# Employees — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/employees
> Sources are cited per item. Verify against the official texts before relying on them.

Employee data protection and workplace privacy

## Overview

## Legal Framework

Employee data processing is governed primarily by Articles 5, 6, 9, 13–14, and 88 GDPR. Article 6(1)(b) covers processing necessary for employment contract performance; Article 6(1)(c) covers legal obligations (e.g., payroll tax compliance); Article 6(1)(f) covers legitimate employer interests such as workplace safety and fraud prevention. Article 9 restricts special category data (health, biometrics) unless an Article 9(2) exception applies — notably Article 9(2)(b) for employment obligations. Article 88 permits Member States to adopt specific employee monitoring rules. The fairness principle in Article 5(1)(a) requires employers to inform employees about data transfers to recipients, as confirmed in *Bara*. Transparency obligations under Articles 13–14 apply regardless of whether data is collected directly or indirectly from the employee.

## Key Developments

The CJEU in *Bara* established that national law permitting data transfers cannot substitute for the employer's obligation to inform employees about recipients of their data under Articles 10–11 of Directive 95/46. The fairness principle requires active notification of transfers, not passive reliance on statutory authorization.

Dutch case law sets practical thresholds for employer investigations. In the *Sif* case, the court held that an employer conducting a saliva test on an employee was impermissible, even where the employee violated safety policy — the employer's legitimate interest in safety did not override data protection requirements for biometric testing. The court nonetheless upheld dismissal on the basis of a disturbed employment relationship (i-ground), separating the legality of data processing from the consequences of employee misconduct.

In the *recherchebureau* case, the court validated an employer's engagement of a private investigation agency where the company doctor had identified inconsistencies in reported limitations. The legitimate interest basis under Article 6(1)(f) was satisfied because the employer had concrete, reasonable suspicion rather than speculative monitoring. However, the *RET* case demonstrates limits: where an investigation report is central to dismissal proceedings, pseudonymization must be offered before disclosure, and blanket refusal of employee access is impermissible under Article 15.

Enforcement actions reinforce these thresholds. The Belgian DPA fined a technology company €177,000 for lacking a valid legal basis for employee data processing, and the Spanish DPA fined SIPHONE 2020 €4,000 for the same deficiency — confirming that employer convenience does not constitute a lawful basis.

## Practical Guidance

- **Map every processing activity to a specific Article 6 lawful basis before implementation.** Reliance on consent is rarely valid in employment contexts due to the power imbalance; prioritize Article 6(1)(b), (c), or (f) with documented balancing tests for the latter.
- **Notify employees of all data recipients, including internal departments and external investigators.** *Bara* makes clear that statutory authorization for a transfer does not discharge the transparency obligation — employees must be actively informed.
- **Before engaging private investigators or conducting testing (drug, saliva, biometric), document concrete, reasonable suspicion.** The *recherchebureau* ruling shows that generalized suspicion is insufficient; the employer must articulate specific facts justifying the intrusion.
- **Provide pseudonymized access to investigation reports when employees exercise Article 15 access rights.** The *RET* decision prohibits blanket refusal where the report forms the evidentiary basis for dismissal.
- **Ensure camera monitoring is proportionate and time-limited.** Recent developments on permanent driver monitoring confirm that continuous surveillance without a specific, documented purpose violates Article 5(1)(c) and (e).

## Case law

### Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums

*Source: Court of Justice of the European Union, C-34/21, 2023-03-30 — https://overview.legal/posts/132292 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034*

In Case C-34/21, the Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium challenged the Hessian Ministry of Education's introduction of mandatory videoconference teaching during the COVID-19 pandemic without the express consent of the teachers concerned. The Verwaltungsgericht Wiesbaden referred the matter to the Court of Justice for a preliminary ruling on the interpretation of Article 88(1) and (2) GDPR regarding the processing of employee data in the employment context. The Court held that Member States may authorize employers, including public authorities, to implement such processing under national law providing for suitable safeguards, without requiring the employees' express consent, provided the processing relies on a legal basis other than Article 6(1)(a) GDPR; no fine was imposed.

