Monitoring

Legal Framework

Monitoring of individuals triggers several GDPR provisions. Article 3(2)(b) extends the Regulation's territorial reach to controllers outside the EU that monitor the behaviour of data subjects within the Union — a provision that anchors the GDPR's extraterritorial grip on cross-border tracking and surveillance.

"the monitoring of their behaviour as far as their behaviour takes place within the Union."
— GDPR Art. 3(2)(b)

Where monitoring is systematic and large-scale, it also drives mandatory organisational obligations. Article 37(1)(b) requires designation of a Data Protection Officer when the controller's core activities consist of "regular and systematic monitoring of data subjects on a large scale." Similarly, Article 35(3)(c) mandates a Data Protection Impact Assessment for "a systematic monitoring of a publicly accessible area on a large scale." Article 23(1)(h) permits Member States to restrict GDPR rights for monitoring functions connected to the exercise of official authority, but only where proportionate and necessary in a democratic society.

Key Developments

The CJEU's ruling in WORTEN clarifies that monitoring by public authorities — in that case, inspection of working-time records — must be narrowly tailored to the legal obligation being enforced. The Court held that access to personal data by a national monitoring authority is permissible only where the authority genuinely holds powers in that specific field.

"only the grant of access to authorities having powers in that field could be considered to be necessary within the meaning of Article 7(e) of Directive 95/46"
— WORTEN ¶36

The Court also acknowledged that employer surveillance measures may be justified as "measures necessary" to ensure compliance with working-time directives, but the employer in WORTEN argued the interference was excessive — illustrating that even lawful monitoring must survive a proportionality test. Enforcement actions reinforce this: the Spanish DPA sanctioned a controller for surveillance cameras facing public highways without authorisation, and the Italian Garante fined an agency €50,000 for remote-work monitoring that lacked adequate safeguards.

Status of the Debate

This topic is actively contested in court. The boundaries of lawful monitoring are not settled: courts diverge on what constitutes "systematic" and "large-scale" monitoring under Article 35(3)(c), and on how proportionality should be calibrated when monitoring serves a legitimate regulatory or employer interest. The WORTEN line of authority provides a necessity-and-proportionality framework, but later enforcement decisions — particularly on workplace surveillance and CCTV — apply it inconsistently. What would resolve the open question is further CJEU guidance on the threshold for "regular and systematic" monitoring under Article 37(1)(b) and on the proportionality limits of employee monitoring under legitimate-interest grounds.

Practical Guidance

• Assess scale and systematicity early. Determine whether your monitoring qualifies as "regular and systematic" and "large scale" under Article 37(1)(b); if so, appoint a DPO before processing begins.
• Conduct a DPIA for large-scale public-area monitoring. Article 35(3)(c) makes this mandatory; document the necessity and proportionality analysis in writing.
• Limit access to data collected through monitoring. Following WORTEN, ensure that only authorities or personnel with a genuine remit in the relevant field can access monitoring data — broad access undermines the necessity justification.
• Check extraterritorial exposure. If your organisation is outside the EU but monitors behaviour of individuals in the Union, Article 3(2)(b) applies; designate an EU representative under Article 27.
• Document proportionality for workplace monitoring. Employer surveillance must be the least intrusive means of achieving the stated objective; the Italian Garante's €50,000 fine demonstrates that blanket remote-work monitoring without targeted safeguards will not withstand scrutiny.