a link to episode 12, where I talk to Amnesty International's Racial Justice Director about the hidden algorithms behind modern policing. Thanks for listening and join us next time on Guardians of Data.