### MK v K GmbH

*Source: Court of Justice of the European Union, C-65/23, 2024-12-19 — https://overview.legal/posts/132156 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065*

In a preliminary ruling requested by the German Federal Labour Court (Bundesarbeitsgericht), the Court of Justice of the European Union interpreted Article 88 of the GDPR regarding Member States' ability to adopt more specific rules for processing employee data in the employment context. The case arose from a dispute between an employee (MK) and his employer (K GmbH) over compensation for non-material damage allegedly caused by the processing of personal data based on a works agreement. The Court held that Article 88 does not grant Member States or social partners a margin of discretion to deviate from the core GDPR requirements of Article 5, Article 6(1), and Article 9, meaning national courts must conduct full judicial review of whether such data processing complies with these fundamental GDPR provisions.

### Maximillian Schrems v Data Protection Commissioner

*Source: CJEU, C-362/14, 2015-10-06 — https://overview.legal/posts/51471 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=51471*

Invalidated Safe Harbor adequacy decision. National supervisory authorities can examine adequacy decisions.

### VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance

*Source: Administrative Court Hannover, 2026-08-07 — https://overview.legal/posts/353923 — original: https://gdprhub.eu/index.php?title=VG_Hannover_-_10_A_5144/23*

Facts — The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. Holding — The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. Regarding the lawfulness of the processing, the court examined whether consent or legitimate interest could be relied upon. For consent, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the processing. The controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests.

### OVG Saarlouis - 2 A 165/24

*Source: Superior Administrative Court Saarlouis, 2025-05-13 — https://overview.legal/posts/125590 — original: https://gdprhub.eu/index.php?title=OVG_Saarlouis_-_2_A_165/24*

Facts — The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15 GDPR. They did not respond. On 28 January 2022, the controller terminated the employment. On 17 February 2022, the data subject lodged a complaint with the Data Protection Authority (DPA) under Article 77 GDPR. The data subject alleged that the controller had failed to answer the access request, had taken unauthorised photographs, and had a copy of their vaccination certificate. On 24 February 2022, the employment relationship ended by a court settlement before the Labour Court. The settlement stated that all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, were settled, except for employment documents. By entering the settlement, the data subject agreed to not pursue further claims. After the settlement, the controller informed the DPA that it had not received an access request from the data subject, had not taken photographs, and had destroyed the vaccination certificate after the employee left. The data subject continued to raise issues with the DPA, including access to time-tracking data and alleged inaccuracies in the controller’s provided documents. The controller later provided partially redacted time-tracking data. On 26 July 2022, the DPA closed the administrative procedure, as it considered that the data subject no longer had a right of access under Article 15 GDPR because the settlement didn't allow for this claim. The data subject challenged the DPA’s decision before the Administrative Court. On 10 July 2024, the court dismissed the action. The data subject appealed. Holding — First, the court held that the right of access under Article 15 GDPR was, in principle, waivable. Although Article 8(2) CFR protects the right of access, the court noted that data protection law is based on self-determination, including the possibility to consent to processing under Article 7 GDPR. From this, the court inferred that a data subject could also waive the exercise of the right of access. Second, the court clarified that a waiver could not generally cover unknown future data processing. However, a waiver relating to past processing was permissible, especially after the end of an employment relationship, where the imbalance between employee and employer no longer existed. Third, the court held that the specific settlement covered the right of access under Article 15 GDPR. The clause settling all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, also included secondary claims linked to the employment relationship, such as access rights concerning employee data. The court considered the wording sufficiently clear and found no requirement to explicitly mention data protection rights. Fourth, the court noted that the data subject already knew about the access request and had raised it before concluding the settlement. Any internal intention not to waive data protection rights was legally irrelevant. Finally, the court upheld the DPA’s decision to close the procedure. Since the data subject had waived the right of access under Article 15 GDPR for past processing through the settlement, the DPA had no obligation to continue enforcement action against the employer.

