Monitoring People: Where Security Meets Privacy

Picture a person starting a remote session. It could be an employee logging in to work with sensitive systems or a student sitting an online exam. They close other applications, turn on the camera and microphone, show an identity document, and stay under observation throughout. For the organization, these are carefully designed security measures. For the individual, they are simply part of the experience. How much does that person know about what happens behind the scenes, and how much should they know?

Remote monitoring has two goals that must be met at the same time: preventing misuse and allowing people to participate fairly. The challenge is protecting the organization's legitimate interests without intruding further into individuals' privacy than necessary. Following the monitored person's journey, before, during, and after the session, shows where that balance is struck.

Before: Setting Up the Controls

Security starts early. Lockdown software may restrict access to other applications, while identity checks and live or recorded supervision confirm that the right person is present under the right conditions.

These requirements also shape the individual's experience. A control that works smoothly for most people may cause problems for someone using assistive technology, a different type of device, or an approved adjustment. Accessibility should therefore be considered when controls are designed, not only after a problem occurs.

Behind every requirement sits a data protection question: what information is actually needed to achieve the security objective?

• Identity verification may involve identity documents.
• Supervision is likely to involve audio and video.
• Technical controls generate logs about the device and activity.

Each should have a defined purpose, appropriate access controls, and a clear retention period. Systematic monitoring of individuals is also one of the factors that may make a Data Protection Impact Assessment necessary under GDPR Article 35.

During: Proportionate Monitoring

Once the session begins, software may block external resources while supervisors or automated tools watch for anything unusual.

But what counts as unusual? Not every deviation is evidence of misconduct. A person may be using assistive technology, changing position, taking an approved break, or simply behaving differently from what a supervisor expects. A system that treats every deviation as suspicious risks confusing legitimate behavior with a security threat.

This is why human review matters. A flag should trigger an appropriate review, not an automatic finding. It also reflects the principles of necessity and proportionality: monitoring should serve a defined purpose, and organizations should consider whether less intrusive means could achieve the same result.

Transparency is part of proportionality. The Article 29 Working Party's Opinion 2/2017 on data processing at work stresses that people should receive effective information about any monitoring that takes place. It also notes that consent is unlikely to be a valid legal basis in the employment context, because employees can rarely refuse without consequences.

After: Handling the Evidence

The session ends; the data does not. A monitored session can leave behind identity information, audio and video recordings, technical logs, supervisor notes, and incident reports. If a session is flagged, some of this may become evidence in a later review.

Organizations should set clear rules on:

• Access. Recordings and investigation records should be available only to those who genuinely need them for their role.
• Responsibility. It should be clear who reviews flagged sessions and how.
• Retention and disposal. Information should be kept only as long as necessary and then securely deleted.

These rules apply the core GDPR principles of purpose limitation, data minimization, storage limitation, and security.

The difference between suspicion and proof is especially important. An unusual action, a technical irregularity, or a supervisor's concern may justify further investigation, but it does not establish wrongdoing on its own. Where evidence is inconclusive, the process should allow for that uncertainty.

This is where security and privacy meet most clearly: the more information an organization collects to protect itself, the greater its responsibility to control that information afterwards.

Conclusion

Monitoring does not begin when a session starts or end when it closes. It covers how people enter, how security is maintained during the session, and how the collected information is reviewed, protected, retained, and disposed of afterwards. Controls such as lockdown software, identity checks, and supervision can protect legitimate interests, but they should be proportionate, transparent, compatible with accessibility needs, and limited to what is necessary.