Monitoring staff with data: five conditions before you deploy

According to The Economist (2018), the badge worn at Humanyze's Palo Alto office holds a microphone that picks up whether two people are talking, Bluetooth and infrared sensors that show where they are, and an accelerometer that records when they move (The Economist, 2018). Suppose you run a 40-person service firm and someone offers you a badge like that, or software that captures screen activity, promising to find out why customers wait so long for a reply. The first question is not the price. It is whether staff can really say no. This post tests the library's five conditions for workplace analytics on a hypothetical firm. See also the Humanyze case and the Facebook emotional contagion experiment.

If staff cannot refuse, is their signature consent?

Usually not. Condition 1 asks whether the person can refuse without losing anything. If the answer is no, the four conditions after it cannot rescue the decision.

Palm (2009) writes that the dependency asymmetry between employer and job applicant puts the applicant at a disadvantage in defending reasonable interests, and stresses that consent in employment contracts must be put in context to be ethically acceptable (Palm, 2009). I read only the abstract; extending it to people already employed is my reading. The GDPR points the same way. Consent is not freely given if the person "is unable to refuse or withdraw consent without detriment" (European Parliament and Council, 2016, Recital 42), and it is not a valid ground where there is a "clear imbalance", "in particular where the controller is a public authority" (European Parliament and Council, 2016, Recital 43). The text names public authorities, not employers; putting employment in the same class is my inference.

Stop rule: ask "what would a person who refuses lose in the next 12 months?" If the answer includes anything, such as assignments, bonus, appraisal or the manager's impression, do not call it consent. Either make the exit free in fact, or do not use the tool.

Do staff know what they are agreeing to?

They do when they can say it back: who collects, for what, what can be inferred, who sees it, how long it is kept. The GDPR requires at a minimum that the person knows the controller's identity and the purposes (European Parliament and Council, 2016, Recital 42).

"What can be inferred" is the usual gap. According to The Economist, at Humanyze itself, staff badge data are combined with e-mail and calendars to build a full picture of how they spend their time at work (The Economist, 2018). Agreeing to have your location logged is not necessarily agreeing to that picture.

The Facebook experiment shows the structure. In one week in January 2012, 689,003 users were in an experiment in which, in the test groups, each emotional post had a 10 to 90 per cent chance (depending on user ID) of being left out of the News Feed, to see how those users then posted. The authors write that the word-counting software ran automatically, so researchers saw no text, and that this was consistent with the data policy users accept when they open an account, which they say constituted informed consent (Kramer et al., 2014). The journal later published an editorial expression of concern (3 July 2014, PNAS 111(29), p. 10779) about informed consent and the chance to opt out. In my reading, one general agreement, later applied to a specific act, is the structure of many monitoring clauses in employment contracts.

Stop rule: write one page covering the data collected, what can be inferred, who sees it and how long it is kept. Ask three employees to read it and say it back. If they get the inferences wrong, the page is not enough.

Is the data used only where it was meant to be?

Only if the flow of information matches the norms of the context it came from. Nissenbaum writes that what people care about most is that information flows appropriately, not merely that it is restricted (Nissenbaum, 2010, p. 2). Context-relative norms "define and sustain essential activities and key relationships and interests, protect people and groups against harm, and balance the distribution of power" (Nissenbaum, 2010, p. 3). The GDPR has a counterpart in Article 5(1): specified, explicit purposes; only what is necessary; no longer than needed (European Parliament and Council, 2016, Art. 5(1)).

Stop rule: write one sentence, "data A about staff goes to person B, for purpose C, kept for D". Any use outside it, such as putting badge figures into year-end appraisals, goes back to condition 1. Before writing the sentence, ask whether the business question can be answered without personal data at all. If it can, stop there.

Does one person's choice affect those who did not consent?

