Covert Tracking
Tracking someone without telling them. The narrow circumstances in which it is contemplated at all, and why it is almost never the answer.
Covert tracking is requested more often than people admit, usually during a suspicion about one individual.
The legal position, broadly
General orientation, not legal advice.
Transparency is a foundational requirement in most data protection regimes: people must be told what is collected about them.
Covert monitoring is an exception that has to be justified, not a tool available on request.
Where it is contemplated at all, it is generally limited to investigating a specific suspected serious wrongdoing, where notifying would prejudice the investigation, for a limited period, with a documented decision at senior level.
Not for: performance concerns, suspected timekeeping issues, or a general sense that someone is not where they say.
Some jurisdictions restrict it further, and placing a tracker on a vehicle owned by the employee is a criminal matter in several places.
Why it usually fails anyway
The suspicion is frequently wrong. A substantial proportion of these investigations find an ordinary explanation, and the employer is then holding covert surveillance of an innocent person.
The evidence is often unusable, because the process was not followed.
It becomes known. Small organisations especially — someone sees the device, or the data appears in a conversation.
And the damage is not limited to that person. Once one covert deployment is known, everyone assumes it applies to them.
What to do instead
Ask what the actual concern is.
If it is attendance at customer sites, that is a job-record question, answerable by customer confirmation.
If it is hours worked, that is a timekeeping question, with its own ordinary processes.
If it is theft or fraud, that is an investigation with a proper route, usually involving advice and possibly the police, and covert tracking may or may not be part of it — decided by someone qualified, not by a fleet manager.
In every case the overt question comes first: would asking the person produce the answer? It frequently does.
If you are asked to set it up
Ask who authorised it and on what documented basis.
Ask whether advice was taken.
Ask what happens to the data if the suspicion is unfounded.
Ask whether the person's vehicle is theirs or the company's, which changes the legal position entirely.
Where the answers are not forthcoming, that is the answer. Declining is covered in its own note.
What this collection will not describe
How to place a tracker discreetly.
How to avoid detection.
How to structure a deployment so people do not realise what it collects.
These appear only here, to explain why they should not be done. A better-hidden version of the thing is still the thing.
The overt question first
Before any covert proposal is considered.
Would asking the person produce the answer?
It frequently does, and the explanation is usually immediate and ordinary.
Would an overt check answer it? A customer confirmation, a job record, a conversation with a supervisor.
Covert monitoring is an exception requiring justification, and an exception that was not preceded by the ordinary attempt is very hard to defend.
Connect policy to configuration
The practical choices behind this note can be compared with stealth monitoring software. Keep the written purpose in control of the setup, enable only the data needed and review the result with affected workers.
Independent reference
For an external point of reference, see ICO guidance. Use the regulator's current material before considering exceptional monitoring, necessity, proportionality and transparency.