The Hague District Court, 7 July 2026, ECLI:NL:RBDHA:2026:18633, case number 12156440 \ RP VERZ 26-50366.
An employer who suspects that an employee is structurally working fewer hours than agreed must act carefully. Covertly analysing login and logout data is not automatically permitted, and even where such data reveals discrepancies, this does not automatically amount to sufficient evidence for summary dismissal. On 7 July 2026, the cantonal court in The Hague ruled on this issue in a judgment that is relevant for every employer considering the use of digital monitoring tools.
The facts
The employee had been employed since 2022 by EControls Europe B.V., a technology company based in Delfgauw, most recently in a managerial role within the finance department. In the summer of 2025, the employee’s partner underwent treatment for breast cancer. With management’s agreement, the employee subsequently worked from home more often, partly in order to care for their two young children. His performance was assessed positively during staff appraisals, and at the beginning of 2026 he even received a pay rise.
Later, the employer began to doubt his commitment. The trigger was two routine reminder letters, one from the accountant and one from Statistics Netherlands (CBS), concerning outstanding administrative obligations. Without first asking the employee for an explanation, the employer spent around a month analysing the login and logout data of his user account on the company network. On this basis, the employer concluded that the employee had worked 29 hours fewer than agreed, and he was summarily dismissed for alleged structural hour shortfalls and for not being honest with the employer about this.
No adequate GDPR basis
By analysing the login and logout data, the employer was processing the employee’s personal data. Such processing requires a legal basis under the GDPR. In an employment relationship, reliance on legitimate interest is the obvious option, but this requires more than a mere wish on the employer’s part to exercise supervision. The employer must be able to demonstrate a concrete and current interest, that the processing is necessary to serve that interest, and that the employee’s interests and fundamental rights do not outweigh it.
Monitoring compliance with employment arrangements can in principle constitute a legitimate employer interest. In this case, however, the two reminder letters were insufficient for that purpose. They did not point to any hour shortfall and still gave the employee the opportunity to fulfil his administrative obligations. There was thus no sufficiently concrete basis for the processing: it was not a matter of an established fact or a specifically substantiated suspicion, but an indirect indication that was translated, without any conversation with the employee, into a covert investigation.
In addition, the employee did not know that his login and logout data could be used for this kind of check. The homeworking policy, which had only recently been established, provided no clear basis for this either. Employees must be able to understand what data is being collected, for what purpose, and under what circumstances they may be monitored. The fact that working from home was expressly permitted, partly because of the employee’s personal circumstances, makes the lack of transparency all the more significant: it was precisely in that context that the employer should have made clear in advance what was expected in terms of working hours, availability, and any registration of time.
The monitoring was neither proportionate nor subsidiary
Even had the employer had a legitimate interest, the monitoring would still have had to be proportionate: the seriousness and scope of the intrusion into the employee’s privacy must be in proportion to the reason for, and purpose of, the investigation. That proportionality was lacking here. The employer analysed the data of a single employee for around a month, without informing him in advance or first asking for an explanation, while there was only a limited and indirect reason to do so. Moreover, the employee was performing well, had recently received a pay rise, and working from home had been permitted with management’s agreement.
The employer should also have assessed whether the same objective could have been achieved by less intrusive means – the so-called subsidiarity test. During the hearing, the manager stated that a conversation with the employee had deliberately been avoided, because the employer feared he would adjust his behaviour once he became aware of the investigation. The cantonal court did not find this a convincing reason. Adjusting potentially improper conduct is precisely the outcome an employer should want to achieve through a conversation, a warning, or an improvement plan. By deliberately forgoing this and opting immediately for covert monitoring, the employer used too drastic a measure without first trying the less intrusive alternatives.
Login and logout data do not automatically prove that someone has not worked
On the merits too, the cantonal court found the data insufficiently convincing. Not being logged into the company network does not automatically mean that someone is not working. The employee’s role also involved analysis, planning, consultation, supervision and telephone contact – activities that do not necessarily require an active network connection. Login and logout data record system activity, not the full scope of someone’s work performance.
The cantonal court considered it possible that working offline explained part of the difference, but not the entire difference of 27 hours over a period of 4.5 weeks. Even so, the average difference of just over an hour per working day was insufficient to conclude that structurally, significantly fewer hours had been worked than agreed. At most, the data amounted to an indication, not conclusive evidence of serious misconduct or intentional deception.
