Skip to content

Behavioral monitoring privacy model

Behavioral monitoring — observing how a candidate works (file, editing and testing activity, focus and timing, paste activity, terminal and git metadata) — is the most legally sensitive part of the platform, especially in the EU where it can engage employee-monitoring, works-council co-determination, and DPIA obligations. This page is the documented privacy model Legal asked for: legal bases, the data-minimization design, the works-council posture, and a DPIA summary.

Read this together with Monitoring and data collection, which is the candidate-facing description of exactly what is and is not collected.

Design principle: minimization is a control, not a promise

The strongest privacy argument is that the sensitive data is never collected in the first place. SkillFoundry's telemetry is engineered so that:

  • It records activity, not content — behavioral interaction events that describe what happened in the workspace — not the text, not keystrokes, not clipboard contents.
  • It is scoped — in the VS Code extension only activity inside the assessment workspace folder is observed (enforced technically, including against symlink tricks), and collection runs only between starting and submitting the assessment.
  • It is sanitized before upload — email addresses, tokens, IP addresses, and home-directory paths are redacted from events (e.g. terminal command strings, commit messages).
  • It carries no audiovisual proctoring — no webcam, microphone, or screen recording.

Workspace scoping and sanitization are the technical measures that make the legal analysis defensible: they implement data minimization (GDPR Art. 5(1)(c)) and privacy-by-design (Art. 25) at the point of collection, not after the fact.

The appropriate lawful basis depends on who the controller is and the jurisdiction. Document your choice per deployment.

Basis When it applies Notes
Legitimate interest (Art. 6(1)(f)) Assessing job-relevant competence during a hiring process Requires a Legitimate Interest Assessment balancing the employer's interest against candidate rights. The minimization above is central to passing the balancing test.
Consent (Art. 6(1)(a)) Where required — e.g. some employee-monitoring contexts, or when relied on for optional processing Consent must be freely given; in an employment/candidate power imbalance it is often not a robust basis on its own. SkillFoundry records consent with policy version and timestamp (see Data retention and erasure).
Contract (Art. 6(1)(b)) Delivering an assessment the candidate has chosen to take Often layered with legitimate interest for the analytics.

Consent is not a silver bullet for candidates

Because candidates are in a power-imbalanced relationship with a prospective employer, EU regulators are skeptical of consent as the sole basis for monitoring. Most deployments should rely on legitimate interest with a documented LIA, use the disclosed transparency tooling, and keep monitoring proportionate — with consent reserved for genuinely optional elements.

EU works-council and co-determination

In several EU jurisdictions, introducing or operating a system capable of monitoring employee/candidate behavior triggers employee-representative involvement before roll-out:

  • Germany: under §87(1) no. 6 BetrVG, technical systems "designed to monitor" behavior or performance are subject to works-council co-determination — the works council must agree (typically via a works agreement / Betriebsvereinbarung) before use. This can apply to assessment tooling used on employees/internal mobility, and informs candidate-facing use.
  • France, Netherlands, and others: analogous information/consultation duties with the CSE / works council or employee representatives.

SkillFoundry's posture: the platform gives works councils what they need to evaluate and constrain the system — a precise, minimized data inventory ("activity, not content"), documented scoping and sanitization, candidate transparency tooling, configurable retention, and the ability to disable candidate-facing behavioral reports or specific categories of analysis. Completing works-council consultation and any works agreement is the employer's responsibility; SkillFoundry supports it with this documentation and the DPIA pack.

DPIA summary

Automated evaluation that influences hiring is a systematic evaluation of personal aspects / automated decision-making and typically requires a Data Protection Impact Assessment (GDPR Art. 35). SkillFoundry includes PIA/DPIA tooling that scores processing risk and flags high-risk factors (automated decision-making, profiling, sensitive data, third-party recipients, long retention) and generates recommendations. A summary DPIA for behavioral monitoring:

DPIA element Assessment
Processing activity Collection of assessment-session behavioral telemetry and computation of behavioral results that inform hiring.
Data types Behavioral interaction events (file, editing, testing, focus and paste activity metadata), submitted code diff, stakeholder chat, evaluation outputs. No keystrokes, clipboard, audiovisual, or special-category data.
Purposes Skills assessment and integrity checking to support a hiring decision.
Necessity & proportionality Minimization by design (activity, not content), workspace scoping, session-bounded collection, sanitization — the least-intrusive means for the purpose.
Key risks (1) Behavioral measures correlating with protected characteristics → adverse impact (see Bias audits and adverse impact); (2) function creep beyond assessment; (3) candidate opacity.
Mitigations Human-in-the-loop (flags → review, never auto-reject; audited manual overrides); candidate transparency (live event view, own report); scoping/sanitization; configurable retention and the ability to disable categories of analysis; bias-audit support.
Residual risk Medium — acceptable where the employer runs the required bias audit, gives notice, offers appeal/accommodations, and (in the EU) completes works-council consultation.
Review Re-assess on material scoring changes and at least annually.

Your organization should adopt and localize this DPIA rather than rely on it as-is; SkillFoundry will provide the supporting DPIA pack under NDA.

Configuration levers for a proportionate deployment

  • Behavioral reports to candidates: enable to strengthen transparency, or manage per organization.
  • AI-usage detection: applies only where the task/organization disallows AI assistance; when AI is allowed, no flags are raised.
  • Retention: align submission/conversation retention with your legal basis (see retention schedule).
  • Monitoring scope: telemetry is inherently session- and workspace-scoped; there is no "always-on" or off-hours monitoring to disable because it never exists.

Cross-references