Employee Surveillance

April 03, 2025

The surveillance of employees is a controversial topic in labour law. The particular sensitivity of the issue arises from its relevance to fundamental rights and data protection.

Employees want and need to be able to rely on the protection of their privacy in their employment relationship. On the other hand, the employer has a legitimate interest in monitoring not only the employee's work performance, but also to prevent criminal offences and ensure that trade secrets are kept secret.

Permissibility of surveillance

There is no clear answer to the question of whether employee monitoring is allowed. Even more than usual, the answer depends on the overall circumstances of the individual case.

In order to standardise and ensure the protection of personal data within the European Union, the General Data Protection Regulation (GDPR) came into force in the member states on 25 May 2018 as directly applicable law.

This means that employers require a legal basis for the processing of personal data. Video recordings and recordings of conversations also constitute such personal data.

The most prominent expression of informational self-determination is the consent of the data subject, as standardised in Art. 6 I a) GDPR.

This must be given voluntarily and in an informed manner, whereby the data subject has the right to revoke it at any time, Art. 7 III GDPR. However, consent is not the only basis for permission. For the other bases for permission under Art. 6 GDPR, the condition of necessity comes into focus.

In Germany, the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) provides more specific details on the requirements of the GDPR for data processing. According to Section 26 I 1 BDSG, personal data of employees may be processed for the purposes of the employment relationship. The decisive criterion here is also the necessity of the data processing. Ultimately, it comes down to a pure decision based on consideration.

The employer must state a purpose for the surveillance measure and ensure that the data is only used for the stated purpose. This means that surveillance without cause is always impermissible. Permanent surveillance was also deemed to be fundamentally disproportionate and therefore impermissible.

However, this does not apply to the e-commerce company Amazon. This was stated by the Administrative Court of Hannover (VG), ruling of 9 February 2023 (10 A 6199/20), in a more recent decision. Amazon uses a hand scanner to process and record the performance data of its employees in the logistics centre every minute, which the Administrative Court ruled is permissible because the employees' right to privacy does not outweigh Amazon's business interests. The court thus determined that even permanent monitoring can be lawful in individual cases.

It remains to be seen what significance this ruling will have for labour court rulings. However, it is symbolic of the complexity and associated legal uncertainty of this topic.

Video surveillance

The type and location of the surveillance are crucial to answering the question of the admissibility of video surveillance. The intensity of the intrusion depends in particular on whether the surveillance has been made sufficiently clear.

Covert surveillance is particularly intrusive and can hardly be justified as an infringement of the rights of the person concerned. Only in an emergency, for example if there is a specific suspicion of a criminal offence, can hidden surveillance be exceptionally justified.

Open surveillance is surveillance in which employees are informed of the reason and location of the surveillance as early as possible.

In addition to the duration and scope, the quality of the recordings, including any zoom and panorama options, also play a role in assessing the necessity.

In rooms that are open to the public, the employer is supported by the special authorisation of Section 4 of the Bundesdatenschutzgesetz (BDSG – German Federal Data Protection Act), in particular to safeguard special interests or the right to exclude persons from property. A room is publicly accessible if, according to the recognisable intention of the authorised party, it can be entered by anyone. This includes sales rooms, museums, bank rooms or a railway platform. The necessity of purchasing a ticket does not preclude public accessibility, as long as anyone could ultimately enter the room.

In rooms that are not publicly accessible, stricter conditions apply because the group of people monitored is limited and known to the employer.

Rooms that employees use as a retreat, such as break rooms, changing rooms, kitchens or sanitary facilities, are always excluded from surveillance.

The employer can also outsource surveillance and evaluation to external service providers. The employer is then responsible for carefully selecting the service provider and monitoring its implementation.

These principles also apply to dummy cameras, since employees are already restricted by the presence of those.

Data deletion

The data obtained must then be destroyed when the purpose of the video surveillance has been achieved. According to the old legal situation, a maximum period of ten days was assumed. However, the German Federal Labour Court (BAG), ruling of 23 August 2018 (2 AZR 133/8), ruled that in the case of lawful open video surveillance, the evaluation was still permissible even after almost six months. In this case, the parties were in dispute over a termination. The employee was employed in a tobacco and magazine shop. In the third quarter of 2016, there was a shortfall in tobacco products, which the employer took as an opportunity to evaluate its video recordings, which were from an open video surveillance system for the purpose of protecting property from customers and employees. In doing so, he noticed that on two days in February, the employee did not put money into the cash register.

