Assessing Employee Surveillance Privacy

Overview

Workplace monitoring represents one of the most sensitive areas of data protection because of the inherent power imbalance between employer and employee. GDPR Art. 88 allows Member States to provide more specific rules for processing in the employment context, and WP29 Opinion 2/2017 on data processing at work provides detailed guidance on proportionality, transparency, and data minimisation for employee monitoring. This skill provides a DPIA methodology for all forms of workplace surveillance: email monitoring, internet usage tracking, CCTV, GPS vehicle and personnel tracking, keystroke and screen capture logging, telephone call monitoring, and wearable device monitoring.

Legal Framework

GDPR Art. 88 — Processing in the Employment Context

Art. 88(1) permits Member States to provide, by law or collective agreement, more specific rules for processing in the employment context, covering recruitment, performance of the employment contract, management, planning and organisation of work, equality and diversity, health and safety, protection of employer's property, and exercise of employment-related rights.

Art. 88(2) requires that such rules include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests, and fundamental rights, with particular regard to transparency, intra-group transfers, and monitoring systems in the workplace.

WP29 Opinion 2/2017 on Data Processing at Work

Key principles established: