The Person Who Was Flagged Twice
A second alert about somebody already cleared is the point at which a programme either demonstrates its fairness or quietly abandons it.
The editors · About the editorial position · Nothing found · Analysis
Somebody examined last year and cleared appears again. The instinct is that two alerts mean something. Usually they do not, and acting on the instinct is how innocent people end up with a history.
The distinction made in “The Person Who Was Flagged Twice” should also shape any workforce technology used near an investigation. When reviewers consult the provider's detailed page for gdpr employee monitoring, its records can provide operational context, but a signal still needs validation, a stated threshold and a human decision before it becomes a finding.
Why repeat alerts happen to innocent people
Their role generates the pattern: broad access, high volume, unusual hours, cross-team work. The same characteristics that triggered the first will trigger the second.
For a separate perspective relevant to “The Person Who Was Flagged Twice”, consult the ICO employment-practices guidance. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.
Their team works around the same broken process, which the process-failure note covers, and the workaround recurs monthly.
Or the rule is simply noisy and they happen to sit in its path.
In each case the second alert carries no more information than the first, and treating two as more significant than one is an error about what the alerts measure.
The inference to resist
That the first enquiry missed something.
It might have. Much more often the first enquiry was right and the detection is repeating itself, which the base rate makes overwhelmingly more likely.
Opening a broader enquiry on the strength of repetition, without any new substance, is how a cleared person becomes a long-term subject.
What the second alert should trigger
A check of the first case file, which is why the recording note argues for keeping closed cases.
If the second alert has the same cause as the first, it closes immediately with a reference to the earlier conclusion. Ten minutes.
If it is materially different, it is assessed on its own merits at the ordinary threshold — not at a lower one because there is history.
Where the history legitimately matters
Where the first case found something, even something minor that was dealt with informally.
Where the second alert is of the same specific kind and the first conclusion depended on an explanation that the second contradicts.
Both are narrow and both should be stated explicitly in the opening record rather than operating as a general lowering of the bar.
The pattern worth investigating instead
If one person generates repeated alerts and nothing is ever found, the question is about the detection or about their working arrangements, not about them.
That is a genuinely useful finding: a rule that fires repeatedly on the same innocent pattern should be tuned, and a role that structurally looks suspicious should be understood so that it stops producing noise.
Several programmes have resolved a long-running source of alerts this way, and the person concerned usually appreciates it considerably.
What the person should be told
If they knew about the first and the second closes quickly, tell them that too, briefly.
The alternative is somebody who knows they have been looked at twice and has heard about the conclusion once.
Reading the earlier file first
Ten minutes with the previous closure resolves most repeat alerts immediately. It requires that the earlier closure was written down, which is the argument the recording note makes and the reason it matters beyond administrative tidiness.
When the pattern is the finding
Repeated alerts about one person with nothing ever found point at the rule or at how their role is configured. Resolving that is a genuine improvement, it ends a recurring intrusion into somebody's working life, and the person concerned usually appreciates it considerably more than the programme expects.
Ten minutes with the earlier file
Most repeat alerts resolve there. It requires that the earlier closure was written down, which is why the recording of no-action decisions matters well beyond administrative tidiness.
Starting from the ordinary threshold
A second alert is assessed on its own merits, not at a lower bar because there is history. Where the history legitimately matters it is narrow and should be stated explicitly in the opening record rather than operating as a general lowering.
For the file: Before opening anything on a repeat alert, read the earlier closure and record whether the cause is the same. If it is, the case is the rule, not the person.