Short answer
An employer may monitor workers only where each operation has a specific legitimate purpose, a valid GDPR lawful basis, and is necessary and proportionate. It must normally inform workers clearly before monitoring, collect no more than the purpose requires, restrict access and retention, protect the data, and be able to demonstrate its assessment. Owning the laptop, email system or vehicle does not give the employer an unrestricted right to observe the person using it.
The technique matters. Security logs are less intrusive than reading messages; work-time location differs from off-duty tracking; and aggregate statistics differ from continuous individual scoring. Biometric identification may trigger special-category rules, while decisions made solely from productivity scores may trigger Article 22. High-risk systems require a data protection impact assessment (DPIA) before deployment.
The GDPR is the EU floor. National law and collective agreements may add conditions but cannot dilute it. The EU Charter and the separate ECHR framework also matter.
Begin with the operation, not the monitoring product
The applies whenever a system processes personal data. The employer should describe what is collected, from whom, how often, for which decision, who receives it, and when it is deleted. “Security”, “efficiency” or “employee management” is too broad to test necessity.
Article 5 requires lawfulness, fairness, transparency, purpose limitation, security and accountability. It also requires data to be:
“adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. —
A fraud investigation may justify targeted logs for a defined period, not permanent capture of every worker's screen. Dispatch may require a vehicle's current position during a shift, not a precise trail during breaks. Cybersecurity data should not silently become a general disciplinary database.
A lawful basis is necessary, but never sufficient
The employer needs an Article 6 basis for every purpose. Legal obligation supports monitoring a specific law genuinely requires; a public employer may sometimes rely on public task. Contract supports only processing objectively necessary to perform the employment contract. A private employer relying on legitimate interests must identify the interest, prove necessity, and balance it against workers' rights and reasonable expectations.
Consent is rarely reliable in a dependent relationship. It is valid only if freely given, specific, informed and withdrawable without detriment. A signature on a policy does not make intrusive processing necessary or prove freely given consent.
Articles 13 and 14 normally require advance information about the purpose, basis, data categories, recipients, retention and rights. “Use may be monitored” may not explain content access, location frequency, screenshots, scoring or disciplinary use. Covert monitoring is not a routine transparency exception and requires an exact check of EU and national law.
Different tools create different legal risks
Email and communications
Employers should distinguish account metadata from communications content. Malware detection or access alerts may work without reading messages. Content review may expose private, health, union or legally privileged material, so it needs stronger reasons, tighter targeting and safeguards.
The states:
“Everyone has the right to respect for his or her private and family life, home and communications.” —
Article 8 separately protects personal data, while Article 52 requires limitations to be lawful, necessary and proportionate and to respect the essence of the rights.
Location and devices
Location monitoring should be limited by time, precision and frequency. Safety or routing may justify location during relevant work, while continuous off-duty tracking is much harder to defend. An off-duty switch, coarse location, short retention and dispatch-only access reduce intrusion.
Device ownership does not settle the issue. Access logs, patch status and malware alerts differ from keystroke logging, webcam or microphone activation and continuous screenshots. The employer should test whether security controls, aggregate reports or a targeted investigation would achieve the purpose with less observation.
Biometrics
Article 9's special-category rule applies when biometric data are processed to uniquely identify a person. A normal photograph is not automatically special-category biometric data; a facial template used to recognise the worker usually is.
Where Article 9 applies, an Article 6 basis is not enough. The employer also needs an Article 9(2) exception. The employment-law exception in Article 9(2)(b) requires necessity and authorisation by EU or Member State law, or by a collective agreement under Member State law, with appropriate safeguards. Explicit consent remains vulnerable to the employment power imbalance. Employers should compare less intrusive alternatives such as cards, tokens or PINs and provide a workable alternative where required.
Productivity and automated decisions
Productivity data can lack context: idle time may reflect a call, equipment failure or safety procedure. Employers should validate metrics, correct errors, avoid repurposing and not treat a score as an unexplained proxy for performance.
Article 22 requires separate attention where solely automated processing produces legal or similarly significant effects—for example, dismissal, promotion or pay decisions. Nominal human approval is insufficient if the reviewer cannot assess and depart from the output. Other GDPR rules apply even below Article 22's threshold.
The AI Act separately treats specified employment and worker-management AI uses as high-risk. Regulation (EU) 2026/1744 postponed the relevant Chapter III Sections 1–3 duties for Annex III systems until 2 December 2027. That timing does not suspend the GDPR, labour law or existing discrimination rules.
High-risk monitoring requires assessment before deployment
Under Article 35, a DPIA is mandatory where the proposed processing is likely to result in high risk. Systematic and granular observation of workers, consequential profiling, new technologies and large-scale biometric processing are strong indicators. The competent national supervisory authority's published DPIA list must also be checked.
A DPIA must describe operations and purposes, assess necessity and proportionality, identify risks, and specify safeguards. These may include role-based access, short retention, separation of security and HR uses, aggregate processing, access logs, challenge routes and worker consultation. High residual risk may require prior consultation with the supervisory authority under Article 36.
National labour law and collective agreements add rules, not exemptions
Article 88 allows Member States, by legislation or collective agreement, to adopt more specific employment-data rules. Those rules must protect human dignity, legitimate interests and fundamental rights, with particular regard to transparency, intra-group transfers and workplace monitoring. National law may also require consultation or agreement with a works council or union, regulate communications secrecy, or restrict the use of unlawfully obtained evidence.
The Court of Justice made the hierarchy clear in : a national provision is not a valid Article 88 “more specific rule” unless it satisfies Article 88(2). A non-compliant rule must be disregarded unless it independently supplies a valid Article 6(3) legal basis that meets the GDPR.
In , the Court held that Article 88 rules must also comply with Articles 5, 6 and 9. The bargaining parties' view that processing is necessary:
“does not prevent the national court from carrying out a full judicial review in that regard.” —
So a collective agreement is an important legal instrument, but not a waiver of necessity, proportionality or special-category safeguards. Because national rules differ, a cross-border employer must assess the law where each monitored workforce is employed rather than deploy one supposedly “EU-compliant” setting everywhere.
The Charter and ECHR have distinct roles
The Charter binds EU institutions and Member States when they implement EU law. It informs how legislators, authorities and courts interpret and apply the GDPR; it should not be described as a free-standing horizontal monitoring code imposed directly on every private employer.
The European Court of Human Rights is not an EU court. Its Grand Chamber judgment in concerns states' duties under ECHR Article 8. Its communications-monitoring checklist covers prior notice, degree and duration of intrusion, reasons, alternatives, consequences, safeguards and a remedy. The Court stressed:
“Since monitoring of the content of communications is by nature a distinctly more invasive method, it requires weightier justification”. —
In López Ribalda and Others v Spain, the Grand Chamber accepted limited covert video in a suspected-theft context. That fact-specific ruling is not general permission for secret surveillance.
A defensible deployment sequence
Before monitoring begins, the employer should:
- define each narrow purpose and the decisions the data will support;
- select and document the Article 6 basis and, for biometric identification, an Article 9 exception;
- compare less intrusive means and limit people, fields, precision, frequency and duration;
- check the Member State's labour law, collective agreement, worker-representation duties and supervisory-authority DPIA list;
- complete a DPIA where high risk is likely and consult the authority if high residual risk remains;
- give specific advance notice, establish access, retention, security and challenge procedures; and
- reassess necessity before reusing data or turning observations into disciplinary or automated decisions.
Conclusion
Workplace monitoring turns on purpose, legal basis, necessity, proportionality, transparency and safeguards—not device ownership. Article 88 permits more specific national or collective rules, but no escape from the GDPR.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.