Login monitoring and summary dismissal: what the GDPR allows employers

An employer may not build a summary dismissal on the covert analysis of an employee’s login and logout data. On 7 July 2026 the subdistrict court (kantonrechter) in The Hague set aside such a dismissal, holding that the employer had no adequate legal basis under the GDPR, that the monitoring was neither proportionate nor the least intrusive means available, and that absence from the company network does not prove that no work was done. Monitoring is not forbidden as such: it can be lawful where the employer has a concrete reason, has informed employees in advance and chooses the least intrusive means.

The judgment is Rechtbank Den Haag 7 July 2026, ECLI:NL:RBDHA:2026:18633. An employer who suspects that an employee is structurally working fewer hours than agreed must act carefully: the suspicion has to be concrete before any monitoring starts, the employee has to know in advance that this kind of data may be checked, and even a genuine discrepancy in the data is rarely enough on its own to carry the heaviest sanction in Dutch employment law.

What happened in this case?

The employee had been employed since 2022 by EControls Europe B.V., a technology company based in Delfgauw, most recently in a management role in finance and IT. In the summer of 2025 his partner fell seriously ill. With management’s agreement he subsequently worked from home more often, partly in order to care for his young children. His performance was assessed positively during staff appraisals, and at the beginning of 2026 he even received a pay rise.

Later, the employer began to doubt his commitment. The trigger was two routine reminder letters, one from the accountant and one from Statistics Netherlands (CBS), concerning outstanding administrative obligations. Without first asking the employee for an explanation, the employer analysed the login and logout data for the period from 20 January to 20 February 2026 of his user account on the company network. On this basis the employer put the shortfall at some 29 hours over a period of four and a half weeks, and dismissed him summarily on 23 February 2026 for structural hour shortfalls and for not being open about them. The court, working through the same data, arrived at a difference of about 27 hours over that period, or a little over an hour per working day.

Why was there no valid GDPR basis?

By analysing the login and logout data, the employer was processing the employee’s personal data. Such processing requires a legal basis under the GDPR. In an employment relationship, reliance on legitimate interest is the obvious option, but this requires more than a mere wish on the employer’s part to exercise supervision. The employer must be able to demonstrate a concrete and current interest, that the processing is necessary to serve that interest, and that the employee’s interests and fundamental rights do not outweigh it.

Monitoring compliance with employment arrangements can in principle constitute a legitimate employer interest. In this case, however, the two reminder letters were insufficient for that purpose. They did not point to any hour shortfall and still gave the employee the opportunity to fulfil his administrative obligations. There was thus no sufficiently concrete basis for the processing: it was not a matter of an established fact or a specifically substantiated suspicion, but an indirect indication that was translated, without any conversation with the employee, into a covert investigation.

In addition, the employee did not know that his login and logout data could be used for this kind of check. The homeworking policy, which had only recently been established, provided no clear basis for this either. Employees must be able to understand what data is being collected, for what purpose, and under what circumstances they may be monitored. The fact that working from home was expressly permitted, partly because of the employee’s personal circumstances, makes the lack of transparency all the more significant: it was precisely in that context that the employer should have made clear in advance what was expected in terms of working hours, availability, and any registration of time.

Why was the monitoring disproportionate?

Even had the employer had a legitimate interest, the monitoring would still have had to be proportionate: the seriousness and scope of the intrusion into the employee’s privacy must be in proportion to the reason for, and purpose of, the investigation. That proportionality was lacking here. The employer analysed the data of a single employee for around a month, without informing him in advance or first asking for an explanation, while there was only a limited and indirect reason to do so.

The employer should also have assessed whether the same objective could have been achieved by less intrusive means – the so-called subsidiarity test. During the hearing, the manager stated that a conversation with the employee had deliberately been avoided, because the employer feared he would adjust his behaviour once he became aware of the investigation. The subdistrict court did not find this a convincing reason. Adjusting potentially improper conduct is precisely the outcome an employer should want to achieve through a conversation, a warning, or an improvement plan. By deliberately forgoing this and opting immediately for covert monitoring, the employer used too drastic a measure without first trying the less intrusive alternatives.

