# Standards and Regulatory References — Employee Monitoring DPIA

## Primary Legislation

### GDPR Article 35 — Data Protection Impact Assessment
- **Art. 35(1)**: DPIA required where processing is likely to result in high risk to rights and freedoms, particularly using new technologies.
- **Art. 35(3)(a)**: Systematic and extensive profiling with significant effects triggers mandatory DPIA.
- **Art. 35(7)**: DPIA must contain systematic description, necessity/proportionality assessment, risk assessment, and mitigation measures.
- **Art. 35(9)**: Where appropriate, seek views of data subjects or their representatives on intended processing.

### GDPR Article 88 — Processing in the Employment Context
- **Art. 88(1)**: Member States may provide more specific rules for processing in the employment context by law or collective agreements.
- **Art. 88(2)**: Such rules must include suitable and specific measures to safeguard human dignity, legitimate interests, and fundamental rights of the data subject.

### ECHR Article 8 — Right to Respect for Private Life
- Art. 8(1): Right to respect for private life, family life, home, and correspondence.
- Art. 8(2): Interference permitted only when in accordance with law, pursuing a legitimate aim, and necessary in a democratic society.

## EDPB and WP29 Guidance

### EDPB Guidelines 3/2019 on Processing of Personal Data Through Video Devices
- Section 8: Processing in the employment context — video surveillance of employees must satisfy proportionality; cameras must not be placed in break rooms, toilets, or union meeting rooms.
- Section 8.2: DPIA mandatory for workplace CCTV systems.

### WP29 Opinion 2/2017 on Data Processing at Work (WP249)
- Section 5.1: Consent rarely valid in employment due to power imbalance.
- Section 5.3: Monitoring must be proportionate and transparent.
- Section 5.4: Employees classified as vulnerable data subjects.
- Section 5.5: Less intrusive alternatives must be considered.

### EDPB WP248rev.01 — Guidelines on DPIA
- Nine criteria for high-risk determination: employee monitoring meets criteria 3 (systematic monitoring), 7 (vulnerable data subjects), and typically 1 (evaluation/scoring) and 5 (large-scale).
- Two or more criteria met: DPIA presumptively required.

### Barbulescu v Romania (ECHR Grand Chamber, Application No. 61496/08, 5 September 2017)
- Six-factor proportionality test for employee communications monitoring.
- States have positive obligation to protect employees' Art. 8 rights.

## National Supervisory Authority Guidance

### CNIL (France)
- Deliberation No. 2018-327 (11 October 2018): National DPIA list includes systematic employee monitoring.
- Deliberation No. 2019-001 (10 January 2019): Biometric data framework for access control.
- Decision SAN-2021-003: EUR 20,000 fine for keystroke logging without DPIA.

### ICO (United Kingdom)
- Employment Practices Data Protection Code, Part 3: Monitoring at Work.
- Art. 35(4) list includes systematic monitoring of employees.

### BfDI (Germany)
- BDSG Section 26: Employee data processing requirements.
- Section 87(1)(6) BetrVG: Works council co-determination for technical monitoring.

### AEPD (Spain)
- Guide on Data Protection in Labour Relations (2021).
- Art. 87-91 LOPDGDD: Digital rights in employment.

### Garante (Italy)
- Workers' Statute Art. 4: Remote monitoring requires trade union agreement or labour inspectorate authorisation.
- Multiple decisions restricting continuous monitoring technologies.

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| CNIL | SAN-2021-003 | EUR 20,000 | Keystroke logging without DPIA |
| Garante | Provvedimento 9834141 (2022) | Prohibited | Continuous screen capture disproportionate |
| AEPD | PS/00120/2021 | EUR 60,000 | GPS tracking outside working hours |
| Datainspektionen | DI-2020-11370 | SEK 300,000 | Facial recognition for timekeeping |
| Hellenic DPA | Decision 26/2019 | EUR 150,000 | Continuous CCTV without proportionality |
| ICO | ENF/2021/00352 | Enforcement notice | Covert monitoring of personal devices |