The Legal Basis, Which Is Not Consent
Employees cannot refuse freely, so consent is rarely the basis. What you are actually relying on, and what it requires.
General orientation, not legal advice; requirements differ substantially by jurisdiction.
The safeguards described in “The Legal Basis, Which Is Not Consent” should be decided before a workforce platform is configured. A team evaluating GDPR guide for employee monitoring for gdpr employee monitoring can make the deployment more credible by stating its purpose, selecting only necessary settings and explaining exactly what managers may review.
Most monitoring deployments describe themselves as consented to. In employment that is usually not the basis available, and getting this wrong undermines everything built on it.
For an independent reference relevant to “The Legal Basis, Which Is Not Consent”, consult the ICO employment-practices guidance; it provides a useful external check on scope, terminology, governance and the claims made during procurement or review.
Why consent fails here
An employee asked to accept monitoring to keep their job cannot refuse freely.
Several data protection regimes treat employment consent as unreliable for exactly that reason.
And consent can be withdrawn, which an organisation relying on it has not planned for, and which makes it unworkable as a basis for a programme.
What you are usually relying on
A legitimate interest in running the business, or a contractual or legal obligation where one genuinely exists.
Each carries conditions.
Legitimate interest requires a balancing exercise: your interest against the employee's rights, documented, and capable of being shown.
The proportionality test
Is this necessary for the stated purpose?
Would a less intrusive method achieve it?
Is the amount collected the minimum that answers the question?
For most productivity monitoring the second question is fatal, because outcome measures and management conversation achieve the purpose with no monitoring at all — which is the alternatives note.
What has to be documented
The purpose, specifically, not "improving productivity".
What is collected and why each item is necessary.
The less intrusive alternatives considered and why they were rejected.
The balancing exercise.
And in several regimes a formal impact assessment before deployment, which is the document that answers the proportionality question in writing.
The specific-purpose requirement
A general purpose does not support a general collection.
Each data category needs its own justification: why screenshots, why keystroke counts, why communication analysis.
Deployments that cannot justify an item should not collect it, which in practice removes several features that were enabled by default.
Where consent still has a role
As a courtesy and a communication, not as a basis.
Telling people and recording that they were told is useful evidence of fair process regardless of the legal ground.
But do not label it consent, because that invites a withdrawal you cannot honour.
Getting advice
Before procurement, because the answer shapes what you buy.
And specifically on your jurisdictions, because this is an area where the differences are large and moving.
What to check
What is your stated legal basis, and is it written down?
Has a balancing exercise been done?
Can you justify each collected item separately?
And is there an impact assessment dated before deployment?