Do login data prove that someone did not work?

On the merits too, the subdistrict court found the data insufficiently convincing. Not being logged into the company network does not automatically mean that someone is not working. The employee’s role also involved analysis, planning, consultation, supervision and telephone contact – activities that do not necessarily require an active network connection. Login and logout data record system activity, not the full scope of someone’s work performance.

The subdistrict court considered it possible that working offline explained part of that difference of roughly 27 hours, though not all of it. Even so, an average of just over an hour per working day was insufficient to conclude that structurally and significantly fewer hours had been worked than agreed. At most, the data amounted to an indication, not conclusive evidence of serious misconduct or intentional deception.

How does the GDPR breach affect the dismissal?

The unlawfulness of the data processing does not automatically mean that any use of that data in the dismissal proceedings was excluded, but it did seriously undermine the reliability and persuasiveness of the investigation. The employer based the dismissal to a significant extent on data that had been collected without clear prior information, analysed without a concrete reason specifically related to hour shortfalls, obtained through an excessively intrusive means of control, and which gave only a limited picture of the actual work performed. Without further investigation, without the employee being heard, and without concrete examples of work not carried out, no urgent cause for dismissal could be derived from this. The GDPR violation was therefore not a separate privacy issue, but part of the inadequate preparation and substantiation of the summary dismissal.

How does this ruling fit earlier case law?

The subdistrict court in The Hague is not alone in this. As early as 2017, the European Court of Human Rights (ECtHR) formulated, in the widely discussed case of Bărbulescu v. Romania (ECtHR 5 September 2017, no. 61496/08), an assessment framework for employer monitoring that continues to influence Dutch case law. The ECtHR held that, when assessing digital monitoring of employees, regard should be had to, among other things: whether the employee had been informed in advance of the possibility of monitoring, how extensive and intrusive the monitoring had been, whether the employer had a legitimate reason for the monitoring, whether less intrusive methods were available, what consequences the monitoring had for the employee, and whether adequate safeguards had been provided.

This assessment framework recurs, for example, in a 2021 ruling of the Central Netherlands District Court (ECLI:NL:RBMNE:2021:6071). In that case, an employer monitored an employee’s email use following two internal signals, without it being clear how intrusive this monitoring had been or whether the employee had been informed in advance of the possibility of monitoring. Because the employer failed to provide sufficient transparency about this, the subdistrict court was unable to establish whether the Bărbulescu criteria had been met, nor whether the investigation’s findings were independent of any unlawful monitoring. The request for dissolution of the employment contract already foundered on this lack of clarity.

That digital monitoring is not inherently unlawful is shown by a more recent ruling of the North Holland District Court of 12 December 2025 (ECLI:NL:RBNHO:2025:14471). In that case, an employer launched an IT investigation into an employee after he had threatened to leak company data externally and a colleague had reported possible IT misuse. The subdistrict court ruled that this was not an untargeted fishing expedition, but an investigation with a concrete and current basis, so that the findings could indeed be relied upon to justify the summary dismissal.

Finally, for the purposes of evidence in dismissal cases, it is relevant that the Supreme Court, on 13 March 2026 (ECLI:NL:HR:2026:409), emphasised that a court basing its ruling on a summary dismissal partly on digital evidence, such as camera footage, must ensure that the employee has genuinely been able to view that material and comment on it. If this does not happen, the right to be heard (hoor en wederhoor) and equality of arms are violated under Article 19(1) of the Dutch Code of Civil Procedure and Article 6 ECHR. This line of reasoning is equally relevant where an employer, as in the EControls case, bases a dismissal on login and logout data: here too, the employee must be given a genuine opportunity to view and challenge that evidence before a court bases a decision on it.