In its decision, the lower court, the Regional Labour Court of Hamm, judgment of 20 December 2017 (2 Sa 192/17), had assumed a further violation of the requirement of deletion and had inferred from this a prohibition of the use of evidence due to the resulting intensity of the violation of personal rights. The BAG, on the other hand, did not consider the employer to be obliged to evaluate the data immediately. The employer may store the video surveillance until it is evaluated on the basis of a legitimate reason. Even if there had been an obligation to delete the data, this could not lead to a ban on the use of evidence. The lawfully filmed perpetrator does not become worthy of protection through the mere passage of time, because ‘data protection does not protect the guilty’.

PC monitoring

Instead of monitoring the person themselves, a company can also monitor an employee's PC or other devices to check on their work ethic. Employers can use a variety of tools to do this. For example, they can install spy software or view the employee's browser history after hours. Here, too, the rule is that hidden employee monitoring is not allowed.

The employer may prohibit the use of company devices for private purposes. This must be stated in the employment contract or a service agreement. The employer may then also monitor compliance with this on a random basis. However, it depends on the exact content of the agreement. If the employee is allowed to use the company device for private matters during breaks, the secrecy of telecommunications and the resulting restrictions of the Telecommunications Act must be observed.

Wiretapping of telephone calls

The same applies to the wiretapping of telephone calls. Since telephone calls are also subject to the secrecy of telecommunications, the consent of both the employee and the conversation partner must be obtained. The tapping must serve a specific purpose, such as training purposes. In addition to the specific purpose, it must be limited in time. Private phone calls are always off limits.

Keylogger

Even if the employee has given general permission, the employer is not allowed to use every possible means. Comprehensive and permanent PC monitoring is still prohibited.

The German BAG ruled that in its judgment of 27 July 2017 (16 Sa 1711/15), that the use of keyloggers – software that logs all keyboard entries and regularly takes screenshots – was not permitted in the case in question because there was no specific suspicion of a criminal offence or other serious breach of duty and the employee was not even informed.

Recording working hours

Since a decision by the BAG, judgment of 13 September 2022 (1 ABR 22/21), recording working hours has been mandatory in Germany. However, this obligation only serves to determine working hours. Thus, the principles of data protection must also be observed when recording working hours.

Private devices

Employees‘ personal devices are beyond the employer's control. However, the employer can define rules for handling them or even issue a general ban on their use at work. However, this may not, in principle, apply to lunch breaks.

Monitoring employees’ social media profiles is generally not permitted, as otherwise there would be constant pressure to monitor employees' private lives.

Tracking

Global Positioning System (GPS) can also be used as a monitoring system due to the possibility of checking the routes travelled. The link between persons and locations is personal data, so that the data protection principles also apply here. As long as there is a connection under labour law, tracking is generally permitted. However, tracking must not encroach on the private sphere. Tracking must be discontinued during breaks or after work.

Consequences of unauthorised surveillance

If surveillance is unlawful, various claims may arise for the employee concerned. Initially, claims for defence or removal can be asserted. In addition, claims for damages may be considered.

If the employer violates employee data protection, they may face fines and, if they intend to cause harm or enrichment, a prison sentence of up to two years in accordance with § 42 II BDSG. Unauthorised recording of audio tracks may constitute a violation of the confidentiality of the spoken word according to § 201 of the German Criminal Code (StGB), which can lead to a prison sentence of up to three years. Furthermore, the data obtained cannot usually be used in legal proceedings, such as a dismissal based on the findings.

Conclusion

The surveillance of employees is only permissible within strict legal limits. Even if it is not possible, due to the nature of the matter, to establish clear guidelines for admissibility, there are nevertheless principles that an employer can follow. Transparency, in the sense of providing clear and comprehensive information to employees.

Data minimisation, in which only data required for a specific purpose is collected and processed and this data is then immediately deleted.

Purpose specification, in which a specific purpose is defined and logged in advance.

*If, for better readability, we use only the generic feminine or the generic masculine in the future, this explicitly includes all genders.