# Standards and Regulatory References for Employee Surveillance Privacy

## Primary Legislation

### GDPR
- **Art. 6(1)(f)**: Legitimate interest — primary lawful basis for employee monitoring.
- **Art. 88**: Processing in the employment context — Member States may provide more specific rules.
- **Art. 35**: DPIA required when employee monitoring meets WP248 criteria (systematic monitoring C3, evaluation/scoring C1, vulnerable data subjects C7).
- **Art. 21**: Right to object to processing based on legitimate interest, including employee monitoring.

### National Employment Data Protection Laws
- **Germany BDSG Section 26**: Employee data processing necessity requirement. Works council co-determination under BetrVG Section 87(1)(6).
- **France Labour Code L1121-1**: Proportionality of restrictions on employee rights. L1222-4: prior notice of monitoring.
- **Italy Workers' Statute Art. 4**: Prohibition on remote surveillance except by trade union agreement or labour inspectorate authorisation.
- **Spain LOPDGDD Art. 87-91**: Digital rights at work including digital disconnection.

## EDPB and WP29 Guidance

### WP29 Opinion 2/2017 on Data Processing at Work
- Established that employee consent is generally not freely given due to power imbalance.
- Recommended legitimate interest as the primary lawful basis for employee monitoring.
- Required proportionality assessment for each monitoring technology.
- Keystroke logging and screen capture identified as highly intrusive — last resort only.
- Blanket monitoring of all employee communications is disproportionate.

### EDPB Guidelines 3/2019 on Video Surveillance
- Section 7: workplace video surveillance must respect proportionality.
- CCTV in toilets, changing rooms, and rest areas prohibited.
- Continuous monitoring of individual workstations generally disproportionate.
- Covert surveillance only in exceptional circumstances with strict conditions.

## European Court of Human Rights

### Barbulescu v Romania (Grand Chamber, Application 61496/08, 5 September 2017)
- Established six factors for proportionality of employee communications monitoring:
  1. Has the employee been notified of the possibility of monitoring and its scope?
  2. What is the extent of the monitoring and degree of intrusion into privacy?
  3. Has the employer provided legitimate reasons justifying the monitoring and access?
  4. Would it have been possible to use less intrusive methods?
  5. What are the consequences for the employee of the monitoring?
  6. Have adequate safeguards been provided?

### Lopez Ribalda v Spain (Grand Chamber, Application 1874/13, 17 October 2019)
- Covert video surveillance of employees suspected of theft was justified under the specific circumstances.
- Established that covert monitoring requires: specific suspicion, limited duration, limited scope, no less intrusive alternative, and proportionate to the investigation aim.

## Enforcement Decisions
- **CNIL vs Amazon France Logistique (SAN-2024-001, 2024)**: EUR 32 million fine for excessive warehouse employee monitoring.
- **Hamburg DPA vs H&M (2020)**: EUR 35.3 million fine for systematic profiling of employees' private lives.
- **Greek DPA vs PwC Greece (2019)**: EUR 150,000 fine for unlawful employee email monitoring.
- **Romanian DPA vs Raiffeisen Bank (2019)**: EUR 100,000 fine for GPS tracking of personal vehicles outside working hours.
- **ICO vs Serco Leisure (2022)**: Enforcement notice for biometric (facial recognition) attendance system without DPIA or alternative.