Findings

10 Continuous, keystroke or screenshot monitoring with no assessment recorded

Keystroke logging, screenshots, productivity scoring, idle-time tracking and webcam checks are the practices the EU and UK guidance single out as high risk and rarely proportionate; the CNIL calls keystroke loggers disproportionate; the ILO code allows continuous monitoring only for health and safety or the protection of property.

For the DPO: Where is the assessment (a DPIA, or the necessity and proportionality test) that came before this practice, and what less intrusive way was considered?

Where it comes from, location by location

Assessmentstatutory requirementAn impact assessment before processing likely to be high risk, with necessity and proportionality tested first, and the least intrusive way chosen. GDPR Art. 35WP249 para 3.2.2WP249 para 3.1(b)
Assessmentofficial guidance, not law guidance says noKeystroke, mouse, screen and webcam capture is disproportionate in the Working Party's view, and a legitimate interest for it will very rarely exist. WP249 para 5.4.1 official guidance, not law
Assessmentstatutory requirementNo decision with legal or similarly significant effects based solely on automated processing, save the listed routes and safeguards. GDPR Art. 22
Assessmentofficial guidance, not lawMany video cases need an assessment, and large-scale monitoring of public areas always does. EDPB video guidelines para 10 official guidance, not law
Assessmentstatutory requirementNecessity under s 26(1): no more data and no more intrusive processing than the employment purpose needs. BDSG s 26(1) sentence 1BDSG s 26(5)
Assessmentstatutory requirement guidance says noNo constant surveillance of staff; keystroke loggers are disproportionate; teleworkers are not watched by webcam or forced presence checks. CNIL guidance ACT-3CNIL guidance ACT-5CNIL guidance TLW-1Code du travail L1121-1
Assessmentofficial guidance, not law guidance says noScreen capture coupled with call recording is disproportionate; screen video with calls only for training, with every listed safeguard. CNIL guidance SCR-1CNIL guidance SCR-2 official guidance, not law
Assessmentstatutory requirementAn assessment before high-risk monitoring, the DPO's advice recorded, workers told before it starts; device monitoring needs its justification documented and a less intrusive way used if one works. UK GDPR Art. 35ICO monitoring guidance para 1.11ICO monitoring guidance para 3.11(a)
Assessmentofficial guidance, not law guidance says noWebcam capture is rarely justified; keystroke monitoring can be behavioural biometric data. ICO monitoring guidance para 3.11(c) official guidance, not law
Assessmentofficial guidance, not lawSolely automated decisions with significant effects on workers need one of the grounds the law lists and a route to a human. ICO monitoring guidance para 2.1 official guidance, not law
Assessmentstatutory requirementCollect only what is reasonably necessary, by fair means the law allows. (when you say the Privacy Act applies) APP 3
Assessmentstatutory requirementCollection proportionate to its purpose; a risk assessment where processing presents significant risk. (when you say the business meets the CCPA thresholds) CCPA 1798.100(c)CCPA 1798.185(a)(15)
Assessmentofficial guidance, not lawContinuous monitoring only for health and safety or the protection of property; monitoring output never the sole basis of a performance judgement. ILO code para 6.14(3)ILO code para 5.6 official guidance, not law

See the specimen plan run Plan your own list