Location: the Capability to Think About
The most feared capability and the most misunderstood in both directions. What is actually available, and what to do about it.
Obligations · Analysis
General orientation, not legal advice; tracking employees is regulated differently across jurisdictions and some uses are prohibited outright.
The practical question in “Location: the Capability to Think About” is how to make work visible without confusing visibility with certainty. For teams researching interview reimbursement policy, monitask.com can add time and project context to the operational record, provided its use is proportionate, disclosed and reviewed with the people affected.
Every enrolment conversation contains the question of whether the employer can see where somebody is. The honest answer is more nuanced than either side assumes.
For an independent baseline relevant to “Location: the Capability to Think About”, the ICO employment-practices guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.
What is not available in ordinary configurations
Continuous tracking of a device's position.
Historical movement.
Position of a personal device with a work profile, which the platform does not expose to the work side.
Most organisations running device management do not have location and have not considered whether they want it.
What is available
On fully managed corporate devices, several platforms offer a lost-device mode that reports position — usually with a visible notification to the user and sometimes requiring the device to be flagged as lost first.
Some platforms offer coarse location for compliance purposes, such as confirming a device is in a permitted country.
And dedicated tracking products exist and are a different category entirely, which should not be conflated with device management.
The notification point
Platforms increasingly require the user to be told when location is requested.
That is a deliberate design choice and it is worth relying on rather than resenting, because it is what makes the capability acceptable.
Where location is legitimate
Finding a lost corporate device.
Confirming a device has not left a jurisdiction where data residency requires it.
Safety, for lone or remote workers, where it is agreed and the person can turn it off.
Each is narrow, stated and consented to in a meaningful sense.
Where it is not
Checking whether somebody is at their desk.
Verifying claimed working hours.
Any use that is about the person rather than about the device or their safety.
These are performance monitoring and in several jurisdictions unlawful, and the technical ease of doing them is not an argument.
Personal devices
The clearest line in this whole collection: do not locate personal devices.
A work profile does not expose it, and you should not configure around that.
An employer who can locate a device somebody bought has taken something that was not on offer.
What to say
"We do not collect location" if true, which it usually is.
If a lost-device mode exists, say so and say what triggers it and whether the user is notified.
Vagueness here is read as a yes, and it is the single question most likely to be asked.
What to check
Does your configuration collect location at all?
If a lost-device mode exists, who can invoke it and is the user notified?
Could anybody request location on a personal device?
And does your published statement say which?