UK may require employers to consult workers before deploying workplace surveillance tech

The UK Department for Business and Trade is launching a formal consultation on whether employers should be legally required to consult workers before introducing workplace monitoring technology (WMT). The initiative is part of the government's broader Make Work Pay reforms and will accept responses until September 30.

The consultation proposes a sweeping definition of WMT that encompasses CCTV, access control systems, biometric technologies, location tracking, keystroke monitoring, productivity software, and systems using automated decision-making or artificial intelligence. Notably, the government is inviting feedback on whether this definition is too broad, too narrow, or appropriately calibrated—an acknowledgment that defining "bossware" is as difficult as regulating it.

Minsters have not yet settled on a regulatory approach. They are asking three distinct questions: whether non-statutory guidance would suffice; whether a statutory code of practice is needed; or whether employers should face a legal obligation to consult recognized trade unions or elected employee representatives before deploying monitoring technology. The underlying concern is that workplace surveillance is both spreading and outpacing oversight. Research cited in the consultation found that one in three UK organizations now actively monitor employees' digital activity. Two years earlier, the Information Commissioner's Office (ICO) measured that figure at one in five employers—a striking rise in a short period.

The government's framing acknowledges the legitimate business case: WMT "can improve productivity, investment, and economic growth when used well." At the same time, it flags serious risks: "risks to privacy and autonomy," "disproportionate or unnecessary surveillance," and "biased or unfair outcomes" where monitoring systems rely on incomplete or inaccurate data. AI features prominently in the consultation because many emerging WMT systems incorporate automated decision-making and algorithmic management, raising questions about transparency, accountability, and the human impact of algorithmic systems in the workplace.

For employers, the compliance implications are substantial. Stephanie Lees, a data protection specialist at Pinsert Masons, noted that a statutory consultation duty would add "a further layer of oversight" for compliance teams already managing GDPR obligations, local employment laws, and the EU AI Act. The practical effect is that deploying the latest AI-powered workforce optimization suite could shift from a primarily technical decision into a human-resources and labor-relations exercise, requiring consultation with worker representatives before implementation proceeds.