On Monday morning, before starting her home-care shift, Nora installed the service's new coordination app. The welcome screen promised easier scheduling, faster changes, and reassurance for families. Then it asked for continuous location access: not only while she was visiting a client, but while she waited for a bus, bought groceries after work, or slept. The company called this a way to confirm availability. Nora saw something else. Because no one had issued her a work phone, her private device was being asked to turn the hours beyond her shift into a workplace record.
Location data can sometimes have a legitimate, narrow role. A service may need to confirm arrival at a scheduled home visit or let a worker call for help in an emergency. The important question is not whether an app is capable of collecting a position. It is which decision needs which data, for how long, and under whose responsibility. If the decision is whether a worker arrived at ten, a time-limited check-in may be enough. A minute-by-minute trail through evenings, nights, and days off does not make that decision more accurate; it expands the employer's power to observe.
A permission is not free when work depends on accepting it#
Privacy prompts often describe consent as an individual choice. That description fails when the app is the only route to shifts. Declining access may mean fewer assignments, uncomfortable questions from a supervisor, or a reputation for being unavailable. No explicit threat is necessary for pressure to shape the decision. A person has a meaningful choice only when they can do their job, receive pay, and raise concerns without surrendering more private information than the task requires.
Privacy prompts often describe consent as an individual choice. That description fails when the app is the only route to shifts.
The fact that the device is personal makes the imbalance sharper. A corporate phone with a separated work profile does not solve every risk, but it makes the employer bear the cost of its tool and makes the boundary visible. Asking a worker to provide the handset, data plan, battery, and private life in order to complete an organisational task shifts both financial and privacy costs downward. In care work, where schedules are broken up and travel is constant, that shift can define the conditions of employment.
There is no need to prove that every manager will act maliciously before setting limits. It is a verifiable fact that the app can request background location. It is an inference that someone will use it to monitor a break or a personal trip. Yet the system already makes that use possible. Digital rights are not only remedies after proven abuse; they are design limits that stop a narrow operational need from silently becoming routine surveillance.
Build small permissions instead of a master key#
A respectful app separates its functions. Viewing a schedule should not require location. Confirming arrival can use a code, a manual action, or a one-time position check that explains why it is collected. An emergency alert can share a location for a brief period with the named response team. If route information is genuinely necessary for an exceptional service, it should run only during that visit, expire automatically, and display a clear indicator. One permanent “allow always” setting collapses different situations into a general surrender for the convenience of the software.
The controls must be usable without specialist knowledge. Before agreeing, Nora should be able to see the specific purpose, duration, recipient, and equivalent alternative. She should be able to change her choice later without losing basic work functions. A setting buried in a menu while the app repeatedly demands “always” is not effective control. Good design uses plain language, does not shame a more private choice, and gives the worker a readable copy of the configuration.
Data minimisation also means limiting retention. Proof of arrival does not justify keeping years of coordinates. The organisation should specify short retention periods, automatic deletion, and a firewall between operational coordination and any disciplinary file. When a particular incident needs review, access should be tied to that case, logged, and challengeable. An endless archive invites later uses of data that were never part of the original explanation.
An alternative is real only when it carries no penalty#
Saying Nora may decline tracking is meaningless if she is then placed last whenever visits are assigned. That is not a choice; it is a hidden penalty. Equivalent options might include a code at the home, a call to a staffed coordination line, a work terminal used during the visit, or a start record without continuous tracking. Each should provide the same access to shifts, support, and complaint routes. No one should have to defend, week after week, the wish to keep their home life private.
Those options should be tested with the people who do the work. Some workers have weak rural coverage; some share a device with family; others need to report a delay without disclosing an exact position. A pilot involving workers, labour representatives, and families may show that availability is improved more by realistic gaps between visits, staffed support, and honest schedules than by a permanent map. More data is not the same as better care.
An emergency route must be fast as well. A help button that shares location temporarily with a named emergency service can be justified because it connects the data to an event, a recipient, and a clear end. Continuous tracking “just in case” has none of that proportionality. Safety improves when a signal reaches someone able to act, not when an organisation accumulates signals with no decision attached.
Logs a person can read and challenge#
Every access should leave a human-readable trace. Nora should be able to open a simple list showing date, time, account, stated reason, and any action that followed. That makes a real question possible: why was my phone checked at eight in the evening when my shift ended at six? A technical log full of identifiers, or a support reply pointing to general terms, does not enable a right in practice.
The employer should also account for the system in aggregate: how many out-of-shift accesses occurred, how many were linked to emergencies, how quickly data was deleted, and how many complaints led to a correction. Workers' representatives and an accountable person with authority to suspend a feature should review those measures. A policy without a log, resources, or consequences for breach is only a statement of intent.
Labour oversight must not become a second surveillance team watching live maps. Its job is to inspect rules, limited samples, and complaints, with confidential channels and protection from retaliation. An independent audit can examine settings, retention, and shift allocation to see whether people who refuse tracking receive worse conditions. The question is not merely whether data was collected. It is what employment cost was imposed on someone who set a boundary.
Turning a complaint into a correction#
When Nora challenges a permission, she needs a route that does not depend solely on the person who assigns her hours. The process should be simple, time-bound, reviewed by a human, and clear about how a record or decision can be corrected. If the employer says access was necessary, it should identify the rule and evidence rather than repeat a vague claim of efficiency. If it was wrong, it should delete the data, repair the shift consequence, and explain what will change.
Families benefit from this approach too. Care is more reliable when workers can focus on the person they are helping instead of constantly proving where their phone is. Trust comes from sustainable schedules, honest communication, and managers who resolve failures; it does not come from treating every journey as evidence.
Before a care app is deployed, the organisation should publish a table naming the function, data, schedule, duration, recipient, and equivalent alternative. If that table can only be filled with “always” and “just in case,” the permission has not been justified. Nora's own phone can help coordinate a visit. It should not become the credential that exposes every minute of her life.
