Reading email, logging internet use, installing cameras, tracking the company car: employers have legitimate reasons to monitor, yet an employee retains a measure of privacy at the workplace as well.
Legal basis
There is no dedicated statute on staff monitoring. The legal basis is usually the legitimate interest in Article 6(1)(f) GDPR; consent from an employee rarely suffices, because it is not freely given in a relationship of authority. The interest must be weighed against the employee’s privacy, with necessity, proportionality and subsidiarity as the yardsticks. Article 8 of the European Convention on Human Rights applies within the employment relationship; in Bărbulescu the European Court of Human Rights set out what an employer must tell staff in advance. Article 27(1) of the Works Councils Act requires the works council’s consent for arrangements concerning systems that monitor personnel. Covert camera surveillance is a criminal offence unless the presence of cameras has been announced in general terms beforehand.
How it works in practice
The workable sequence is: record why you are monitoring, choose the least intrusive means, inform staff through a protocol, obtain the works council’s consent, and carry out a data protection impact assessment where the monitoring is structural. Targeted checks on a concrete suspicion of wrongdoing may go further than permanent observation, provided they stay limited in time and scope.
Where it goes wrong
Three points recur. First, the missing protocol, which leaves the evidence exposed in a later dismissal case. Second, the forgotten works council consent, which makes the arrangement vulnerable. Third, monitoring that starts with one employee and quietly grows into permanent surveillance of a whole department.
Related terms
Monitoring of employees connects to the data protection impact assessment, to retention periods and to data subject rights.
Want a monitoring protocol that holds up? Our IT lawyers draft it and align it with the works council.
