# Employee Surveillance Privacy Assessment Workflows

## Workflow 1: Employee Monitoring DPIA Trigger Assessment

```
START: Employee monitoring system proposed or changed
│
├─ WP248 C1 (Evaluation/scoring): Does the monitoring evaluate employee performance?
├─ WP248 C3 (Systematic monitoring): Is monitoring continuous or systematic?
├─ WP248 C4 (Sensitive data): Could monitoring capture health, political, or religious data?
├─ WP248 C7 (Vulnerable subjects): Employees are always vulnerable due to power imbalance.
├─ WP248 C8 (Innovative technology): Is the monitoring technology novel?
│
├─ C7 is always met for employee monitoring.
├─ If any one additional criterion is met → DPIA required.
│
└─ Proceed to full employee surveillance DPIA.
```

## Workflow 2: Monitoring Proportionality Assessment

For each monitoring type, follow this assessment:

### Step 1: Purpose Validation
- Document the specific purpose (not "general security" but "detection of insider trading in compliance with MAR Art. 16(2)")
- Verify the purpose is documented in the employee privacy notice
- Confirm the purpose has a lawful basis

### Step 2: Necessity Test
- Is monitoring necessary for the purpose, or can the purpose be achieved without monitoring?
- Alternative assessment: policy enforcement, training, spot checks, complaint-based investigation

### Step 3: Proportionality Scaling
- Select the least intrusive monitoring level that achieves the purpose
- For email: metadata before content
- For internet: categories before URLs
- For CCTV: common areas before workstations
- For GPS: working hours only, not 24/7

### Step 4: Scope Limitation
- Target monitoring to specific risk areas or roles (not blanket)
- Limit duration (not indefinite)
- Exclude personal/private activity where possible

### Step 5: Retention Limitation
- Set specific retention periods per monitoring type
- Implement automated deletion
- Monitoring data retention should be shorter than business data retention

## Workflow 3: Works Council Consultation Process

1. Prepare monitoring proposal documentation for works council/employee representatives.
2. Include: purpose, scope, data categories, retention, access controls, employee rights.
3. Present to works council and invite feedback.
4. Negotiate modifications based on feedback.
5. Document the agreement or the consultation outcome.
6. In Germany: works council agreement (Betriebsvereinbarung) is legally required under BetrVG Section 87(1)(6) for technical monitoring.
7. In France: CSE consultation required before implementation.
8. In Netherlands: works council consent required under WOR Art. 27(1)(l).

## Workflow 4: Employee Notification Process

1. Update employee privacy notice with monitoring details.
2. Update acceptable use policy.
3. Provide plain-language monitoring summary (separate from legal privacy notice).
4. Conduct employee awareness session explaining monitoring scope and rights.
5. Document notification and acknowledgment.
6. For new employees: include monitoring information in onboarding materials.