GDPR a zaměstnanci

Why is employee monitoring a legal minefield?

You must balance on the edge of two key regulations: the General Data Protection Regulation (GDPR), because monitoring constitutes systematic data processing, and the Labor Code, which in Section 316 sets strict rules for protecting employee privacy.

A violation doesn't just mean the risk of a single fine. You face the risk of simultaneous penalties from two authorities: from the Office for Personal Data Protection (ÚOOÚ) for GDPR mistakes and from the State Labor Inspection Office for violating the Labor Code.

However, the real risk often lies elsewhere than in fines. If you dismiss an employee for, say, theft or long-term inactivity, and your only evidence is an illegally obtained camera recording or an unlawfully acquired email, the court will throw out such evidence.

Illegal monitoring renders your key evidence inadmissible in court. As a result, you will not only pay a fine but also lose the labor dispute, have to reinstate the employee, and pay their back wages. This dual threat can be avoided. Our Prague-based legal team is ready to help you set up monitoring legally.

Myth #1: "The employee signed it, so I can do anything"

The most common and most dangerous mistake is to rely on employee consent. The argument from authorities and courts is consistent: an employee cannot give free consent in a situation where they are existentially dependent on the employer. The employee reasonably fears that refusing consent would lead to negative consequences, and therefore their consent is not considered freely given.

Relying on a signed consent form is like building a house on sand. It gives you a false sense of security, but at the first legal confrontation, the entire monitoring system will collapse as invalid.

The correct legal basis is almost always the employer's legitimate interest under Article 6(1)(f) of the GDPR. This interest could be protecting property from theft, ensuring workplace safety, or protecting trade secrets or IT infrastructure. Need legal assistance with assessing your legitimate interest? Contact our experts.

How to conduct the key "balancing test," or what you must assess

However, a legitimate interest is not a blank check to monitor anything. You must be able to prove that your interest is genuinely stronger than the employee's right to privacy. This requires a key documentation step: the balancing test (or proportionality test). Moreover, you must have it prepared in advance, not hastily created when an inspection arrives.

The balancing test must consider at least:

1. Purpose: What exactly are you monitoring and why? (e.g., protecting a server room from unauthorized access).

2. Impact: How much will you intrude on the employee's privacy? What is their reasonable expectation of privacy in the given location (e.g., in an office vs. a hallway)?

3. Balance: Does your interest outweigh the employee's rights?

4. Minimization: Is there a less intrusive way to achieve the goal? (e.g., just a lock on the door instead of a camera?).

A universal template for a balancing test does not exist. A test for a camera in a warehouse, where the expectation of privacy is low, will look completely different from a test for monitoring software on a lawyer's computer in their office.

The lawyers at ARROWS specialize in preparing balancing tests and DPIAs (Data Protection Impact Assessments) for monitoring. For an immediate solution to your situation, do not hesitate to contact us.

You must play with your cards on the table: The duty to inform

Even legally established and justified monitoring becomes illegal if you conduct it secretly. The fundamental principle of the GDPR is transparency. Covert surveillance is strictly prohibited, with very few exceptions (e.g., targeted detection of specific serious criminal activity).

The employer is obliged to inform employees directly and in advance about:

• The scope of the monitoring (what exactly you are monitoring).

• The method of its implementation (what technologies you are using).

• The purpose (why you are doing it).

• The period for which the data will be stored.

The best way to fulfill this obligation is to create a high-quality internal policy. It must be understandable even to non-experts and easily accessible to all employees. ARROWS prepares clear internal policies for clients that protect against fines and will stand up to scrutiny during an inspection.

PC and email monitoring: Where exactly is the line for privacy?

Monitoring IT tools is the most common form of employee supervision. However, many employers mistakenly believe that what is on a company computer belongs to the company. It's not that simple. Courts have repeatedly confirmed that blanket, continuous monitoring of employee activity on a PC is illegal.

You must clearly distinguish between monitoring metadata and content:

• Monitoring metadata: Checking whether an employee is using work tools excessively for private purposes (e.g., checking browsing history, lists of phone calls) is generally permissible if it is proportionate and employees are aware of it.

• Monitoring content: Reading the content of emails, private chat messages, or listening to calls is a fundamental intrusion into privacy and the secrecy of correspondence.

A key ruling in this regard is the judgment of the European Court of Human Rights (the Bărbulescu case). It established that an employer may, in exceptional cases, access the content of communications, but only if the employee was informed in advance of the possibility of such monitoring, private use was clearly prohibited, and there is a legitimate reason for the check.

Extremely invasive tools, such as keyloggers (software that records keystrokes), are almost always considered illegal spyware because they indiscriminately collect private data, including banking passwords and sensitive messages.

A legal consultation from ARROWS will help you set rules for IT monitoring that protect your data without risking a lawsuit.

