
Legal boundaries between control, data protection and co-determination
The technical monitoring of employees has long been a part of everyday business life. Cameras in entrance areas, GPS systems in vehicles, software for performance or communication analysis, and IT-supported monitoring in home offices are all technically feasible today. However, only some of these methods are legally permissible. This is because every form of employee monitoring infringes on the general right to privacy and is subject to strict labor and data protection laws.
What awaits you:
- Legal boundaries between control, data protection and co-determination
- Data protection as the starting point for all surveillance
- Video surveillance, GPS and IT tools
- Monitoring of emails and digital communication
- Performance control and proportionality
- Prohibitions on the use of evidence
- Co-determination of the works council
- Conclusion
- FAQs
Data protection as the starting point for all surveillance
The central benchmark is the General Data Protection Regulation (GDPR). Every monitoring measure constitutes the processing of personal data and therefore requires a sound legal basis. Article 6 of the GDPR and, in the employment context, Section 26 of the German Federal Data Protection Act (BDSG) are particularly relevant.
Monitoring is only permissible if it is necessary and the employer's interests do not outweigh the employees' fundamental rights. A general appeal to productivity, efficiency, or control is insufficient. Necessity, purpose, and proportionality must each be specifically justified and documented.
Consent does not usually play a significant role in the employment relationship, as it is generally not given voluntarily due to the dependency relationship.
Video surveillance, GPS and IT tools
Video surveillance may be permissible, for example in publicly accessible areas such as entrances or sales floors, if it serves security purposes and is not aimed at the permanent performance monitoring of individual employees. It is generally not permitted in particularly sensitive areas such as changing rooms, restrooms, or break rooms.
GPS tracking of vehicles is only permitted to the extent that it is necessary for operational purposes, such as route planning or vehicle security. Continuous monitoring or tracking outside of working hours is prohibited. Employees must be transparently informed about the type, scope, and purpose of the tracking.
The use of software to analyze behavior or performance is particularly sensitive. Covert surveillance measures such as keyloggers, screenshot tools, or comprehensive tracking constitute a serious intrusion into privacy. The Federal Labor Court has ruled that such measures are only permissible in cases of concrete suspicion of a serious breach of duty and may not be used without cause.
Monitoring of emails and digital communication
Reviewing work emails or communication tools like Teams or Slack is particularly complex from a legal perspective. In addition to data protection law, telecommunications law also plays a role. Depending on the nature of private use, the confidentiality of telecommunications may apply, now regulated by the Telecommunications and Digital Services Data Protection Act.
Regardless, access to communications is only permissible if there is a clear legal basis under data protection law. For internal investigations, Section 26 Paragraph 1 Sentence 2 of the German Federal Data Protection Act (BDSG) is particularly relevant, as it permits processing in cases of suspected criminal offenses or serious breaches of duty. This requires documented factual evidence, the necessity of the measure, and a balancing of interests in favor of the employer.
Continuous or indiscriminate monitoring of communications is inadmissible.
Performance control and proportionality
Performance reviews are generally permissible under labor law, but are subject to strict limits. Every review infringes on the general right to privacy of employees and simultaneously constitutes the processing of personal data. Therefore, the principles of necessity, proportionality, and transparency are paramount.
In particular, permanent or continuous monitoring that creates constant pressure to conform is inadmissible. Technical capabilities do not justify comprehensive control. However, time-limited, random, and purpose-oriented performance reviews may be permissible, provided they serve a legitimate aim and no less intrusive means are available.
Covert monitoring is generally unlawful. Employees must be informed whether and to what extent performance data is being collected. Objective measurements of individual work results may be permissible, as long as they do not lead to the creation of a comprehensive behavioral or personality profile.
In companies with a works council, Section 87 Paragraph 1 No. 6 of the Works Constitution Act (BetrVG) must also be observed. The use of technical systems for performance monitoring is legally contestable without prior co-determination.
Prohibitions on the use of evidence
A common misconception is that data protection breaches automatically lead to the exclusion of evidence. This is not the case. Instead, the courts conduct a balancing of interests. An exclusion of evidence is only considered if the employee's right to privacy outweighs the employee's right to privacy in the specific case.
If data was collected openly and serves to investigate intentional breaches of duty, it can be used despite data protection violations. Data protection is not protection against crime.
Co-determination of the works council
In companies with a works council, monitoring is further limited by works constitution law. According to Section 87, Paragraph 1, Number 6 of the Works Constitution Act (BetrVG), there is a mandatory right of co-determination regarding the introduction and use of technical equipment that is suitable for monitoring the behavior or performance of employees. The decisive factor is the objective suitability, not the intended use.
This right of co-determination regularly concerns the technical equipment as such. However, individual measures taken in cases of concrete suspicion are not necessarily subject to co-determination, provided they are carried out within the framework of existing company agreements.
Conclusion
Employers have legitimate interests in monitoring their employees. However, these interests end where personal rights, data protection, and employee participation are violated. Technical capabilities do not justify unlimited surveillance. Every measure must be proportionate, transparent, and legally sound.
For companies, this means that monitoring is only legally sound with a clear legal basis, thorough documentation, and early involvement of the works council. For employees, the rule is: not all monitoring is permitted – and unlawful monitoring remains open to challenge.








