What You Must Not Monitor Even With Consent

Consent has boundaries beyond the wording of a form

A signed employee acknowledgment can document that a person received a workplace monitoring notice, but it cannot grant an employer unlimited authority. The employer must still establish an appropriate purpose, consider applicable legal requirements and limit collection to what is necessary. A broad clause stating that the organisation may monitor everything does not automatically justify every activity that a technical product makes possible.

The limits employee monitoring even with consent depends on more than the document itself. The nature of the employment relationship, the information involved, the location of the employee and the applicable privacy framework can all affect what is permitted. Some legal requirements cannot be waived through a general acknowledgment. A local adviser should therefore examine the proposed conduct rather than merely approve the form's wording.

Personal communications are not automatically open to inspection

A company-owned phone can contain both business information and personal material. An employee might use an authorised device for an occasional personal message, store private photographs or maintain contacts unrelated to work. Device ownership is relevant, but it does not mean that every item stored on the device is automatically available for unrestricted review.

Employers should define the boundary between business information and personal activity before monitoring begins. If a business concern can be addressed through access logs or information relating to a particular work application, collecting unrelated personal conversations may be unnecessary. The organisation should also explain any restrictions on personal use of company equipment and ensure that those restrictions are consistent with local employment and privacy rules.

• Do not assume device ownership removes privacy rights.
• Separate business records from unrelated personal information.
• Avoid collecting more information than the stated purpose requires.
• Refer uncertain personal-data questions to a local adviser.

Assess particularly intrusive monitoring separately

Some monitoring activities create substantially greater privacy risks than ordinary business records. Keystroke logging can reveal information typed into applications, while periodic screen capture may expose personal content displayed during device use. Live screen streaming can provide a more immediate view of activity. Call recording may capture sensitive conversations involving employees and other people. These activities should never be treated as routine simply because a monitoring tool offers them.

Before considering any of these features, an employer should identify a specific need, examine less intrusive alternatives and establish strict limits on access and use. The organisation should consider whether monitoring can be restricted to a particular business context and whether sensitive information can be excluded. Clear employee disclosure is essential, but disclosure does not remove legal restrictions or make disproportionate collection appropriate.

mSpy is a commercial app with an online dashboard and lists various monitoring capabilities, including supported messaging and social application monitoring, call logs, keystroke logging, periodic screen capture and live screen streaming. Some capabilities depend on Android or iOS, the version, plan and configuration, and certain features require permissions on the monitored phone. Employers should check the official website for the current feature list rather than assume every function applies to every device.

• Justify each intrusive feature independently.
• Consider narrower methods before collecting detailed activity.
• Restrict access to authorised personnel.
• Explain the activity and its purpose before monitoring begins.

Location and communications data need clear boundaries

GPS location tracking, route history and geofence alerts can serve legitimate operational purposes in some workplace settings, but continuous location collection may reveal movements unrelated to work. An employer should consider whether location data is genuinely necessary, when collection should occur and whether a more limited arrangement would meet the same objective. Employees should be told what location information is collected and who can view it.

The same reasoning applies to SMS, email, call logs, browser history and information from supported messaging applications. A business security concern does not automatically justify reviewing every communication or browsing record. Employers should define relevant categories, explain the intended use and establish a process for handling information that falls outside the stated purpose.

Apply a practical test before approving any monitoring

A useful internal review asks whether the proposed activity is necessary, whether the same result could be achieved with less information, whether the scope is limited and whether access is appropriately controlled. It should also consider how long information is needed, how employees can raise concerns and what happens if the original business purpose changes. These questions should be answered for each monitoring category, not just for the product as a whole.

Consent and transparency matter, but neither should be used to disguise excessive collection. Employees need a written policy and notice that describe the real arrangement. If the policy includes a particularly intrusive feature, its justification should be documented separately and reviewed by the appropriate decision-makers.

The legal position varies between countries and may involve additional workplace consultation or data protection obligations. A local lawyer or competent adviser should assess the specific proposed activities. The next step is to prepare a monitoring inventory, mark the features that involve personal or sensitive information, and request a local review before relying on employee consent.

Questions readers ask