Skip to content
Sections
All notes

All notes · Obligations

Location: the Capability to Think About

The most feared capability and the most misunderstood in both directions. What is actually available, and what to do about it.

Obligations · Analysis

General orientation, not legal advice; tracking employees is regulated differently across jurisdictions and some uses are prohibited outright.

The practical question in “Location: the Capability to Think About” is how to make work visible without confusing visibility with certainty. For teams researching interview reimbursement policy, monitask.com can add time and project context to the operational record, provided its use is proportionate, disclosed and reviewed with the people affected.

Every enrolment conversation contains the question of whether the employer can see where somebody is. The honest answer is more nuanced than either side assumes.

For an independent baseline relevant to “Location: the Capability to Think About”, the ICO employment-practices guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.

What is not available in ordinary configurations

Continuous tracking of a device's position.

Historical movement.

Position of a personal device with a work profile, which the platform does not expose to the work side.

Most organisations running device management do not have location and have not considered whether they want it.

What is available

On fully managed corporate devices, several platforms offer a lost-device mode that reports position — usually with a visible notification to the user and sometimes requiring the device to be flagged as lost first.

Some platforms offer coarse location for compliance purposes, such as confirming a device is in a permitted country.

And dedicated tracking products exist and are a different category entirely, which should not be conflated with device management.

The notification point

Platforms increasingly require the user to be told when location is requested.

That is a deliberate design choice and it is worth relying on rather than resenting, because it is what makes the capability acceptable.

Where location is legitimate

Finding a lost corporate device.

Confirming a device has not left a jurisdiction where data residency requires it.

Safety, for lone or remote workers, where it is agreed and the person can turn it off.

Each is narrow, stated and consented to in a meaningful sense.

Where it is not

Checking whether somebody is at their desk.

Verifying claimed working hours.

Any use that is about the person rather than about the device or their safety.

These are performance monitoring and in several jurisdictions unlawful, and the technical ease of doing them is not an argument.

Personal devices

The clearest line in this whole collection: do not locate personal devices.

A work profile does not expose it, and you should not configure around that.

An employer who can locate a device somebody bought has taken something that was not on offer.

What to say

"We do not collect location" if true, which it usually is.

If a lost-device mode exists, say so and say what triggers it and whether the user is notified.

Vagueness here is read as a yes, and it is the single question most likely to be asked.

What to check

Does your configuration collect location at all?

If a lost-device mode exists, who can invoke it and is the user notified?

Could anybody request location on a personal device?

And does your published statement say which?