When Monitoring Data Is Used in a Termination

Monitoring data has an appearance of objectivity that makes it attractive in a termination decision. Numbers, timestamps, screenshots — it looks like proof.

For a related workplace-management perspective, Monitask outlines common fireable offenses.

Employment-decision guidance is available from the U.S. Equal Employment Opportunity Commission.

It is frequently weaker than it looks, and using it badly converts a defensible decision into a difficult one.

General information, not legal advice. Termination decisions should be reviewed with employment counsel.

What activity data does not prove

It does not prove someone was not working. Low activity is consistent with reading, thinking, being in a meeting, being on a call, working on paper, or working on a second device. Every one of those is work.

It does not prove someone was working. High activity is consistent with a mouse jiggler, an open document nobody was reading, or busy work.

It does not establish output. Two people with identical activity scores may have produced entirely different value.

It does not account for context. Illness, caring responsibilities, an accommodation, a disability, a system outage, a slow dependency.

The gap between what the data shows and what it is taken to show is where the risk lives. See productivity surveillance: what it measures.

Where it is legitimately strong

Monitoring data supports some conclusions well:

Specific policy breaches. Accessing systems without authorisation, exfiltrating data, visiting prohibited content. Discrete, documented, verifiable.

Falsified time records. Where badge access or system logs contradict recorded hours, the discrepancy is factual.

Regulatory findings. Where supervision is mandated and the record shows a specific failure.

Corroboration. Supporting a conclusion reached on other grounds, rather than being the grounds.

The distinction: it works for discrete events, and it works badly for general assessments of effort.

The questions to answer first

Before monitoring data supports any adverse action:

Was the monitoring disclosed? If notice was required and not given, you now have two problems. See employee monitoring: what is lawful.

Was the policy consistently applied? If the data exists for everyone but was reviewed only for this person, that selectivity is the fact that will be examined.

Would we have reached this decision without it? If yes, the data is corroboration. If no, be careful — it is carrying more weight than it can bear.

Have we asked the employee? A conversation frequently explains the pattern. Skipping it removes the cheapest way to avoid an expensive mistake.

Is there a protected explanation? Disability, accommodation, medical leave, caring responsibilities, protected activity. A drop in activity following an accommodation request is a pattern with an obvious alternative reading.

Is the timing awkward? Following a complaint, a leave request, an accommodation request, or protected activity. Timing does not make a decision unlawful, but it shifts the burden of explanation onto you.

Do we have contemporaneous performance documentation? Monitoring data assembled after a decision, in place of records that should have existed all along, is visible as such.

The pattern that goes wrong

The recurring failure looks like this:

1. A manager forms a view that someone is not performing
2. Nothing is documented at the time
3. The manager reviews monitoring data and finds a pattern that supports the view
4. The termination rests on the data
5. In a dispute, it emerges that the data was reviewed only for this person, that others with similar patterns were not reviewed, and that the low-activity periods correspond to something with an innocent explanation

The problem is not that the data was used. It is that it was used to justify a conclusion reached beforehand, and selective review is straightforward to demonstrate.

Do it properly instead

Document performance when it happens. Contemporaneous records of specific issues, expectations set, support offered, and outcomes. This is what carries a termination, with or without monitoring data.

Apply review consistently. If you review activity data, review it for everyone in the role, on a defined basis, not on suspicion.

Have the conversation. Tell the person what you have observed and ask them to explain it. Their answer is information, and its absence is a gap in your process.

Separate categories of finding. A specific policy breach with a timestamp is one thing. A general impression of low effort is another. Do not present the second as though it were the first.

Get advice before acting where the person has an accommodation history, has recently complained, has taken protected leave, or where monitoring data is doing the decisive work.

Retention and disclosure

Two consequences employers underestimate.

The data becomes discoverable. Every screenshot and activity log relating to that employee — including everything that supports their account — is potentially producible. Employers occasionally find that their own monitoring undermines their position.

Employees may have a right to access it. In several jurisdictions employees can request the personal data an employer holds about them. A monitoring programme that collects extensively creates a corresponding disclosure obligation.

Both argue for collecting less, keeping it for a defined period, and knowing exactly what you hold.

The test

If the monitoring data disappeared tomorrow, would this termination still be defensible?

If yes, proceed on the underlying grounds and treat the data as corroboration.

If no, the decision rests on something that cannot support it — and the right response is more documentation and a proper conversation, not a better dashboard.