Digitalization has definitively arrived in the workplace. It has become very easy and also inexpensive for employers to monitor employees in the workplace. However, employers must make a conscious and carefully considered decision before implementing a monitoring or control system. The monitoring measures may otherwise be impermissible. The following contains information regarding the legal principles that apply to workplace monitoring.

1. Conflicting interests

When monitoring employees in the workplace two legitimate interests collide: on the one hand, employees have a right to the protection of their personality rights and their personal integrity (in the sense of privacy). On the other hand, the employer has a legitimate interest and a right to verify that employees are carrying out the work assigned to them. These two conflicting interests must be balanced before the implementation of a monitoring system.

2. The Employer must have an outweighing interest

By law, monitoring and control systems intended to monitor the employees’ behavior in the workplace may not be used (Art. 26, para. 1 of Ordinance 3 to the Employment Act, EmpAO 3). If monitoring and control systems are required for other reasons, they are permitted, but they must be structured and organized so that they do not affect the health and freedom of movement of employees (Art. 26, para. 2 EmpAO 3). Thus, monitoring systems may not be used to monitor the employees themselves (e.g. to monitor their general behavior in the workplace, social interactions, etc.). The use of monitoring systems requires a specific purpose: the use of monitoring systems to monitor production processes, for security purposes and to evaluate performance has been acknowledged as necessary and therefore legitimate. However, it is difficult to clearly distinguish permitted performance monitoring from impermissible monitoring of behavior. In light of the increasing ease of collecting and, above all, assessing data, the difficulty in distinguishing the line between (permissible) data collection for performance monitoring and (impermissible) data collection for conduct monitoring will increase. For example, imagine a company where the employee badges have GPS transmitters (or other communication transmitters) – which every business smartphone is already equipped with anyway. Using location positioning, an employer can determine, for example, which employees spend time together and for how long. If the employees are reprimanded because they talked with one another for too long on the basis of this assessment, this would clearly be impermissible conduct monitoring. However, if the employer used the analysis of communication flows to optimize communications within the company, this could constitute permissible performance monitoring. For this reason, diligence should be applied when using HR analysis tools.

The question of the purpose of the monitoring is therefore central. The company’s interest in monitoring must clearly outweigh the employee’s interest in protecting his privacy. An example of an outhweighing interest would be video monitoring in a bank vault.

3. Make sure the measure is proportionate

If monitoring systems are used (because the employer has an outweighing interest in doing so), they may only be used in a manner that protects the personality rights and health of employees to the greatest extent possible. Therefore, a monitoring tool must be selected that achieves the monitoring objective (e.g. production monitoring) with the least impact on employees. This depends on the specific circumstances and the intended aim of the monitoring. For example, if access to a particular room is to be monitored, the use of a badge system is preferable to continuous video monitoring of the access area. If the use of a video camera is unavoidable, the camera must be positioned so that it generally records the subject of the monitoring (in the case of production monitoring, for example, the conveyor belt) and only records staff in exceptional cases. In this context, it is generally recommended that the camera be positioned so that it records the employees from behind. It should also be determined whether the monitoring measure needs to be active at all times. For example, it is permissible to record and assess the route taken by company vehicles of sales staff in order to optimize efficiency. But if employees are allowed to drive the vehicles for personal use, the recording must be deactivated during their free time.

The relevant measures must be reviewed on a regular basis to determine whether the monitoring measure is still required and thus whether it continues to meet the legal requirements. 

4. Collaboration of employees

If monitoring or control systems can also be used to monitor employees’ behavior (in addition to their intended purpose), the employees are entitled to be informed and consulted in advance about the measure that is to be introduced. In the case of video monitoring, this will regularly be the case. With respect to questions related to health protection, the employer must justify why he does not observe an objection raised by an employee or the employee representative. Careful (and documented) preparation of the introduction of the monitoring measure makes it easier for the employer to justify its decision.

The collection, storage and assessment of the data constitutes data processing pursuant to the Data Protection Act and must be carried out in accordance with the corresponding principles. The processing of the personal data of the affected persons must therefore always be carried out in a transparent manner. The affected employees must be informed in advance about the type, objective and purpose of processing. This is particularly true in connection with work-related IT systems, i.e. the use of work email accounts. It is therefore highly recommended that the use of business email and the internet is regulated in a respective policy. This will allow the employer to define employees’ rights and obligations in connection with the use of their email accounts as well as the monitoring mechanisms used to ensure compliance with these requirements.

5. Consequences of impermissible monitoring

Monitoring employees without fulfilling the legal prerequisites for doing so can have far-reaching consequences, including criminal prosecution. 

Monitoring employees without observing the legal requirements is a violation of the Employment Act, in particular, Art. 26 EmpAO 3. An inspector of the Labor Authority can ascertain and punish such a violation. Employers that use impermissible monitoring measures also open themselves up to anonymous reports by aggrieved employees. The Labor Authority is also permitted to access all the documents and data collected by the control and monitoring systems.

In relation to employees, the impermissible use of monitoring and control systems represents a violation of their personality rights and therefore a violation of the employer’s duty of care. Employees are entitled to compensation for the violation of their personality rights. The amount of such compensation is generally not substantial. However, impermissible monitoring may constitute reasonable grounds for termination by an employee, as a result of which any post-contractual non-compete obligation may not apply even though the employee gave notice of termination.

Furthermore, the recording of others’ conversations without their consent may also be a violation of Art. 179bis of the Criminal Code (CC), which can be punished by a prison sentence of up to three years or a fine. According to Art. 179quater CC, making video recordings without the consent of the affected person can be punished by a prison sentence of up to three years or a fine. In this connection, it is important for monitored areas to be clearly designated as such.

Evidence obtained using impermissible monitoring may be ruled as inadmissible. This means that the evidence may not be used in a trial. For example, if the emails of an employee are monitored without observing the requisite legal requirements, the content of the emails cannot be used in a trial against the employee.

6. Temporary storage only

As described above, companies must collect and process data in compliance with the Data Protec- tion Act. On the one hand, this means that the data must be collected in a transparent manner and in accordance with the principle of proportionality. Data may only be collected to the extent necessary. The data must then be deleted after a predefined period that should be as short as possible. In general, access to this data must be governed by internal regulations and limited to the persons who are capable of and authorized to assess it.

The person affected by the data collection has the right to view the data collected about them.

7. Recommendations

We recommend adhering to the following prin- ciples at all times when using monitoring and control systems:

  •  Conduct a thorough needs analysis before implementing a monitoring and control system. In doing so, ask what will be monitored or controlled with the intended measures (“What do I want to achieve?”). 
  •  This needs analysis should be repeated on a regular basis.
  •  When selecting the monitoring measure, ensure that it is proportionate (balanced relationship of the ends and the means) (“Only as much as necessary”).
  •  The documents outlining the mechanism, type and timing of the recording and any needs anal- ysis must be retained.
  •  If the monitoring mechanism also records employees’ behavior, employees must be consulted in advance. A record must be kept of this.
  •  A policy must be issued for business email accounts and the use of the internet outlining the rights and obligations of employees as well as the employer’s control options.