Yes, whenever one person's data says something about another. Fairfield and Engel open with "Your privacy is not yours alone" (Fairfield and Engel, 2015, p. 387), and write that by consenting to collection a person becomes a conduit for information about her whole network, whether or not the others consented (Fairfield and Engel, 2015, p. 410). Their setting is social networks and their evidence comes from the experimental public-goods literature, not from workplaces; moving the point to a 40-person firm is my step.

Here is the move. The microphone on a consenting person's badge records the colleague beside them who refused. Screen-capture software records the chat window with a colleague who took no part.

Stop rule: if any of these applies, the decision belongs to the whole group, which takes you to condition 5.

Does the firm have a way to decide together?

It needs one, because each person's privacy depends on the choices of others. Fairfield and Engel write that protecting privacy requires group coordination (Fairfield and Engel, 2015, p. 387), and warn that if privacy is a social dilemma, educating and giving more control to individuals one by one may make the dilemma worse (Fairfield and Engel, 2015, p. 412). Two of the tools they describe: communication, which helps when members can identify one another and check who kept their promises, while cheap talk does not raise contributions (Fairfield and Engel, 2015, p. 451); and social sanction, which works but costs the person who applies it (Fairfield and Engel, 2015, p. 453).

The application is mine. Hold a whole-company meeting before buying. Draw up a charter that the owner also signs, saying who may see which data. Let staff see reports about themselves, as Humanyze's own staff can (The Economist, 2018). Meet again after 90 days and give the group the right to stop. One thing to watch: because workers are in the weaker position, an open show of hands run by the owner can fail condition 1 on the spot. I would use a secret ballot and fix the counting rule beforehand.

What does this look like in a 40-person firm?

A hypothetical, with every number made up by me. A customer-service firm has 40 staff in four teams of ten, and average reply time has risen from 4 to 9 hours. The owner is considering two tools. Tool A is a sensor badge recording who talks to whom, reported by team only. Tool B is software that captures each person's screen every five minutes. Such software exists: The Economist describes the American firm Veriato as selling a product that registers everything that happens on an employee's computer (The Economist, 2018).

In my reading, B stops at conditions 3 and 4 and struggles at condition 1, so it should not be deployed. A can go ahead if it clears all five and probably needs changes first. Then the earlier question returns: if the owner only wants to know why customers wait, measuring the time from a customer's request to the first reply, per request and without the handler's name, may be enough.

When do these conditions not fit?

They fit if you have not bought yet, have a few weeks, and want a process staff can see. They do not fit if monitoring is a matter of workplace safety or a mandatory requirement. The Economist notes that firms with dangerous workplaces are starting to use computer vision to check protective gear (The Economist, 2018); the five conditions give no verdict on that case.

Other limits. The GDPR is EU law; Article 88 lets member states set specific rules for employee data, and those rules must include safeguards, with particular regard to "monitoring systems at the work place" (European Parliament and Council, 2016, Art. 88(2)). I read no Vietnamese rules and make no claim about Vietnamese law. Nissenbaum says her policy and legal reference points come from the United States (Nissenbaum, 2010, p. 16). The Economist piece dates from March 2018; as of 3 November 2026 I have not checked whether Humanyze still operates or has changed its product.

Going deeper: what did I read, and what did I not?

Read in full: Kramer, Guillory and Hancock (2014), through the open-access copy on PMC, together with the journal's expression of concern about it; The Economist (2018), through the Wayback Machine capture of 17 January 2019 because the original blocks automated access.

Read in part: the GDPR on EUR-Lex (recitals 1 to 57, plus Articles 4 to 7, 35 and 88; I have not checked amendments since 2016). Fairfield and Engel (2015), through the Washington and Lee University copy: the opening, pages 410 to 412, part of III.B.1, III.C and the conclusion. Nissenbaum (2010): the contents page and introduction (pp. 1 to 17) in an excerpt the author posted, so I do not know how deeply she treats workplaces. Palm (2009): the public abstract only, because the article is paywalled.

The stop rules, the 40-person table and the coordination proposals are mine, built on these sources.