Ethical Considerations in Data Protection and Surveillance

Ethics in cyber security refers to the principles and values that should guide decisions about how data is collected, used and protected, and about how security measures that affect individuals are designed and implemented. Ethical considerations go beyond legal compliance: there are many practices that are technically legal but ethically problematic, and there are obligations that arise from genuine respect for human dignity and autonomy that no law requires but that responsible management demands.

For mid-level managers, the ethical dimensions of cyber security are not abstract philosophical questions. They arise in concrete decisions: whether to implement a monitoring tool, how to communicate with staff about security requirements, how to respond when a team member makes a security mistake, and how to balance the organisation’s legitimate security interests against the privacy rights of employees and customers.

The Ethics of Employee Monitoring

Employee monitoring in digital environments has expanded dramatically over the past decade. Tools that track internet usage, record keystrokes, capture screenshots at intervals, log application use, monitor email content, track physical location and measure productivity metrics are all commercially available and widely deployed. Research from 2024 found that 80% of large businesses monitor their employees’ internet access, phone calls and emails. The growth of remote and hybrid working has accelerated this trend, as organisations seek visibility into work patterns that were previously observable through physical presence.

The ethical questions raised by employee monitoring are genuine and significant. They cannot be resolved simply by pointing to the existence of a monitoring policy, because the existence of a policy does not establish that the policy is ethical, only that it is disclosed. The key ethical considerations are:

• Proportionality: is the level of monitoring proportionate to the legitimate security or business objective it is intended to serve? Monitoring that records every keystroke and captures screenshots every five minutes on the grounds of security goes significantly beyond what most security objectives require, and the additional intrusion into employee privacy is not justified by the marginal security benefit. Proportionality requires that the least intrusive effective means is used.
• Transparency: employees should know what is monitored, why it is monitored, how the data is used and how long it is retained. Covert monitoring, except in the specific and carefully circumscribed circumstances recognised in law, is ethically unjustifiable because it fundamentally undermines the trust relationship between employer and employee. Research from the Society for Human Resource Management found that 45% of employees would consider leaving their current job if subjected to invasive surveillance practices, which has practical as well as ethical implications.
• Purpose limitation: monitoring data collected for security purposes should not be used for other purposes, such as performance management, productivity assessment or disciplinary proceedings unrelated to the security concern that justified the monitoring. Using security monitoring data in ways that were not disclosed to employees at the time the monitoring was implemented violates the principle of informed consent and is likely to create legal as well as ethical problems.
• Dignity and autonomy: research published in the Harvard Business Review and elsewhere has found that excessive monitoring can lead to increased stress, decreased job satisfaction, reduced creativity and, counterintuitively, increased rule-breaking behaviour. When people feel they are being controlled rather than trusted, they may exercise less self-control and experience less intrinsic motivation to act in accordance with organisational values. These findings suggest that monitoring policies designed without regard for their psychological impact may actively undermine the security and performance objectives they are intended to serve.
• Equity and non-discrimination: monitoring policies must be applied consistently and without discrimination. Selective monitoring of particular groups of employees based on their background, seniority or personal characteristics creates serious ethical and legal problems. The design and operation of monitoring systems should be reviewed to ensure they do not produce discriminatory outcomes in practice.

A Practical Framework for Ethical Monitoring Decisions

When considering whether to implement or support a monitoring policy, managers can apply the following questions as an ethical framework:

• Is there a legitimate security purpose? can we clearly articulate a specific security risk that this monitoring is designed to address? If the purpose is vague or primarily about productivity rather than security, the ethical justification is weaker.
• Is the monitoring proportionate? is the level of intrusion into employee privacy no greater than what is necessary to achieve the stated security purpose?
• Are employees fully and honestly informed? do employees know exactly what is monitored, why, how the data is used and for how long it is retained?
• Is there a clear governance process? who has access to the monitoring data, under what circumstances, and with what oversight? Are there controls to prevent misuse?
• Has the impact on trust and culture been considered? what is the likely effect of this monitoring on the trust relationship with employees, and has this been weighed against the security benefit?
• Is this consistent with how we would want to be treated? would the managers and leaders who have approved this policy be comfortable if it were applied to them in the same way?

The Ethics of Data Protection Beyond Compliance

Beyond monitoring, the ethical dimensions of data protection touch on fundamental questions about the relationship between organisations and the people whose data they hold. Several principles are worth examining explicitly:

• Informed consent and the right to understand: individuals whose data is held by an organisation have not only legal rights but genuine human interests in understanding what data is held about them, why and how it is used. Designing data practices that are genuinely transparent and understandable, rather than technically compliant but practically opaque, reflects an ethical commitment to treating data subjects as people rather than data sources.
• The duty to protect: organisations that hold personal data on behalf of others have accepted a responsibility to protect it. A breach of that data is not simply a regulatory event. It is a failure of a genuine duty of care that may cause real harm to real people. Approaching data security as a duty of care rather than a compliance requirement changes the character of the decision-making it informs.
• Algorithmic fairness and AI: as organisations increasingly use automated systems and artificial intelligence to make or inform decisions about individuals (including in security contexts such as fraud detection, access management and risk profiling), the ethical implications of those systems require attention. Algorithms can encode and amplify existing biases; they can produce outcomes that are technically accurate in aggregate but unjust in individual cases; and their opacity can make it difficult for those affected to understand or challenge the decisions made about them.