### V & EDPS V. EUROPEAN PARLAMENT, 5.7.2011 (“V v. European Parliament”)

*Source: CJEU, 2011-07-05 — https://overview.legal/posts/6179 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62009CJ0092&ref=6179*

Lawful Basis: The applicant did not consent to the transfer of her medical file by the Commission to the European Parliament. The transfer was not “necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law,” in accordance with Article 10(2)(b). The Parliament’s obligation to control fitness for duty could have been achieved by less intrusive means. Nor does Article 10(3) justify the transfer. (¶¶ 137–139)

### CJEU Bara: public body must inform data subjects of data transfer to another public body

*Source: CJEU, 2015-10-01 — https://overview.legal/posts/6149 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201&ref=6149*

Principle of fairness and lawfulness: The requirement of fair processing laid down in Article 6 of Directive 95/46 requires a public administrative body to inform the data subjects of the transfer of their data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data. (¶¶ 34–38)

### CJEU Bara: national law cannot excuse controller's duty to inform data subjects of

*Source: CJEU, 2015-10-01 — https://overview.legal/posts/5957 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201*

Right to be informed: National law that does not require the specific transfer involved in the case cannot constitute “prior information” under Article 10 of Directive 95/46 (information requirement where data is collected from the data subject), enabling the controller to dispense with his obligation to inform the data subject of the recipients of the data. (¶¶ 34–38). Article 11 (information requirement where data is not collected from data subject) requires that specified information be provi

### CJEU: Employer may assess necessity of staff email use and proportionality of file

*Source: CJEU, 2004-02-18 — https://overview.legal/posts/6190 — original: http://curia.europa.eu/juris/document/document.jsf?text=&docid=48924&pageIndex=0&doclang=DE&mode=lst&dir=&occ=first&part=1&cid=16520847#excerpt-117*

Necessity/proportionality: An employer may consider whether the use of internal email by staff (i) was necessary for the performance of their contract of employment; (ii) whether the content may become relevant for a report on their conduct in the service; (iii) whether a shortened version would suffice for proper management of personal files; and (iv) the fact that the staff in question contravened rules on the use of the internal email system by using it, as members of a trade union, for purpo

### CJEU: Publishing employee names and salaries may interfere with private life (Rundfunk)

*Source: CJEU, ECLI:EU:C:2003:294-118, 2003-05-20 — https://overview.legal/posts/6199 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62001CJ0101&ref=6199*

Lawful basis for proceeding (Necessity requirement): The CJEU held that for an employer to publish the names and incomes of employees to a third party is an interference with the right to respect for private life, protected by article 8 of the European Convention on Human Rights (para 74), but it might be justified if it was both necessary for and appropriate to the aim of keeping salaries within reasonable limits, (that being for the national courts to determine)

## Guidance

### Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group

*Source: EDPB, opinion-222023-on-the-draft-decision-of-the-belgian-en, 2023-11-16 — https://overview.legal/posts/125817 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222023-on-the-draft-decision-of-the-belgian_en*

Adopted Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group Adopted on 16 November 2023 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the…

### Opinion 01/2019 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-012019-on-the-draft-list-of-the-competent-supervisory-en, 2019-01-23 — https://overview.legal/posts/126254 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-012019-on-the-draft-list-of-the-competent-supervisory_en*

Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 01 /201 9 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 23 January 201 9 Adopted 2 Table of c ontents 1 Summary of the Facts ................................ ................................ ................................ ..................... 4 2…

### Opinion 16/2018 on the draft list of the competent supervisory authority of the Netherlands regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-162018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126303 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-162018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 16 /2018 on the draft list of the competent supervisory authority of the Netherlands regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................…

### Opinion 2/2018 on the draft list of the competent supervisory authority of Belgium regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-22018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126274 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-22018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 2 /2018 on the draft list of the competent supervisory authority of Belgium regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................ ................................…