Why was there no urgent cause for summary dismissal?

A valid summary dismissal requires an urgent cause within the meaning of Article 7:677(1) and Article 7:678(1) of the Dutch Civil Code. Such cause must be accepted with great restraint and must be based on provable facts; the burden of assertion and proof lies with the employer. In this case, there was an insufficient factual basis for this. The employer had not first asked the employee for an explanation, had relied on covertly collected data, had failed to adequately take into account work carried out outside the company network, had given no prior warning or opportunity to improve, and had given insufficient weight to the employee’s personal circumstances. The subdistrict court therefore ruled that the summary dismissal was not justified, and that the employer should first have used less intrusive measures.

What did the employer have to pay?

Because the dismissal had not been validly given, the employer was ordered to pay several forms of compensation: fair compensation (billijke vergoeding) of €60,000 gross, compensation for irregular termination of €11,544.34 gross, and the statutory transition payment (transitievergoeding). The claimed fair compensation was €90,000. In determining the amount of the fair compensation, the subdistrict court took into account that the employee had been confronted, from one day to the next, with the most severe sanction available under employment law, while he had been performing well and the employer had not followed a careful preliminary process. The set-offs the employer had applied against the fixed statutory compensation were also reversed.

What should you check as an employer?

Covert monitoring is only defensible where it meets the principles of Article 5 GDPR, such as lawfulness, transparency and data minimisation, and rests on a legal basis under Article 6 GDPR. Article 88 GDPR allows more specific rules for the employment relationship, but it is no blank cheque; the same framework applies to camera surveillance at work.

• Record in your homeworking policy what is expected on working hours, availability, output and time registration.
• Tell employees in advance which digital data you collect, for what purpose and when it may be checked.
• Ask the works council for consent before introducing a monitoring system or a rule on personal data processing (Article 27(1) of the Works Councils Act, WOR); without consent you need permission from the subdistrict court (kantonrechter).
• If you doubt an employee’s hours, talk to the employee first and consider time registration, a warning or an improvement plan.
• Do not treat login and logout times as proof of hours worked; use them only as part of a careful investigation.
• Give a summary dismissal only on proven facts, immediately and with the reason stated, as Article 7:677(1) BW requires.

What should you check as an employee?

If you have been dismissed summarily, you have two months to ask the subdistrict court to set the dismissal aside or to award compensation. Act quickly and collect evidence of the work you actually did.

• Check whether your employer’s policy told you in advance that login data or other digital data could be monitored.
• Ask in writing for the data and the analysis on which the dismissal is based; under Article 15 GDPR you have a right of access to your personal data.
• Collect evidence of offline work: calls, meetings, documents, planning and supervision.
• Note the date of the dismissal and the reason given, and diarise the two-month deadline.
• Check whether your employer offset amounts against your final pay; in this case the court reversed such deductions.

What can we do for you with a summary dismissal based on monitoring?

Our dismissal lawyers act for employees and employers in disputes about digital monitoring and summary dismissal.

• We review the dismissal letter, the monitoring policy and the data used.
• We file the petition with the subdistrict court within the two-month deadline.
• We calculate the transition payment, the compensation for irregular termination and a claim for fair compensation.
• We assess a monitoring tool or homeworking policy against the GDPR and the works council’s right of consent before you introduce it.
• We prepare the conversation with the employee and the written warning or improvement plan.

Summary

• On 7 July 2026 the subdistrict court in The Hague set aside a summary dismissal based on covert analysis of login data (ECLI:NL:RBDHA:2026:18633).
• Monitoring needs a concrete reason, prior information to the employee and the least intrusive means; two routine reminder letters were not enough.
• Not being logged in does not prove that someone did not work.
• The employer had to pay €60,000 gross fair compensation, compensation for irregular termination and the transition payment.
• Monitoring can be lawful, as a December 2025 ruling of the North Holland District Court shows, where the trigger is concrete and serious.

Frequently asked questions