Privacy and personnel precisely managed: workplace monitoring

Employee monitoring — camera, email, GPS, screen monitoring — must comply with the GDPR (proportional, transparent, with a legal basis) and the Works Councils Act (Works Council consent for those over 50). Insufficient regulation results in a Data Protection Authority fine of up to 4% of global turnover plus employment law proceedings. For SMEs, it is a matter of striking a balance between employer interests (productivity, safety, fraud prevention) and employee privacy. Below are the rules and how Tessa manages monitoring in her warehouse.

The short answer

• GDPR requirements: lawful basis, transparency, proportionality, purpose limitation.
• Works Council consent: for 50+ employees via Art. 27 WOR.
• Inform employees: in advance, in writing, clearly.
• Employee privacy rights: access, rectification, objection.
• Sanctions: Data Protection Authority fine + employment law proceedings.

Types of monitoring

1. Camera surveillance

• Public space (shop, warehouse): often permitted for safety/theft prevention.
• Individual employee workplace: carefully considered, often not permitted.
• Changing rooms, toilets: never allowed.

2. Email and the internet

• General log files: permitted for security/audit.
• Content access to individual email: only in case of concrete suspicion, with procedure.
• Automated scanning (DLP, security): permitted on good grounds.

3. GPS tracking of commercial vehicles

• During work: permitted for route optimization, customer visits.
• Outside work: not permitted without a compelling reason.
• Access to historical data: limited to purpose.

4. Screen monitoring (productivity tools)

• Increasingly common when working from home.
• Often worth considering for SMEs — privacy impact significant.
• Employee information and Works Council consent are crucial.

GDPR requirements

1. Lawful basis

• Legitimate interest: for security, productivity (after balancing of interests).
• Consent: rarely applicable (power imbalance).
• Contract: for specific positions where monitoring is essential.
• Legal obligation: e.g. obligation to retain records.

2. Proportionality

• Monitoring must be proportionate to the objective.
• Choose the least invasive measure.
• Collect no more data than necessary.

3. Transparency

• Inform employees in advance: what, why, and how long it will be kept.
• Privacy statement update for monitoring.
• Inform the Works Council upon implementation.

4. Purpose limitation

• Use data only for the stated purpose.
• Not for other purposes (e.g. assessment) without new substantiation.

Works Council consent (Art. 27 Works Councils Act)

For 50+ employees: the Works Council has the right of consent regarding the introduction of monitoring rules. Procedure:

1. Submit the proposed decision to the Works Council.
2. OR has 4 weeks to respond.
3. Upon approval: implementation possible.
4. In case of refusal: the director may request substitute consent from the subdistrict court judge.

No Works Council: direct agreement with employees via communication.

Tessa's warehouse monitoring

Tessa has 12 employees — no Works Council, but monitoring:

• Cameras in warehouse (anti-theft): permitted, employees informed in advance.
• No cameras in the canteen, break room, or changing room.
• Email log files: only technical metadata.
• Content review of email: only in case of suspected concrete irregularity, following a management decision.
• Privacy statement contains monitoring information.

Tessa documents the decision and informs new employees during onboarding.

Sanctions for violation

• AP fine: up to 4% of global turnover or €20 million.
• Compensation: by the injured employee.
• Employment law: the employee can demand dissolution.
• Exclusion of evidence: unlawfully obtained evidence (e.g. camera footage) is not admissible in the proceedings.

Honest recommendation

For SME limited liability companies: minimize monitoring to what is strictly necessary. Inform employees clearly in advance. Document considerations and the decision. For structural monitoring: GDPR impact assessment and (for 50+ employees) Works Council consent. Combine with a good privacy statement and HR policy. In case of doubt: consult a GDPR lawyer (€500-€2,500) to draft the policy — this prevents fines and employment law issues.

For other topics: privacy statement, data breach and works council.

Frequently Asked Questions