Short answer
An Irish employer may process worker data only for a defined lawful purpose and only where the chosen monitoring is necessary, proportionate, transparent, secure and no more intrusive than needed. A device-usage policy does not create unlimited permission to read private email, watch employees continuously or repurpose security footage for performance management.
Health data needs both an ordinary GDPR legal basis and a special-category condition. Human resources ordinarily needs a fitness or accommodation conclusion, not a full diagnosis. Location tracking must serve a genuine operational, safety or security purpose and should not become general behavioural or off-duty surveillance.
Significant decisions made solely by an algorithm are generally prohibited unless a narrow Article 22 exception and safeguards apply. Other scoring and decision-support systems remain subject to fairness, explanation, challenge, equality and data-impact duties. Some AI Act rules already apply, but the employment high-risk regime was still subject to a revised future timetable at the review date.
Use one test before choosing any monitoring tool
The GDPR and Data Protection Act 2018 apply to identifiable employee activity, images, communications, device identifiers, location, health information and inferred scores. Before procurement or collection, the employer should document:
- the precise purpose and Article 6 legal basis;
- why the measure is necessary and why a less intrusive method is insufficient;
- the impact on employees' privacy and other rights;
- the data collected, access, recipients, security and deletion period; and
- the notice, rights process, review and evidence of accountability.
Contract necessity is narrower than convenience: processing must be objectively necessary to perform the employment contract. Legal obligation covers processing genuinely required by employment, tax or safety law. Legitimate interests requires a recorded purpose, necessity and balancing assessment. Consent is usually unsuitable because the employment power imbalance means refusal may not be genuinely free.
Article 5 requires data to be:
“adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”
—
Employees must receive clear advance information about the monitoring, purpose, basis, recipients, retention, rights and relevant automated logic and consequences. A hidden or vague clause in a long handbook rarely cures excessive processing. Article 8 ECHR privacy expectations reinforce the need to consider context, advance warning, scope, justification, access and safeguards.
High-risk plans require a data protection impact assessment before processing. Systematic employee monitoring, communications or location data, sensitive data, new technology, scoring and significant automated decisions commonly trigger or strongly support a DPIA. If mitigations cannot remove residual high risk, prior consultation with the DPC is required.
Communications monitoring must be targeted
An employer can secure its network, filter malware, preserve business records and investigate a concrete serious incident. It should prefer aggregate logs, security alerts and metadata before opening content, restrict searches by person, time and term, segregate privileged or plainly private material, and record who accessed what and why.
Routine reading of email, chats or browsing is much harder to justify. A 2024 DPC case found GDPR infringements where an employer accessed employees' private email on a shared work computer and used it for discipline. The contract and privacy notice saying business equipment could be monitored were not blanket consent to process personal-account messages.
A workable policy distinguishes incidental personal use, business continuity after absence, cybersecurity review and misconduct investigation. It states the escalation conditions and gives employees a private channel. Covert monitoring should be exceptional, time-limited and tied to a reasonable suspicion of serious wrongdoing where notice would defeat the investigation; employment fairness and admissibility issues remain separate from GDPR compliance.
CCTV is not a substitute for supervision
Images of identifiable people are personal data. CCTV can be justified for crime prevention, access control or a demonstrated lone-worker or safety risk after a legitimate-interest balance. Cameras should avoid private areas, unnecessary views and audio, use visible signs plus a fuller policy, restrict live and recorded access and delete footage on a defensible schedule.
The DPC says workplace CCTV is generally inappropriate for routine attendance or performance monitoring. Security footage cannot automatically be reused for discipline. If serious misconduct appears, limited further use may be lawful where compatible or supported by a separate basis, and where necessity, proportionality and employee transparency can be demonstrated. A manager browsing footage to assess productivity is materially different.
Audio recording and facial recognition are much more intrusive. Biometric identification adds Article 9 special-category requirements, while large-scale public-area monitoring can itself mandate a DPIA.
Location data should track the operation, not the private life
GPS and telematics identify the person using a vehicle or device. Legitimate purposes may include dispatch, route evidence, lone-worker safety, theft recovery, mileage or compliance with a specific transport duty. “Efficiency” does not justify collecting every movement indefinitely.
The employer should configure the lowest useful precision and frequency, limit access, define real-time versus historic use and disable tracking outside work where private use is allowed. Employees need to know whether driving behaviour, breaks or geofences will affect appraisal or discipline. The DPC expressly warns that vehicle tracking should not be general staff or behavioural monitoring.
App location, badge, Wi-Fi and productivity telemetry require the same analysis. Combining datasets can turn modest tools into pervasive profiling and may create a new purpose requiring a fresh assessment and notice.
Health information needs two legal gateways
Medical and occupational-health data is special-category data. The employer must identify both an Article 6 basis and an Article 9(2) condition. Necessary employment and social-protection obligations, occupational medicine under professional secrecy, public health or legal claims may apply with Irish statutory safeguards. Explicit consent is possible in limited genuinely optional settings, not as a routine answer.
Data minimisation changes the information flow. A doctor or occupational-health provider can usually tell HR whether the person is fit, unfit, subject to restrictions, needs accommodation and when review is appropriate. HR seldom needs the diagnosis, clinical history or full report. The DPC has criticised excessive circulation of illness details and recommends sharing only the minimum fitness conclusion.
Health files should be access-restricted and separated from ordinary personnel records. Retention should follow the identified legal and claims need; disclosure to managers should be confined to practical restrictions. Equality and safety duties may require action without entitling every decision-maker to medical detail.
Automated workplace decisions need real human control
Article 22 gives a person the:
“right not to be subject to a decision based solely on automated processing”
—
The restriction applies where the result has legal or similarly significant effects, such as automated rejection, dismissal, pay, promotion or serious scheduling decisions. Sole automation is permitted only when necessary for a contract, authorised by Union or Member State law, or based on explicit consent. Applicable exceptions require safeguards, including meaningful human intervention, an opportunity to state a view and challenge the decision. A reviewer who merely clicks “approve” without authority, information or time is not meaningful intervention.
Decision support outside Article 22 still must be lawful, fair, accurate, explainable and contestable. Training data, proxies and outcomes should be tested for discrimination. Workers need relevant information about logic and consequences, and a route to correct input data and obtain review. Vendors are processors or controllers according to their actual role; contracts do not transfer the employer's accountability.
Since 2 February 2025 the AI Act's AI-literacy duty and prohibited-practice rules apply. AI emotion recognition in workplaces is prohibited except for medical or safety reasons. Recruitment, candidate selection, task allocation, monitoring, evaluation, promotion and termination systems fall within the Act's employment high-risk category. A Commission update of 6 July 2026 reports political agreement postponing those stand-alone high-risk rules to December 2027; employers should verify the final amending text rather than assume that timetable is settled. GDPR and equality law apply regardless.
Conclusion
Lawful workplace monitoring begins with a problem, not a tool. Define the problem, choose the least intrusive effective measure, perform the legal and impact assessments, tell employees clearly, constrain access and retention, and preserve meaningful challenge. Cameras, telemetry and algorithms can support a workplace process, but cannot erase the worker's privacy, equality or procedural rights.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.