The Covid-19 pandemic facilitated remote working environments and this is now covered in the draft guidance. Remote working arrangements are heavily reliant on trust and employers should be able to carry out some degree of monitoring, such as monitoring device activity to track workers' activity and productivity. This is acknowledged by the ICO; however, it has made clear that employers' excessive monitoring may intrude in workers' private lives and they must take into account that workers' expectations of privacy are likely to be significantly higher at home than in the workplace. Employers should factor these risks of capturing family and private life information into any planning.

If employers provide workers with company cars, it may be that these cars are tracked during working hours for business reasons. For example, the employer may use tachographs in vehicles to record information about driving time, speed, and distance to ensure the rules on drivers’ hours are followed. The draft guidance makes clear that if company cars can be used for personal use by the worker as well, monitoring during private use will rarely be justified. The ICO suggests that employers should use tracking systems which the driver can disable so it does not monitor driver activity outside of work.
If driver monitoring is more intrusive, for example, by monitoring driver behaviour or using cameras or audio, then these will be harder to justify (due to the higher risk to the worker's privacy). The ICO recommends that a DPIA is carried out in these instances to access the risks and less intrusive methods should be considered.

Technological advances have led to an increase in the processing of biometric data, which is used to monitor and control workers' access into buildings and systems. The updated draft guidance now considers this and warns employers that when processing such data, it must:

• consider whether it is necessary and proportionate, documenting its reasoning;
• identify a legal basis and special category condition where needed. If consent is relied on as a special category condition, employers will also be required to put in place alternative methods for authentication / identification for workers who have not provided consent; and
• carry out DPIAs in some instances. It will be good practice for employers to carry out DPIAs in any instance to reduce potential regulatory action and also improve workplace morale.