# Employee Surveillance DPIA Report

## Reference: DPIA-QLH-2026-0009

| Field | Value |
|-------|-------|
| Organisation | QuantumLeap Health Technologies |
| Subject | Employee Workplace Monitoring Programme |
| Date | 2026-03-10 |
| Next Review | 2026-09-10 |
| DPO | Dr. Elena Vasquez, CIPP/E, CIPM |
| Works Council Agreement | Executed 2026-01-15 |

---

## 1. Monitoring Measures Assessed

### 1.1 Email Metadata Monitoring

| Attribute | Detail |
|-----------|--------|
| Scope | 87 employees in FCA-regulated financial advisory roles |
| Data captured | Sender, recipient, timestamp, subject line |
| Content access | No — metadata only |
| Purpose | FCA SYSC 10A.1 regulatory compliance for recorded communications |
| Lawful basis | Art. 6(1)(c) legal obligation (FCA requirements) |
| Retention | 30 days for monitoring metadata; 7 years for regulatory archive |
| Intrusiveness | 2/5 |
| **Proportionality** | **Proportionate** — metadata-only monitoring is the minimum necessary for regulatory compliance |

### 1.2 Internet Usage Category Monitoring

| Attribute | Detail |
|-----------|--------|
| Scope | All employees (2,847) |
| Data captured | Website visit category (business, news, social media, shopping), time spent per category |
| URL logging | No — category-level only |
| Purpose | Network security (malware detection) and acceptable use enforcement |
| Lawful basis | Art. 6(1)(f) legitimate interest |
| Private use | Permitted — personal browsing categories not reported |
| Retention | 90 days |
| Intrusiveness | 2/5 |
| **Proportionality** | **Proportionate** — category-level monitoring is the least intrusive automated option |

---

## 2. Barbulescu Criteria Assessment

| Criterion | Score | Assessment |
|-----------|-------|-----------|
| BC1: Prior notification | 5/5 | Employees informed via privacy notice (v4.2), employment contract monitoring clause, and plain-language monitoring summary distributed 2026-02-01 |
| BC2: Extent of monitoring | 4/5 | Limited to email metadata and internet categories; no content access, no keystroke logging, no screen capture |
| BC3: Legitimate reasons | 5/5 | Regulatory compliance (FCA SYSC 10A.1) and network security |
| BC4: Less intrusive methods | 4/5 | Alternatives documented for each monitoring type; content monitoring rejected in favour of metadata |
| BC5: Consequences for employee | 4/5 | Monitoring data not used for routine performance evaluation; disciplinary action requires separate investigation with human review |
| BC6: Adequate safeguards | 5/5 | DPO oversight, works council agreement, audit logging of all access, role-based access controls |

**Average score: 4.5/5 — All criteria met.**

---

## 3. Risk Assessment

| Risk | Likelihood | Severity | Level | Mitigation | Residual |
|------|-----------|----------|-------|------------|---------|
| Chilling effect on legitimate communication | Possible | Limited | Medium | Metadata-only monitoring; no content access; employee awareness of limited scope | Low |
| Personal data exposure via monitoring | Remote | Limited | Low | No content access; category-level internet only; personal browsing excluded from reports | Low |
| Monitoring data repurposed for performance management | Possible | Significant | High | Policy prohibition enforced by DPO and works council agreement; access restricted to compliance and IT security teams; audit trail | Low |
| Excessive access to monitoring data by line managers | Possible | Significant | High | Role-based access controls: line managers have no access to monitoring data; only HR (for disciplinary cases) and compliance team | Low |

---

## 4. Approvals

| Role | Name | Date |
|------|------|------|
| DPO | Dr. Elena Vasquez | 2026-03-10 |
| Head of HR | Marcus Chen | 2026-03-10 |
| Works Council | Thomas Richter | 2026-03-11 |
| CISO | Dr. James Okonkwo | 2026-03-11 |
| COO | Dr. Priya Sharma | 2026-03-12 |