‘Consult first’ duty considered for use of employee monitoring tech

The option is one of three interventions the UK government is considering making in response to “the pace of advancement in workplace technologies” – including the use of AI. Alternative interventions could include the introduction of a statutory code, together with guidance, to “strengthen clarity and support more consistent good practice”, or publication of new non-statutory guidance. The consultation does not identify a preferred approach, and the purpose of the exercise is to gather evidence on whether intervention is required and, if so, what form it should take.

Details of the proposals were set out by the Department for Business and Trade (DBT) in a new consultation paper (68-page / 5MB PDF). While the DBT acknowledged the productivity, compliance and security benefits that workplace monitoring technologies (WMTs) offer, it said it was considering new measures to address growing concerns around transparency, worker trust, privacy, fairness and the use of automated decision-making in employment contexts.

The paper highlights the range of requirements that employers already face in relation to their use of WMTs – including obligations under data protection law.

Stephanie Lees of Pinsent Masons, who specialises in data protection matters, said adding a new duty to consult in relation to the use of workplace monitoring technologies (WMTs) would “introduce a further layer of oversight governing the deployment of WMTs and the processing of employee data” for companies operating in Europe.

“Global companies operating in the UK/EU are seeing an increased number of fragmented regulations which could apply to employee data processing,” Lees said. “For example, in addition to local employment laws, UK GDPR, EU GDPR and local implementing data protection laws across EU member states, under the EU AI Act certain AI systems used in the employment context qualify as ‘high-risk’ AI systems, including the use of AI systems used to make decisions affecting terms of work relationships, or to monitor and evaluate the performance and behaviour of workers.”

Certain EU member states already require works council notification and consultation before implementing employee monitoring systems. Lees said that if the proposals to introduce a new consultation duty are implemented in Britain, it will require multinational employers “to adopt a coordinated approach to WMT governance that spans data protection law, employment law, AI regulation and worker consultation requirements”. She highlighted how EU works council consultations can be time consuming, citing the “extensive questions concerning data protection, AI governance and worker rights” employers can face on their proposed use of WMT before they can be deployed.

While the government said legislating for a consultation duty on WMT could deliver benefits like more sustainable adoption of technology and greater trust and confidence in its use, it acknowledged potential limitations. It cited difficulty in defining what technology would fall in scope of the new duty as an example in this regard.

The consultation defines WMTs as “digital tools used by employers to collect, track, analyse or make decisions based on information about workers and their activities”. These include “technologies used to observe performance, behaviour, attendance or communications… and systems that use this data to inform or make decisions affecting workers”. However, Lees said employers would need more practical guidance to help them comply with any new duty.

“With the rise of agentic AI and new technologies, there would need to be clear guidance with practical examples on what WMTs would trigger consultation duties in practice,” said Lees.

Employers need to carefully assess the purpose for processing employee data in advance of introducing any new monitoring technologies, added Lees, who said the government’s consultation paper signposts other data protection principles relevant to the use of WMT.

Lees said: “The consultation sets out eight principles employers should comply with for responsible use of monitoring systems – covering purpose, transparency, necessity, proportionality, human oversight, fairness, accuracy and worker engagement. These principles map closely with UK GDPR requirements and issues covered in the ICO’s employment monitoring guidance. In practice, most employers implementing WMT will already be conducting a data protection impact assessment, which would assess these risks and implement appropriate mitigation, but these principles serve as a useful reminder of those requirements.”