The GDPR violation and the dismissal are not separate matters
The unlawfulness of the data processing does not automatically mean that any use of that data in the dismissal proceedings was excluded, but it did seriously undermine the reliability and persuasiveness of the investigation. The employer based the dismissal to a significant extent on data that had been collected without clear prior information, analysed without a concrete reason specifically related to hour shortfalls, obtained through an excessively intrusive means of control, and which gave only a limited picture of the actual work performed. Without further investigation, without the employee being heard, and without concrete examples of work not carried out, no urgent cause for dismissal could be derived from this. The GDPR violation was therefore not a separate privacy issue, but part of the inadequate preparation and substantiation of the summary dismissal.
This ruling fits a consistent line of case law
The cantonal court in The Hague is not alone in this. As early as 2017, the European Court of Human Rights (ECtHR) formulated, in the widely discussed case of Bărbulescu v. Romania (ECtHR 5 September 2017, no. 61496/08), an assessment framework for employer monitoring that continues to influence Dutch case law. The ECtHR held that, when assessing digital monitoring of employees, regard should be had to, among other things: whether the employee had been informed in advance of the possibility of monitoring, how extensive and intrusive the monitoring had been, whether the employer had a legitimate reason for the monitoring, whether less intrusive methods were available, what consequences the monitoring had for the employee, and whether adequate safeguards had been provided.
This assessment framework recurs, for example, in a 2021 ruling of the Central Netherlands District Court (ECLI:NL:RBMNE:2021:6071). In that case, an employer monitored an employee’s email use following two internal signals, without it being clear how intrusive this monitoring had been or whether the employee had been informed in advance of the possibility of monitoring. Because the employer failed to provide sufficient transparency about this, the cantonal court was unable to establish whether the Bărbulescu criteria had been met, nor whether the investigation’s findings were independent of any unlawful monitoring. The request for dissolution of the employment contract already foundered on this lack of clarity. The same problem arises in the EControls case: there too, transparency about the monitoring policy was lacking, and the employer was unable to show that the monitoring was proportionate and linked to a concrete reason.
That digital monitoring is not inherently unlawful is shown by a more recent ruling of the North Holland District Court of 12 December 2025 (ECLI:NL:RBNHO:2025:14471). In that case, an employer launched an IT investigation into an employee after he had threatened to leak company data externally and a colleague had reported possible IT misuse. The cantonal court ruled that this was not an untargeted fishing expedition, but an investigation with a concrete and current basis, so that the findings could indeed be relied upon to justify the summary dismissal. The contrast with the EControls case is illustrative: whereas in The Hague only two routine reminder letters formed the basis, in the North Holland case there were concrete, current and serious signals originating directly from the employee himself and from a colleague.
Finally, for the purposes of evidence in dismissal cases, it is relevant that the Supreme Court, on 13 March 2026 (ECLI:NL:HR:2026:409), emphasised that a court basing its ruling on a summary dismissal partly on digital evidence, such as camera footage, must ensure that the employee has genuinely been able to view that material and comment on it. If this does not happen, there is a violation of the principle of audi alteram partem and equality of arms under Article 19(1) of the Dutch Code of Civil Procedure and Article 6 ECHR. This line of reasoning is equally relevant where an employer, as in the EControls case, bases a dismissal on login and logout data: here too, the employee must be given a genuine opportunity to view and challenge that evidence before a court bases a decision on it.
No urgent cause for summary dismissal
A valid summary dismissal requires an urgent cause within the meaning of Article 7:677(1) and Article 7:678(1) of the Dutch Civil Code. Such cause must be accepted with great restraint and must be based on provable facts; the burden of assertion and proof lies with the employer. In this case, there was an insufficient factual basis for this. The employer had not first asked the employee for an explanation, had relied on covertly collected data, had failed to adequately take into account work carried out outside the company network, had given no prior warning or opportunity to improve, and had given insufficient weight to the employee’s personal circumstances. The cantonal court therefore ruled that the summary dismissal was not justified, and that the employer should first have used less intrusive measures.
Financial consequences for the employer
Because the dismissal had not been validly given, the employer was ordered to pay several forms of compensation: the statutory transition payment, compensation for irregular termination, and fair compensation (billijke vergoeding) of 60,000 euros gross, corresponding to around six months’ salary. In determining the amount of the fair compensation, the cantonal court took into account that the employee had been confronted, from one day to the next, with the most severe sanction available under employment law, while he had been performing well and the employer had not followed a careful preliminary process. The set-offs the employer had applied against the fixed statutory compensation were also reversed.
Practical lessons for HR and management
This ruling offers a number of clear lessons for practice. When allowing employees to work from home, make clear arrangements in advance about working hours, availability, output and any hour registration, and record transparently what digital data is collected, for what purpose, and when it may be checked. Do not use system data such as login and logout times as an automatic yardstick for presence or performance, but only as part of a careful investigation. If there is doubt about an employee’s commitment, HR should first have a conversation, ask the employee for an explanation, and consider less intrusive measures, such as temporary time registration, a warning, or an improvement plan. Assess any intended form of monitoring in advance against the requirements of legal basis, necessity, proportionality and subsidiarity. Only once concrete signals persist after the employee has been heard can a disciplinary measure – let alone summary dismissal – be considered.