Monitoring of computers, emails, and phones

Cameras (CCTV) in the workplace: What the Labor Inspection Office will not forgive

For camera systems (CCTV), the legal regulation is even stricter. Here, a "legitimate interest" under GDPR is not enough. The Labor Code in Section 316 explicitly states that an employer may only intrude on privacy (which a camera does) if there is a "serious reason arising from the special nature of the employer's activities."

Routine productivity monitoring in an office is not such a "serious reason." This reason might be protecting valuable assets in a jewelry store, ensuring safety in a chemical plant, or securing a data center. Cameras must not primarily serve to monitor work performance.

There are also absolutely prohibited zones where cameras must never be placed (except in truly extreme cases). These are areas where employees have a reasonable expectation of complete privacy: changing rooms, toilets, showers, and break rooms.

Furthermore, you must fulfill a visible information duty (the so-called two-layer approach – a sign as the 1st layer and a detailed document at the reception/on the intranet as the 2nd layer) and store recordings only for the strictly necessary period (the standard is 72 hours to 1 week).

ARROWS provides complete audits of camera systems and prepares the related documentation (including balancing tests and policies) to ensure they comply with both GDPR and the Labor Code.

GPS in company cars: Does tracking end with working hours?

Monitoring company vehicles with GPS is a common practice, especially for companies with fleets or sales representatives. Here, too, distinctions must be made.

Tracking a vehicle's location during working hours for the purpose of maintaining a logbook, protecting property (the car), and monitoring the fulfillment of work tasks is legitimate.

The situation changes dramatically if you allow employees to use the vehicle for private purposes. Here, the opinions of authorities diverge. While the ÚOOÚ has in the past suggested that tracking is possible even for private trips (if the employee is aware of it), European bodies (formerly WP29) and the Ministry of Industry and Trade are much stricter, stating that for monitoring an employee outside of working hours (e.g., on a weekend or in the evening), it is "unlikely that a legal basis would exist."

The safest legal solution is to technologically enable the employee to switch the GPS to a "private mode" (a so-called privacy button). This way, the employer protects their property during working hours but does not intrude on the employee's privacy when they are driving to the doctor on a weekend.

Do you have dozens of vehicles in your company and are unsure about your GPS settings? We will prepare or review your vehicle use agreements and internal policies.

Physical monitoring (CCTV and GPS)

New challenges: How to legally monitor remote work (Home Office)

With the massive shift to remote work, the question has arisen of how to supervise employees we do not see physically. The principles of the GDPR (lawfulness, transparency, minimization) apply just the same to home office work. However, the risk of invading privacy is much higher because the workplace has become the employee's private home, where their family members are also present.

Employers tend to replace physical supervision with digital supervision – using software that takes screenshots, tracks keystrokes, or even uses the webcam. These methods are extremely invasive and are almost certain not to pass a balancing test.

The legal path is to focus on monitoring work results (completed tasks, submitted projects), not on micromanaging online activity.

Remote work requires a specific legal setup. Our Prague-based legal team is ready to help you with the review of employment contracts and policies for home office.

Monitoring in a multinational company: Why a Czech setup will fail in Germany

If your company operates in multiple EU states, you must be particularly careful. While the GDPR applies to every company monitoring employees in the EU, the regulation itself, in Article 88, allows member states to adopt stricter national rules in the context of employment.

A single monitoring policy for the entire EU is therefore practically illegal. What is legal in Prague could be the cause of a fatal problem elsewhere:

• Germany: Here, the works council (Betriebsrat) has a very strong right of co-determination (Mitbestimmung) regarding the introduction of any technical system capable of monitoring employees. It is not enough to inform the council; it must agree to the implementation.

• France: The French supervisory authority (CNIL) is extremely strict, prohibiting the permanent surveillance of employees and is known for imposing astronomical fines, such as the €32 million fine issued to a major international employer for an overly invasive productivity monitoring system.

Thanks to the ARROWS International network, built over ten years, we handle this agenda on a daily basis. We help corporations unify procedures where possible and localize them where necessary. We provide legal advice on international data transfers and the implementation of monitoring in various jurisdictions.

How ARROWS can help you prevent million-dollar losses

Employee monitoring is a complex legal discipline at the intersection of GDPR, labor law, IT, and technology. A mistake is expensive – it costs not only money in fines and lost disputes but also the company's reputation and employee trust.

At ARROWS, we specialize in this area, and thanks to our long-term experience with over 150 joint-stock companies and 250 limited liability companies, we know where companies most often make mistakes.

We provide our clients with comprehensive legal services:

• Legal audits of existing monitoring systems (CCTV, IT, GPS).

• Preparation and review of complete documentation (internal monitoring policies, IT policies, camera system policies, home office rules).

• Drafting of tailored legal opinions and balancing tests.

• Preparation and review of contracts (employment contracts, addendums, vehicle use agreements).

• Expert training for employees or management (HR, managers), including certification.

• Representation in courts and before administrative authorities (ÚOOÚ, State Labor Inspection Office).

Don't leave your monitoring setup to chance. Protect your investment and prevent fatal mistakes. Connect with our experts and arrange a tailored consultation.