UK rules on logging staff
Employee monitoring laws UK: event logs and the UK GDPR
Updated
In the UK there is no single monitoring statute; the UK GDPR does the work, and the ICO has written guidance for employers that monitor workers. A log about named people is personal data under both.
A lawful basis first
Article 6 of the UK GDPR allows processing only on one of its listed bases, among them the person's consent for specific purposes or compliance with a legal obligation the controller is under. Passing a log to a buyer is processing too, so it needs one of those bases.
An impact assessment where the risk is high
Where processing that uses new technologies is likely to result in a high risk to people's rights, Article 35 requires the controller to carry out an assessment before the processing starts.
What the ICO says
The ICO's monitoring guidance is aimed at employers and covers every relationship where a person performs work for an organisation, whatever the contract, including the gig economy.
Can I get paid to record my staff's screens for AI?
None of the twelve buyers on our board asks a firm for screen recordings of its staff, and UK law makes them the hardest thing to sell. What a firm can license instead is the written record of how the work is done.
Source: Who buys workflow traces and operating records
The ICO lists screen captures, webcam captures and keystroke monitoring as device activity monitoring, and says it is likely to capture excessive amounts of workers' personal information. Before any of it, an employer must be clear about the purpose, must identify a lawful basis, and must carry out an impact assessment where the processing is likely to cause high risk; the ICO names keystroke monitoring of workers as an example of high risk processing.
Source: ICO, monitoring workers: methods of monitoring
It also says an employer must inform workers about device monitoring, and that if the aim can be achieved in a less intrusive way, it must be.
Source: ICO, monitoring workers: informing workers about device monitoring
micro1 describes its programme as an operational data partnership using existing business documentation and operational datasets, which is the material a firm already holds without filming anyone. What this site covers next is on why AI companies want to know how your business works.
Also on this site
The US state rules are on employee monitoring laws by state.