### Opinion 11/2018 on the draft list of the competent supervisory authority of Ireland regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-112018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126301 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-112018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 11 /2018 on the draft list of the competent supervisory authority of Ireland regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................ ................................…

### Opinion 15/2018 on the draft list of the competent supervisory authority of Malta regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-152018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126276 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-152018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 15 /2018 on the draft list of the competent supervisory authority of Malta regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................ ................................…

### Opinion 6/2018 on the draft list of the competent supervisory authority of Estonia regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-62018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126278 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-62018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 6 /2018 on the draft list of the competent supervisory authority of Estonia regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................ ................................…

### Opinion 12/2018 on the draft list of the competent supervisory authority of Italy regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR)

*Source: EDPB, opinion-122018-on-the-draft-list-of-the-competent-supervisory-en, 2018-10-03 — https://overview.legal/posts/126280 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-122018-on-the-draft-list-of-the-competent-supervisory_en*

Opinion 12 /2018 on the draft list of the competent supervisory authority of Italy regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 25th September 2018 2 Contents 1. Summary of the Facts ................................ ................................ ................................ ........ 4 2. Assessment ................................ ................................ ................................…

## Enforcement decisions

### DSB (Austria) - 2025-0.960.016

*Source: DSB (Austria), 2026-03-20 — https://overview.legal/posts/187479 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2025-0.960.016*

Facts — The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025. They worked as a manager in the controller’s finance department, with technical and disciplinary responsibility for up to five employees. The controller operated a 360-degree feedback process under which the data subject completed a self-assessment and 17 other individuals, including their supervisor, three subordinates and other employees, evaluated their leadership behaviour across 27 categories. Both the data subject and their supervisor had access to the results. The process was also used for other managers within the company. On 1 August 2025, the data subject lodged a complaint with the Austrian DPA, alleging a violation of their right to confidentiality. They argued that the processing carried out as part of the 360-degree feedback process required a specific works agreement and was therefore unlawful in the absence of one. The controller had concluded a framework works agreement with the central works council on the processing of employee data, as well as a supplementary agreement concerning its HR system. However, there was no specific works agreement covering the 360-degree feedback process. The controller alleged that it relied on its legitimate interests under Article 6(1)(f) GDPR and on the performance of the employment contract under Article 6(1)(b) GDPR. It argued that a works agreement would merely specify its legitimate interests and that the absence of such an agreement did not render the processing unlawful. It further maintained that whether a works agreement was required was a labour-law issue that could not be determined in the proceedings before the DPA The data subject responded that the processing of personal data in a 360-degree feedback process served to evaluate employees and therefore constituted a measure within the meaning of § 96 of the Austrian Labour Constitution Act (ArbVG). Section 96 ArbVG lists certain workplace measures that can be introduced only with the works council’s consent through a works agreement. Holding — The DPA first found that the data subject was an employee covered by the Austrian Labour Constitution Act, rather than a senior executive excluded from its scope. It further held that the assessments of the data subject’s leadership behaviour constituted personal data. The DPA explained that Article 88 GDPR enables Member States to adopt, through legislation or collective agreements, more specific rules protecting the rights and freedoms of individuals in the context of employment-related processing. Such rules must include appropriate safeguards for, among other things, human dignity, legitimate interests and the fundamental rights of data subjects. Recital 155 GDPR expressly refers to works agreements as a possible instrument for implementing such rules. It further stated that Austria had made use of the opening clause in Article 88 GDPR and that § 96 ArbVG constituted one of the more specific national rules protecting employees in the context of personal data processing. It determined that the 360-degree feedback process constituted a systematic and standardised assessment of employees falling under both § 96(1)(2) ArbVG, concerning personnel questionnaires, and § 96(1)(3) ArbVG, concerning monitoring measures affecting human dignity. It held that under § 96 ArbVG, the processing therefore required the works council’s consent through a valid works agreement. It pointed out that the controller’s existing works agreements did not cover the 360-degree feedback process or the categories of personal data collected through it. It therefore held that the processing could not be based on a works agreement under Article 88(1) GDPR in conjunction with § 96 ArbVG. The DPA held that the controller could not rely on Article 6(1)(f) GDPR. It stated that although personnel management and improving employee performance might generally constitute legitimate interests, an interest pursued through processing contrary to national law could not be regarded as lawful. It concluded that since the mandatory works council consent had not been obtained, the interest could not be regarded as legitimate under Article 6(1)(f) GDPR. Moreover, it pointed out that Article 6(1)(b) GDPR was also inapplicable because the feedback process was not necessary for the performance of the employment contract. It reasoned that the employment relationship could be performed without it, and the process was not applied to all employees. The DPA therefore found that the processing was unlawful and violated the data subject’s right to confidentiality. It prohibited the controller from continuing the 360-degree feedback process for employees covered by the ArbVG until a valid works agreement was concluded.