For arrangements concerning the processing of personal data, and for facilities aimed at monitoring employees’ presence, conduct or performance, the works council’s right of consent under Article 27(1) of the Dutch Works Councils Act (WOR) additionally applies. An employer wishing to introduce such an arrangement or monitoring system would do well to assess in advance whether works council consent is required, and, if necessary, to obtain that consent or substitute permission from the cantonal court before applying the measure.
What this means in practice
Covert monitoring of employees is only defensible where it complies with the principles of Article 5 GDPR, including lawfulness, transparency, purpose limitation and data minimisation, and rests on a valid legal basis as referred to in Article 6 GDPR. Article 88 GDPR allows scope for more specific rules on data processing in the employment relationship, but does not in itself provide a blank cheque for covert monitoring. The monitoring must also be necessary and proportionate, and less intrusive means must first have been considered. Data collected unlawfully, or used for a different purpose than intended, can seriously undermine the basis for an employment-law sanction – certainly a summary dismissal – and lead to significant privacy and employment-law risks.
The key lesson from this case is not that digital monitoring is never permitted, but that it is only defensible where the employer can identify a concrete interest, chooses the least intrusive method, and informs the employee transparently about it in advance. In this case, the employer failed on all three counts: the trigger was insufficiently concrete, the monitoring was too intrusive, and less far-reaching alternatives had not been used.
Frequently asked questions
May an employer simply check an employee’s login and logout data?
No. An employer may only process this type of personal data if there is a legitimate interest within the meaning of the GDPR, and if the intrusion into the employee’s privacy is proportionate and necessary. In addition, the employee must in principle know in advance that such monitoring may take place, for example through a clearly communicated policy. Where this is lacking, the investigation quickly becomes unlawful, as in this case.
What is the difference between not being logged in and not working?
Not being logged into the company network does not automatically mean that an employee has not worked. Many roles also involve tasks that do not require a computer connection, such as consultation, analysis or supervision. The cantonal court emphasises that login and logout data can at most provide an indication, but do not in themselves constitute sufficient evidence of structural hour shortfalls.
Can an employer base a summary dismissal on a suspicion?
No. A valid summary dismissal requires an urgent cause, which must be asserted and proven by the employer. The court applies great restraint in assessing this. A suspicion, based on incomplete or unlawfully obtained evidence, is not sufficient. Moreover, the employer must first consider lighter measures, such as a conversation, a warning or an improvement plan, before opting for the most severe sanction employment law has to offer.
What compensation can an employee receive after an unjustified summary dismissal?
If the summary dismissal turns out not to have been validly given, the employee can claim a transition payment, compensation for irregular termination equal to the salary over the notice period, and fair compensation. The amount of the fair compensation depends on all the circumstances of the case, including the degree of culpability on the employer’s part and the consequences of the dismissal for the employee.
May an employer subject homeworking to extra monitoring?
Not without more. If working from home is permitted, that does not automatically mean the employer may carry out additional or covert monitoring. Arrangements about working hours, availability, output and any registration should preferably be clearly recorded in advance and discussed with employees. Additional monitoring must also have a concrete trigger and may not go further than necessary.
What should an employer do instead if there are doubts about hours worked?
The court explicitly mentions less intrusive alternatives, such as having a conversation, keeping track of hours worked, issuing a warning, or starting an improvement plan. Only once these steps fail to yield sufficient results, and there are concrete, substantiated signals, can further-reaching monitoring be considered, in compliance with the requirements of the GDPR.
Is every form of digital monitoring of an employee unlawful?
No. Digital monitoring can be justified where an employer can demonstrate that there was a concrete and current trigger, such as concrete threats or an internal report of misuse, and that it acted in accordance with the principles of proportionality and subsidiarity. This is illustrated, for example, by a ruling of the North Holland District Court of 12 December 2025 (ECLI:NL:RBNHO:2025:14471), in which an IT investigation triggered by concrete threats and an internal report was found to be lawful, and its findings were allowed to form the basis for a summary dismissal.
Conclusion
This ruling makes clear that digital monitoring data cannot simply be used as evidence of hour shortfalls. An employer who monitors covertly, without a clear trigger or prior information, runs the risk that both the investigation and the dismissal based on it will not hold up. The safe route is therefore: investigate the signals carefully, have a conversation first, and only then, if truly necessary, opt for an appropriate and proportionate monitoring measure.
