Task mining and GDPR: what is measured, what is not
Observing desktop work without recording what is typed. The distinction is not cosmetic: it decides whether the whole arrangement stands up.
Task mining observes desktop activity to find the repeated gestures no system records: the back-and-forth between two applications, the retyping, the waiting. The first question is always about surveillance, and rightly so.
The line not to cross
Counting keystrokes is not recording keystrokes. A counter says there were forty entries in a window; it says neither which ones nor what they contained. That is the difference between metadata and capture.
- Collected: the active application, the duration, aggregate interaction counters.
- Not collected: typed content, individual keys, the clipboard, screenshots.
What it changes in practice
The analysis is about patterns, not people: a sequence recurring thirty times a day across eight different operators points to a tooling gap, not to an employee. That is also what makes the result usable: nobody cooperates with something that scores them.
