The Context
Four hours ago, Meta announced a mandatory surveillance programme for its US-based employees. The stated goal is to train AI agents. The method is the installation of tracking software on work computers to capture every mouse movement, keystroke, click, and occasional screen snapshots. This data, described as “real examples of how people actually use” computers, is being harvested under the banner of Meta’s SuperIntelligence Labs. This follows a March 2026 class action lawsuit alleging Meta transmitted sensitive, private video footage from its smart glasses to Kenyan subcontractors for labelling. The precedent is set: a pattern of intrusive data capture, buried disclosures, and a profound consent gap.
The Risk
This is not a technical glitch. It is a cultural detonation. For a director, the primary liability is not just legal; it is reputational and human. The ‘Court of Public Opinion’ is already in session, and the verdict on Meta is one of profound distrust. Mandatory surveillance of this granularity—creating behavioural profiles from biometric-adjacent data—shatters the psychological contract with your workforce. It signals that employees are not partners but data points. This erodes brand equity from the inside out. Psychosocial damage is a real, tangible risk under the Health and Safety at Work Act 2015. A failure to provide a safe working environment, including from psychosocial hazards like intrusive surveillance, may indicate a failure of director duty. The Privacy Act 2020 principles of purpose limitation and transparency are under direct assault. Directors may be personally liable if governance fails to prevent a culture where surveillance is deemed an acceptable cost for innovation.
The Control
The strategic solution is to categorically reject the premise that employee trust is a fungible asset for AI training. Governance must pivot from a compliance checklist to a human-centric risk framework. Any data collection must be preceded by explicit, informed, and revocable consent—not buried in terms of service. Establish a transparent ethical review panel for all AI training data initiatives, with employee representation. Treat keystroke data with the same gravity as health information.
The Challenge
These are the critical questions you should be raising at the board table:
| Beyond legal compliance, what is our quantified assessment of the brand and culture erosion risk from implementing mandatory employee surveillance for any purpose? | |
| If our ‘safeguards’ for sensitive screen data fail—as Meta’s reportedly did for private video—what is our concrete, pre-briefed crisis communications plan to address the resulting employee and public outrage? | |
| Have we conducted a formal psychosocial risk assessment under HSWA 2015 for any proposed monitoring programme, and can we demonstrate that all less intrusive alternatives were exhausted? |