Process Data and Personal Data

A scan event is process data or personal data depending entirely on what is done with it. The distinction determines the obligations and most of the risk.

Where the line falls

Aggregate: how long items wait at packing. Process data.

Attributed: how long each packer took per item. Personal data about identified individuals, in most jurisdictions, with the obligations that follow.

The sensor is the same. The distinction is created by the join to an identity, and it is a design decision rather than a technical necessity.

Why aggregation is usually sufficient

Bottleneck identification needs stage timings, not names.

Layout and slotting decisions need travel patterns, not who travelled.

Staffing models need demand curves, not individual rates.

Equipment decisions need utilisation, not operator identity.

Error analysis needs origin points, and while individual attribution feels natural here, the useful finding is almost always a process or a training gap rather than a person.

Design for aggregation by default, and treat individual attribution as an exception requiring a stated reason.

Techniques that keep it aggregate

Drop the identifier at ingestion, retaining only the stage, the timestamp and the work characteristics.

Aggregate at source where the system allows, so individual records never accumulate.

Group by shift, team or zone rather than by person.

Pseudonymise, with the mapping held separately and access controlled — which reduces exposure without fully removing it, and should not be described as anonymisation.

Set a minimum group size for any report, so small teams do not become individually identifiable by arithmetic.

Where individual data is genuinely needed

It sometimes is, and pretending otherwise leads to it being collected without controls.

Safety incidents, where establishing what happened requires knowing who was involved.

Training and support, where a struggling individual needs help rather than a target.

Certification and competence, where the record is about qualification to operate equipment.

Payroll, where piece rates or premiums apply.

In each case, state the purpose narrowly, tell people, limit access, and set a retention period. These are the obligations described in the worker monitoring section.

The re-identification problem

Aggregate data is not automatically safe.

A zone worked by one person on a shift is individual data whatever the report says.

A time-series with one operator visible is identifiable to anyone who knows the rota.

Cross-referencing two aggregate reports frequently identifies individuals.

Test your reports for this, with someone who knows the rota, before publishing them internally.

The practical argument

Beyond the legal position, keeping to aggregation is operationally better.

People cooperate with process improvement and resist personal measurement, and their cooperation determines whether the data is any good.

Gaming is aimed at personal metrics, not at aggregate ones. A system nobody has a reason to game produces cleaner data.

The findings are more useful, because they point at changes the operation can make rather than at people it cannot easily change.

Testing a report for re-identification

Ten minutes that prevents a whole category of problem.

Take the report to someone who knows the rota.

Ask them to identify individuals from it.

Check the small groups: a zone worked by one person, a shift with three people, an outlier that everyone present would recognise.

Check what happens when two reports are combined, each safe alone.

Where identification is possible, aggregate further — larger groups, wider time bands, or suppression of small cells.

Do this before circulating, not after someone points it out.

The minimum group size

A single rule that prevents most accidental attribution.

Set a threshold below which no figure is reported.

Apply it to every dimension: team, zone, shift, task type, and any combination.

Suppress rather than round, since rounding a group of two still describes two people.

Watch the combinations, which is where the rule is usually defeated: two suppressed cells and a visible total reveal both.

Publish the rule, so that people know why some cells are blank and do not assume the data is missing.