UK mulls making employers ask before installing bossware

Britain's Department for Business and Trade has opened a consultation asking whether the rules around workplace surveillance still hold up now that software can track almost everything an employee does on the clock. The question isn't whether monitoring exists anymore — it clearly does — but whether workers deserve a say before it lands on their desks.

The numbers tell their own story. Research cited in the consultation found one in three UK organizations now actively monitors employees' digital activity, up from one in five just two years earlier, according to separate ICO figures. That's a fast climb, and it's happening as AI creeps into the mix: automated decision-making, algorithmic management, productivity scoring systems that quietly shape who gets promoted or flagged for underperformance.

Ministers haven't picked a lane yet. The consultation lays out three options — leave it to non-statutory guidance, introduce a statutory code of practice, or go further and require employers to consult recognized unions or elected worker reps before rolling out what the document calls workplace monitoring technology, or WMT. That last option would be the biggest shift, turning a decision that currently sits entirely with management into something closer to a negotiation.

The government isn't pretending this technology is all bad. It argues that used properly, WMT can boost productivity and support investment. But the consultation also spells out the risks in plain language: threats to privacy and autonomy, surveillance that's disproportionate to any real business need, and biased outcomes when systems lean on incomplete or shoddy data. Those are exactly the failure modes people worry about when algorithms start making calls about human beings.

Even defining the target is proving messy. The proposed scope for WMT is enormous — CCTV, access control, biometrics, location tracking, keystroke logging, productivity software, anything touching automated decision-making. The consultation itself asks whether that net is too wide, too narrow, or roughly right, which suggests the hardest fight here might not be about what to do with bossware, but about agreeing what counts as bossware in the first place. The consultation runs as part of the broader Make Work Pay reforms and closes September 30.

Stephanie Lees, a data protection specialist at Pinsent Masons, points out that a statutory consultation duty would stack on top of GDPR, existing employment law, and the EU AI Act — another compliance layer for legal teams already stretched thin. It also means, as she notes, that installing the next AI workforce optimization tool could stop being a straightforward IT rollout and start looking a lot more like an HR negotiation.