The Estonian data protection authority (Data Protection Inspectorate, AKI) has published an analysis on the balance to be found between employee monitoring and respect for their privacy, especially in the context of remote work.

The discussion highlights that work evaluation should focus on results and achievement of agreed objectives rather than presence time. The use of technologies allowing continuous monitoring, such as screen capture or keystroke logging, is considered excessive in terms of data protection. It is emphasized that data collected for security purposes, for example via cameras or access control systems, cannot be reused to monitor the pace or behavior of employees. The installation of cameras must not result in constant surveillance of an employee's workstation, who must be able to have areas outside the field of view of the devices.

The importance of transparent communication is highlighted to maintain trust. Employees must be clearly informed about the data collected about them, the purposes of the processing, and the retention period. For example, a bank implemented a fingerprint fragment access system by precisely explaining to employees the use of their data and offering an alternative by card and PIN to those who did not wish to use this solution. The absence of explanation for a change, even if justified, can be perceived as a sign of distrust.