### AEPD (Spain) - PS-00020-2025

*Source: AEPD (Spain), 2026-07-16 — https://overview.legal/posts/53655 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00020-2025*

Facts — Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack. The controller notified the DPA of a personal data breach after a ransomware attack affected its servers, databases, email systems and employee devices. The controller first estimated that 25,000 persons were affected. It later stated that the incident had affected around 40,000 persons, including 75 minors. The incident affected confidentiality, availability and integrity. The attacker encrypted systems and exfiltrated between 3.5 and 4 TB of information from the document management server. The affected data included identification and contact data, ID numbers, dates of birth, financial and insurance data, bank account numbers, health data, employee data and access credentials. The controller also processed data relating to minors in accident claims. A data subject complained to the DPA after being informed that their personal data had been exposed. The data subject was concerned about identity theft and requested additional information from the controller. During the investigation, the DPA found that the controller had known that its IT systems faced an extreme cybercrime risk before the breach. The forensic report could not determine the initial entry point because the servers had been encrypted, but it showed that attackers could move laterally through the infrastructure, obtain privileged access, install tools, exfiltrate data and encrypt systems. The controller had carried out a risk analysis in 2019, but this document concluded that no DPIA was necessary. After the breach, a later analysis found that a DPIA was necessary for treatments involving health data and minors. The controller did not prove that it had carried out the required DPIA. Holding — The DPA held that the controller violated Article 5(1)(f) GDPR. It considered that the controller had failed to ensure the integrity and confidentiality of the personal data under its responsibility. The DPA emphasised that the principle in Article 5(1)(f) GDPR is not limited to the existence of isolated security measures. Rather, the controller must implement adequate technical and organisational measures capable of ensuring that personal data is protected against unauthorised or unlawful processing, loss, destruction or damage. The DPA rejected the controller’s argument that the attack was an external criminal act that could not be attributed to it. The DPA found that the controller was aware of an extreme cyber risk and that its internal vulnerabilities and security posture allowed the attackers to move through the systems, access personal data and encrypt files. The DPA therefore considered that the controller’s measures were clearly insufficient. The DPA also held that the controller violated Article 35 GDPR. The controller processed high-risk categories of data, including health data and data concerning minors. In these circumstances, it should have carried out a DPIA before the processing. The DPA found that the controller’s 2019 risk analysis wrongly concluded that no high risk existed, while its later documentation acknowledged that a DPIA was necessary. The DPA proposed a fine of €150,000 for the infringement of Article 5(1)(f) GDPR and €100,000 for the infringement of Article 35 GDPR, totalling €250,000. The controller paid voluntarily without acknowledging liability, obtaining a 20% reduction under Spanish Administrative Law (39/2015). The final payable amount was therefore €200,000. The DPA also ordered the controller, under Article 58(2)(d) GDPR, to prove within three months from the enforceability of the decision that it had carried out the mandatory DPIA required under Article 35 GDPR.

