The GDPR and the UK GDPR allow employee monitoring only when the employer has a lawful basis, tells workers clearly what is monitored and why, and uses the least intrusive method that achieves the purpose. Consent is rarely a valid basis in employment. Monitoring that is likely to create a high risk needs a data protection impact assessment before it starts.
Key takeaways
- Legitimate interests is the usual lawful basis, and it requires a documented balancing test.
- Workers must be told about monitoring in plain language before it begins.
- A data protection impact assessment is expected for systematic monitoring.
- Regulators have fined employers for counting inactivity, capturing screens constantly and monitoring in secret.
Is employee monitoring allowed under GDPR?
Yes, with conditions. Monitoring data is personal data, so every GDPR principle applies: lawfulness, fairness and transparency, purpose limitation, data minimization, storage limitation and security. The employer is the controller and carries the burden of showing that each one is met.
What lawful basis can employers use?
Legitimate interests is the most common basis. It requires three things: a real purpose, monitoring that is necessary for that purpose, and a balance that does not override the worker's rights. Write the assessment down.
Legal obligation or contract can cover narrow needs, such as recording working time where national law requires it.
Consent rarely works. The EU's data protection authorities said in Opinion 2/2017 on data processing at work that, because of the imbalance between employer and employee, consent will not be a sound basis for most processing at work.
Special category data, such as health details or biometrics, needs an extra legal condition and should be kept out of monitoring wherever possible.
What do regulators expect?
The UK Information Commissioner's Office published guidance on monitoring workers in October 2023. Its core expectations are a useful checklist anywhere in Europe:
- make workers aware of the nature, extent and reasons for monitoring
- have a clearly defined purpose and use the least intrusive means to achieve it
- have a lawful basis
- tell workers in a way that is easy to understand
- keep only what is relevant to the purpose
- carry out a data protection impact assessment where monitoring is likely to create a high risk
Research commissioned by the ICO for that guidance found that 70% of people would find monitoring by an employer intrusive, and fewer than one in five would feel comfortable taking a job where they knew they would be monitored.
Courts apply similar tests. In Bărbulescu v. Romania in 2017, the European Court of Human Rights set out the factors that decide whether monitoring is proportionate: whether the employee was told in advance, how far the monitoring went, whether the employer had legitimate reasons, whether a less intrusive method was available, and what safeguards were in place.
When is a data protection impact assessment required?
Article 35 of the GDPR requires an assessment when processing is likely to result in a high risk to people's rights. Systematic monitoring of employees usually meets that test, because employees are in a weaker position than their employer.
A DPIA describes the monitoring, explains why it is necessary, identifies the risks to workers and records the measures that reduce them. Do it before the software is installed, not after.
What do national rules add?
Article 88 lets each country set more specific rules for employment. Two examples:
Germany
The works council has a right of co-determination over technical systems that can monitor behavior or performance.
France
Employees must be informed before any monitoring system is used, and the social and economic committee must be consulted.
Check the rules for every country where you have staff.
What fines have regulators issued?
| Year | Regulator | Employer | Fine | What went wrong |
|---|---|---|---|---|
| 2020 | Hamburg, Germany | H&M service center | €35.3 million | Extensive records of details from employees' private lives |
| 2023 | CNIL, France | Amazon France Logistique | €32 million | An excessively intrusive system for monitoring employee activity and performance, and video surveillance without proper information |
| 2024 | CNIL, France | A real estate company | €40,000 | Software that counted periods of inactivity and took regular screenshots, plus constant filming, with no valid legal basis, poor information and no impact assessment |
The pattern is consistent. Regulators object to monitoring that is constant, that measures every idle minute, that workers were not properly told about, or that was never assessed.
What should a GDPR checklist for monitoring software cover?
- Write down the purpose of each type of monitoring.
- Complete a legitimate interests assessment.
- Complete a DPIA and act on what it finds.
- Consult the works council or employee representatives where the law requires it.
- Update the employee privacy notice and explain the monitoring in person.
- Minimize: record only during working hours, blur screenshots, prefer summaries to raw content, and leave out features you do not need.
- Limit access by role.
- Set retention periods and delete on schedule.
- Prepare for access requests. Workers can ask for a copy of their data.
- Sign a data processing agreement with your software provider and check where data is stored.
How do BirdsEye settings map to these duties?
| Duty | BirdsEye setting |
|---|---|
| Transparency | The desktop agent shows every employee the rules applied to them |
| Data minimization | Tracking limited to working hours and days, screenshot blur, optional website tracking, optional webcam |
| Access limitation | Administrators see everyone, managers see only their teams, employees see only themselves |
| Storage limitation | Retention settings for activity, screenshots and webcam recordings, with purge on demand |
| Accountability | An audit log of sign-ins and changes to settings |
| Worker access | Employees can view their own day, activity log and screenshots unless the company switches screenshot viewing off |
These settings support compliance. They do not replace your DPIA, your works council process or legal advice. More detail is on the security and privacy page.
Frequently asked questions
Can employers rely on consent for monitoring under GDPR?
Rarely. Regulators consider that employees are seldom free to refuse, so consent is usually not valid. Most employers rely on legitimate interests and document the balancing test.
Is screenshot monitoring legal in the EU?
It can be, if it is necessary for a defined purpose, proportionate, clearly explained to workers and assessed in a DPIA. Frequent captures combined with inactivity counting drew a fine in France in 2024. Longer intervals, blurring and limited retention all reduce the intrusion. See Employee screenshot monitoring.
Do I need a DPIA for time tracking software?
Recording hours alone is lower risk. Once the software records applications, websites or screenshots, a DPIA is the safe course and is what regulators expect for systematic monitoring.
Does GDPR apply to a US company with employees in Europe?
Yes. The GDPR applies to organizations outside the EU when they monitor the behavior of people who are in the EU.
Sources
- Regulation (EU) 2016/679, General Data Protection Regulation
- ICO: guidance to ensure lawful monitoring in the workplace, October 2023
- A&L Goodbody: Article 29 Working Party Opinion 2/2017 on data processing at work
- Ropes & Gray: European Court of Human Rights sets out criteria for lawful monitoring
- CNIL: Amazon France Logistique fined €32 million
- Lewis Silkin: real estate company fined for excessive surveillance
- Hunton: Hamburg DPA imposes €35.3 million fine on H&M