Employee Monitoring, Productivity Scoring and Trust

AI-powered employee monitoring is one of the fastest-growing applications of AI in the workplace, yet most organisations deploy it with minimal governance and minimal regard for employment law, data protection law, or the erosion of trust it creates. Understanding the legal limits, the ethical considerations, and the business risks is essential for HR leaders.

Types of Monitoring

Employee monitoring via AI takes multiple forms. Keystroke logging and mouse movement tracking measure when an employee is actively using their computer. Email analysis systems scan emails for sentiment and engagement.

Time-tracking systems record when employees are at their desks or logged in to virtual meeting platforms. Productivity scoring systems analyse work output, comparing an employee’s throughput to peers or historical baselines. Location tracking tracks where employees are throughout the workday.

All of these systems capture data that organisations never used to collect. The promise is visibility: the organisation can see what work is being done, by whom, and how long it takes. The reality is often surveillance that damages trust and has limited utility for improving performance.

Legal Constraints

Employee monitoring is not banned in the UK, but it is constrained by several legal requirements. First, the monitoring must be proportionate to a legitimate business need. An organisation can monitor to ensure compliance (preventing data theft, monitoring compliance with policies) or to manage performance (ensuring work is completed on time).

However, the monitoring must be the least intrusive method that achieves the legitimate aim.

Second, the organisation must be transparent with employees about what is monitored, how data is collected, how long it is kept, and for what purposes. A legitimate business interest does not permit secret surveillance. If an organisation deploys keystroke logging without telling employees, that is a violation of their privacy rights.

Third, the organisation must conduct a DPIA before deploying monitoring systems, particularly if the system involves profiling or automated decision-making. Productivity scoring systems that use AI to flag employees who are “underperforming” and feed that assessment into redundancy selection decisions are high-risk and require thorough assessment.

Fourth, the organisation must provide individuals with access to their data and a right to challenge automated assessments. If a productivity scoring system recommends that an employee be selected for redundancy, the employee has the right to access their data, understand how the score was calculated, and request human review.

The Trust Question

Beyond legal requirements, monitoring creates substantial business risks. Surveillance erodes trust, reduces employee engagement, and can increase turnover. Employees who know they are monitored keystroke-by-keystroke are more anxious, less creative, and more focused on looking productive (not on being productive).

Research on productivity monitoring finds that the systems often measure activity (are you typing, are you in a meeting) rather than output (is the work actually getting done). Employees quickly learn to game the metrics: they open unnecessary applications to stay “logged in,” they attend meetings without contributing, they multitask inefficiently to show activity.

A manager who uses a productivity score as the primary measure of performance is likely to drive away high-performing employees who value autonomy and trust. This is not hypothetical; it is documented in turnover studies of companies that deployed aggressive monitoring systems.

Building Compliant Monitoring

If an organisation chooses to monitor employees using AI, it should follow a compliance framework. This includes: defining the business objective (what problem are we trying to solve), assessing whether monitoring is the least intrusive method to solve it, conducting a DPIA, providing clear notice to employees, implementing technical safeguards (minimising data collection, securing data, limiting access, retaining data only as long as necessary), obtaining employee consent where legally possible (though consent cannot be a condition of employment), providing individuals with access to their data and right to challenge automated decisions, and regular review to assess whether the monitoring is achieving the stated objective and is still proportionate.

Most organisations skip most of these steps. They deploy monitoring technology because it is available, without thinking through whether it solves a business problem or whether the cost in trust erosion is worth any benefit gained.