Covert Investigation

General orientation, not legal advice.

Covert monitoring is requested more often in this subject than in any other, usually during a suspicion about one person.

The general position

Transparency is a foundational requirement in most data protection regimes.

Covert monitoring is an exception that has to be justified, not a tool available on request.

Where contemplated at all, it is generally limited to investigating a specific suspected serious wrongdoing, where notifying would prejudice the investigation, for a limited period, authorised at senior level, with the decision documented.

Not for: suspected lateness, extended breaks, or a general sense that someone is not where they say.

Why it usually fails here

The suspicion is frequently wrong. In this subject the ordinary explanations — a faulty reader, a queue, a borrowed card returned the same day — are common, and a covert operation that finds one has surveilled an innocent person.

The evidence is often unusable because the process was not followed.

It becomes known, and in a workplace it becomes known quickly.

And the damage is not limited to that person. Once one covert exercise is known, everyone assumes it applies to them, and the reporting of system failures stops immediately.

What to do instead

Ask. The overt question resolves most of these in one conversation, and it is the step that has to be attempted before anything else can be justified.

Check the system first, which explains a large share of anomalies.

Use a defined, authorised, overt review of a specific period if the concern persists.

If it is proposed

Ask who authorised it and on what documented basis.

Ask whether the overt route was tried.

Ask what happens to the material if the suspicion is unfounded.

Ask whether advice was taken.

Where the answers are not forthcoming, that is the answer.

What this collection will not describe

How to monitor someone without their knowledge.

How to structure a review so it is not apparent.

How to frame an automatic trigger as a human decision.

These appear here only to explain why they should not be done, and a better-concealed version of the thing is still the thing.

Try the overt question

The step that has to come first.

Ask.

In this subject the ordinary explanations are common and immediate, and the conversation resolves most matters in a minute.

A covert exercise that was not preceded by the overt attempt is very hard to justify, and one that finds an innocent explanation has surveilled someone for nothing.

Follow the difficult record

Use stealth workforce monitoring to frame one representative case. The useful evidence is the record created when a value is corrected, approved and exported.