### Liguria Health Protection Authority: Insufficient legal basis for data processing

*Source: Italian Data Protection Authority (Garante), 2026-05-28 — https://overview.legal/posts/353986 — original: https://www.enforcementtracker.com/ETid-3235*

The Italian Data Protection Authority (Garante) fined the Liguria Health Protection Authority €6,000 for lacking a sufficient legal basis for personal data processing in the employment sector, violating GDPR Articles 5, 6, 25, 35, and 88. The authority found that the data controller failed to satisfy principles of lawfulness, purpose limitation, and data minimization, while also lacking required data protection impact assessments and appropriate safeguards for employee data.

### Kymen Vesi Oy: Non-compliance with general data processing principles

*Source: Deputy Data Protection Ombudsman, 2020-05-22 — https://overview.legal/posts/46395 — original: https://www.enforcementtracker.com/ETid-280*

Fine for failure to carry out a data protection impact assessment ('DPIA') for the processing of location data of employees with a vehicle information system

### Unknown Company: Non-compliance with general data processing principles

*Source: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH), 2019-10-15 — https://overview.legal/posts/46374 — original: https://www.enforcementtracker.com/ETid-259*

An employee was on sick leave when his employer checked his desktop, laptop and emails to ensure that his work-related duties were being covered in his absence. The employer then suspended his account. The employee did not receive pre-notification and did not have the chance to copy / delete his private information (telephone numbers, messages). According to NAIH, employers must record the access with minutes and photos. Employment agreements must regulate whether employees can use work equipmen

### Private individual: Insufficient legal basis for data processing

*Source: Data Protection Authority of Brandenburg, 2021-01-01 — https://overview.legal/posts/47390 — original: https://www.enforcementtracker.com/ETid-1275*

The DPA from Brandenburg imposed a three-digit fine on a company employee. The individual had sent an Excel spreadsheet with employee data of 56 employees to her private e-mail address from her official computer, although this was not necessary for her official activities. For this reason, the DPA determined that the employee had unlawfully transferred the other employees' data. The spreadsheet included, in addition to the full names of the employees, an overview of vacation days already taken a

### Garante per la protezione dei dati personali (Italy) - 382/2026

*Source: Garante per la protezione dei dati personali (Italy), 2026-05-28 — https://overview.legal/posts/53883 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_382/2026*

Facts — A data subject filed a complaint before the DPA against the Liguria Health Protection Agency (the controller). The data subject was employed by the Ligurian Social and Health Care Agency, however, the organisation was later merged with the controller. According to the data subject, the controller initiated discliplinary proceedings and suspended them based on data collected unlawfully through a tracking system in the company vehicle. The data subject also argued that the controller did not sufficiently inform employees that their location was being tracked through the company vehicles. The DPA received several complaints from other data subjects, and joined the complaints. The controller argued that the geolocation system was a measure to protect its assets, to optimise the management of its vehicles, and to ensure worker safety (e.g. to ensure that an employee followed the route while carrying hazardous materials). The controller argued that it did not process employees’ personal data, as it tracked the vehicles themselves and did not link the vehicle with the employee. Finally, the controller argued that the tracking was in compliance with its workers’ statutes. Holding — The DPA first stated that the controller had complied with its information obligations. Following the collective bargaining agreement, the controller informed data subjects of how their data was going to be processed. In addition, the controller had included a notice on how their location data was processed. Therefore, the DPA did not find a violation of Article 13 GDPR. The DPA found a violation of Article 5(1)(c) GDPR. The DPA found that the controller systematically and continuously monitored employees assigned company vehicles, as they were tracked at very frequent intervals without allowing them to deactivate the tracking. The DPA found this frequent tracking particularly detrimental to data subjects’ rights and freedoms, because the controller was able to access real-time information on vehicle movements. The DPA considered that the controller processed more data than necessary for its purposes, and that it risked processing data related to data subjects’ personal lives. The controller’s need to ensure that hazardous materials are transported safely did not justify continuously monitoring employees, especially because the controller later increased the interval of monitoring to every 15 minutes. Finally, the DPA dismissed the argument that the controller only tracked vehicles and not data subjects. This is because the controller could identify the data subject at any time by checking the logbook inside the vehicles. The DPA also found a violation of Articles 5(1)(a), (b), 6 and 88 GDPR. The DPA stated that a collective bargaining agreement was a necessary but not always sufficient condition for the data processing activities to be lawful. This means that the controller must comply with both labour and data protection legislation. Given the excessive amount of data processed, the DPA found that the controller did not have a legal basis to process this data. The DPA found that the controller also unlawfully further processed the location data of data subjects for disciplinary proceedings, in violation of the principle of purpose limitation. This is because the disciplinary proceedings did not specifically concern the data subject’s movements detected by the tracking system, but rather the data subject’s failure to notify potentially dangerous situations that occurred during the performance of their duties. Finally, the DPA found a violation of Articles 25 and 35 GDPR. The DPA found that the controller failed to choose a less invasive solution during the design phase. Therefore, its processing activities did not meet the requirements of privacy by design and default (Article 25 GDPR). The controller violated Article 35 GDPR by not conducting a data protection impact assessment (DPIA) before processing data subjects’ location data. The controller’s awareness of data protection issues and evidence of introducing measures to protect data subjects was not sufficient to meet this requirement. The DPA fined the controller €6,000. The DPA took into consideration the changes the controller had made during its investigations, including adjusting the interval of tracking vehicles from every 60 seconds to every 15 minutes

