Occupancy Analytics Need Purpose Limits

Decide what question deserves data

A workplace team may need to know whether collaboration rooms are available at peak periods. That question does not necessarily require identifying the people who used them. Starting with the business decision helps avoid collecting detailed personal information simply because a sensor or access system can provide it.

Hong and Li discuss privacy and ethical documentation where building research involves identifiable occupants [HONG]. NIST’s incident-response guidance also recognises the need for appropriate legal and privacy input [NIST]. These sources do not determine a particular organisation’s legal basis. They support deliberate governance before data is combined or repurposed.

Separate operational and individual inference

Room counts, badge entries, Wi-Fi connections and bookings represent different events. A booking does not prove attendance, an entry does not show duration and a device count does not automatically equal people.

Combining them can create an impression of precision without resolving those differences.

Osmos recommends a clear statement of permitted inference. A dataset approved for aggregate capacity planning should not silently become a performance-monitoring tool. The organisation should identify prohibited uses and define the approval process for any proposed change in purpose.

Choose the least detailed useful view

Determine the spatial and temporal detail necessary for the decision. Aggregation can reduce exposure, but small groups or repeated patterns may still make people identifiable. Review the design with privacy specialists rather than assuming that removing names makes a dataset anonymous.

Retention should also follow purpose. Historical patterns may support seasonal planning, while raw event-level records may no longer be needed. Set a retention rule, control access and test deletion. A privacy statement is incomplete if administrators cannot explain where copies, exports and supplier-held records remain.

Explain the system to the people affected

Employee communication should state the purpose, data sources, level of analysis and routes for questions.

Avoid presenting a planning system as harmless solely because it does not use cameras. Different technologies can still reveal sensitive patterns, particularly when several datasets are linked.

Involve workplace, HR, IT, security and privacy teams before deployment. Their responsibilities overlap but are not identical. The operational owner should be able to show that the chosen data actually answers the planning question and that less intrusive alternatives were considered.

Illustrative decision rehearsal

Consider an illustrative proposal to combine room-booking records with access events to improve space planning. The aggregate question may be legitimate, but joining the records can create a much richer picture of individual behaviour than either system originally exposed. The team should evaluate that new capability explicitly instead of treating the join as a routine data-cleaning step.

Ask whether the planning objective can be met with anonymous room counts or less granular time periods. If individual linkage is proposed, require an explanation of necessity, authorised access, retention and the applicable review. The technical team should not decide those boundaries simply because the join is easy to implement.

During the first reporting cycle, test what a reader could infer from small teams, unusual schedules and rarely used rooms. A report without names may still reveal someone’s pattern when combined with ordinary workplace knowledge. Suppression or aggregation rules should be assessed against that real context.

The governance record should also specify what happens when a manager asks for a new use, such as checking a particular employee’s attendance. That request changes the purpose and should not be satisfied through an informal export. A clear escalation route protects both employees and analysts from being asked to make legal or employment judgments through a dashboard filter. The useful outcome is a trustworthy planning service whose limits remain stable even when curiosity or management pressure increases.

Preserve uncertainty in the output

Reports should distinguish observed events from inferred occupancy. Explain coverage gaps, duplicate-device risks, booking no-shows and areas that are not measured. Do not turn a partial view into a claim about productivity or individual effort. Those are different questions requiring different evidence and authority.

Requirements vary by jurisdiction and employment context, so this article is governance analysis rather than legal advice. Local review remains necessary. The objective is useful workplace intelligence with defensible limits: enough information to improve space and service decisions, without treating every available signal as permission to monitor people.

Source notes

[HONG] Tianzhen Hong and Han Li. Good practices for documenting AI-based studies on energy and buildings. Energy & Buildings / Elsevier; author copy hosted by Lawrence Berkeley National Laboratory, 2026-01-20. Sections 2, 3.1–3.6 and 4; pp. 1–4. DOI: 10.1016/j.enbuild.2026.117043. Accessed 1 September 2026. https://eta-publications.lbl.gov/sites/default/files/2026-06/1-s2.0-s0378778826001039-main.pdf [NIST] Alexander Nelson, Sanjay Rekhi, Murugiah Souppaya and Karen Scarfone. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. National Institute of Standards and Technology, 2025-04-03. Section 2; Table 2 GV.SC-05/08; Table 3 RC.RP. DOI: 10.6028/NIST.SP.800-61r3. Accessed 1 September 2026.

Editorial and visual note

This is original Osmos Global analysis informed by the cited publications. Reported findings are distinguished from Osmos recommendations and illustrative scenarios. Source findings and trademarks remain attributable to their owners. Original visual designs do not imply endorsement by source organisations. The content is general research and does not replace site-specific professional advice.