I think that's the whole point of the privacy impact assessment. What information are you trying to get? Let's talk about the time theft. Let's talk about whether people are at the workplace. Can we obtain that information through other means, other than going invasively through a device?
That would be why the assessment exists, and it should be the primary focus of getting the data in a less intrusive manner.