### Electricity Authority of Cyprus: Insufficient legal basis for data processing

*Source: Cypriot Data Protection Commissioner, 2021-03-03 — https://overview.legal/posts/46696 — original: https://www.enforcementtracker.com/ETid-581*

The Cypriot DPA imposed a fine of EUR 40,000 on the Electricity Authority of Cyprus. The controller used an automated system based on the so-called Brad-Factor to manage, monitor and control employee absences due to illness using a tool assessment. The DPA found that such an assessment mechanism was not covered by Cypriot labor law and had therefore been used unlawfully. Furthermore, an option for data subjects not to consent to such automated processing of their personal data should have been p

## Recent developments

### ICO Publishes Draft Employee Monitoring Guidance for Consultation

*Source: Hunton Andrews Kurth, 2022-10-18 — https://overview.legal/posts/6255 — original: https://www.huntonprivacyblog.com/2022/10/18/uk-ico-publishes-draft-employee-monitoring-guidance-for-consultation/#entry-1081*

> On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on commercial surveillance and lax data security practices.

### AEPD publishes GDPR Risk Assessment

*Source: AEPD, 2022-10-11 — https://overview.legal/posts/6259 — original: https://evalua-riesgo.aepd.es/index_en.html#entry-1032*

> GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the processing, to make an initial assessment of the intrinsic risk, including the need to perform a DPIA, and to estimate the residual risk if measures and safeguards are used to mitigate the specific risk factors.

### De ICO publiceert een conceptrichtlijn over het monitoren van werknemers ter beoordeling.

*Source: Hunton Andrews Kurth, 2022-10-18 — https://overview.legal/posts/51832*

Op 14 oktober 2022 heeft de Federal Trade Commission aangekondigd dat de deadline voor het indienen van commentaren op haar voorlopige voorstel voor regelgeving over commerciële surveillance en inadequate databeveiligingspraktijken met een maand wordt verlengd.

### Berlin DPA imposes 525K euro fine over DPO violation

*Source: IAPP, 2022-09-22 — https://overview.legal/posts/6275 — original: https://iapp.org/news/a/berlin-dpa-imposes-525k-fine-over-dpo-violation#entry-482*

> The Berlin Commissioner for Data Protection and Freedom of Information issued a 525,000 euro fine to a Berlin-based retailer for violation of data protection officer requirements under the \[GDPR]. An investigation found an alleged conflict of interest concerning the DPO's employment status and decision-making responsibilities that violated Article 38(6) of the GDPR. The company received a warning from the regulator in 2021.

### "Hof van Appel van Amsterdam: Ontbinding van het bedrijf wegens een verstoorde arbeidsrelatie en gerechtvaardigde klachten over schendingen van de privacy."

*Source: Dutch Courts, 2023-05-13 — https://overview.legal/posts/51749*

Ontbinding van het dienstverband als gevolg van een verstoorde arbeidsrelatie, ernstige schuld van de werkgever vanwege onvoldoende begeleiding bij de eerste poging tot re-integratie, en gerechtvaardigde klachten van de werknemer over schending van de privacy. Met betrekking tot de hoogte van de billijke vergoeding werd overwogen dat er nauwelijks sprake was van relevant inkomstverlies, omdat de werknemer al geruime tijd arbeidsongeschikt was en het einde van de wachttijd was... (Machinevertaling)

## Literature

### LEGAL REGULATION OF THE PROTECTION OF PERSONAL DATA OF EMPLOYEES UNDER THE GDPR

*Source: Law and Society, 2023-01-01 — https://overview.legal/posts/132610 — original: https://doi.org/10.32842/2078-3736/2023.2.2.20*

134 ПРАВО І СУСПІЛЬСТВО № 2 / 2023. Т. 2 ЛУЦЕНКО О. Є., кандидатка юридичних наук, доцентка кафедри трудового права права (Національний юридичний університет імені Ярослава Мудрого) УДК 349.2:[342.721:004.056.5] DOI https://doi.org/10.32842/2078-3736/2023.2.2.20 ПРАВОВЕ РЕГУЛЮВАННЯ ЗАХИСТУ ПЕРСОНАЛЬНИХ ДАНИХ ПРАЦІВНИКІВ ЗА GDPR У статті висвітлюється, що Регламент GDPR діє екстериторіально, оскільки поширюється на суб’єктів, що отримують та обробляють персональні дані гро - мадян та резидентів ЄС незалежно від свого місцезнаходження. GDPR не вима - гає, аби національні уряди розробляли спеціальні акти для його впровадження, і є безпосередньо обов’язковим до виконання. Авторка встановила, що відповідно до GDPR, працівник повинен мати можливість чітко розрізняти дані, на обробку/зберігання яких він/вона вільно погоджується та знати цілі, для яких зберігаються його/її дані. Співробітники також повинні бути проінформованими про свої права та тривалість часу, про - тягом якого дані зберігатимуться, перш ніж можна буде надати згоду. Якщо порушення персональних даних може призвести до високого ризику для прав і свобод фізичних осіб, то роботодавець повинен сповістити про це працівника. GD

### GDPR and employee data protection: Cyber security data example

*Source: Cyber Security: A Peer-Reviewed Journal, 2018-06-01 — https://overview.legal/posts/132525 — original: https://doi.org/10.69554/qnbm9205*

This paper explores the implications of the European Union (EU) General Data Protection Regulation (GDPR) on employee personal data, specific to data elements that might be collected by Information Security (IS) in the effort to protect and defend the environment from data breach and exfiltration. GDPR compliance became effective in May 2018, and many organisations are still working through the strategic complexities of GDPR’s impact on their organisation. Using an example of a phishing assessme

### GDPR Implementation Series ∙ Austria: A Brief Overview Concerning the Implementation of the GDPR

*Source: European Data Protection Law Review, 2017-01-01 — https://overview.legal/posts/132489 — original: https://doi.org/10.21552/edpl/2017/2/12*

### GDPR Implementation Series ∙ Malta: An Overview of the GDPR Implementation

*Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132480 — original: https://doi.org/10.21552/edpl/2020/4/15*

### GDPR Implementation Series ∙ Romania: Overview of the GDPR Implementation

*Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132479 — original: https://doi.org/10.21552/edpl/2018/3/16*

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Human Resources** — https://overview.legal/topics/human-resources
  Processing of employee and HR data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Monitoring** — https://overview.legal/topics/monitoring
  Systematic observation and tracking of individuals

---
Generated by overview.legal · https://overview.legal/topics/employees · 2026-10-13