Employee monitoring and GDPR: why consent fails and what works

In December 2024, France’s data protection authority, the CNIL, fined a small real estate company 40,000 euros for watching its staff too closely. Its software counted “idle” minutes and took screenshots of staff computers every 3 to 15 minutes. Any small or mid-sized company that records how people work, even just to find tasks worth automating, answers to the same GDPR rules.

Screen recordings, task mining logs, app usage logs and email metadata are personal data under the GDPR once they relate to an identifiable person. The obvious first step, asking staff to agree, is the one European regulators say rarely holds up.

So on October 20, 2026, we read the regulators’ own texts: the GDPR, EU guidance, the UK’s ICO, Sweden’s IMY and two French fines. Below are the texts side by side, the design choices they reward and a checklist for a 20-person company. It is a reading of the sources, not legal advice.

Consent fails because staff cannot freely say no

The GDPR allows consent, but recital 43 says it “should not provide a valid legal ground” where “there is a clear imbalance between the data subject and the controller.” Article 7(4) sets out how to judge whether consent was freely given. The EDPB’s point is simple: an employee who fears what a refusal might cost is not free.

Every text we read applies this to work, in nearly the same words:

Source	On consent at work	On monitoring tools
WP29 Opinion 2/2017 (EU advisory body)	Employees “are seldom in a position to freely give, refuse or revoke consent”	Software logging keystrokes, screens and apps used is “disproportionate”; a legal ground for recording keystrokes is “very unlikely”
EDPB Guidelines 05/2020	“Problematic for employers”; for most processing at work the basis “cannot and should not be the consent of the employees”	Names workplace camera monitoring as a request staff are unlikely to answer freely
ICO, monitoring workers (UK)	“Not usually appropriate in the employment context, due to the imbalance of power”	Gives keystroke monitoring as an example of high-risk processing; guidance under review after the Data (Use and Access) Act
IMY (Sweden, updated June 15, 2026)	Does not think an employer can use consent as the legal basis for monitoring staff (our translation)	Using an IT system to monitor in real time, or otherwise regularly, how staff work or take breaks is as a rule not allowed (our translation)

The 2017 opinion came from the Article 29 Working Party, a European advisory body set up under the old directive. The EDPB’s 2020 guidelines, written for the GDPR, agree.

There is one narrow exception. The EDPB says employees can consent freely only “when it will have no adverse consequences at all whether or not they give consent.” Its example is a film crew in an office: staff who do not want to be filmed “are not penalised in any way” and get equal desks elsewhere. A recording tool that a manager proposes to a team will rarely clear that bar.

Legitimate interest is the usual route, with a three-part test

With consent out, the regulators point to legitimate interest. Article 6(1)(f) allows processing “necessary for the purposes of the legitimate interests pursued by the controller,” unless the person’s rights override them. The 2017 opinion names it as an alternative, then warns that “a legitimate interest in itself is not sufficient to override the rights and freedoms of employees.”

The ICO breaks the test into three questions. Is there a legitimate interest behind the processing? Is the processing necessary for that purpose? Do the person’s interests, rights or freedoms override it?

We think finding work to automate can pass the first question. The second and third are the hard part. The ICO says: “If you can achieve your aim in a less intrusive way, you must do so.”

IMY puts a weight on the scale: security reasons count for more than efficiency reasons (our translation). Automation is an efficiency reason.

Legitimate interest also gives staff rights. Under Article 21, a person can object, and the employer must then stop unless it shows “compelling legitimate grounds.” Article 13(1)(d) requires telling people which legitimate interest you rely on.

IMY accepts the employment contract as a basis when measuring performance is needed to pay agreed performance-based wages. An automation study is not that, so most projects come back to the balancing test.

The impact assessment is likely required

Article 35 requires a data protection impact assessment (DPIA), a written risk analysis done before processing starts, when processing “is likely to result in a high risk.” The EU guidelines on DPIAs (WP248) list nine risk criteria and say that in most cases, meeting two calls for one. Systematic monitoring is a criterion, and employees can count as vulnerable data subjects, which is another.

The guidelines then give an example that reads like a task mining pilot: “A company systematically monitoring its employees’ activities, including the monitoring of the employees’ work station, internet activity.” Their answer to whether a DPIA is likely required is yes.

The ICO says a DPIA is a must for high-risk monitoring and that you “should carry out a DPIA even if there is no specific high risk.” If the DPIA finds a high risk you cannot reduce, the ICO says you must consult it before you start. The French company in our opening skipped this step, and the CNIL counted that as its own breach of Article 35.

National law adds its own rules

Article 88 lets EU countries set more specific rules for employee data “by law or by collective agreements,” with particular regard to “monitoring systems at the work place.” So the GDPR is only part of the answer.

Two examples show how much this varies. In Germany, a works council has a co-determination right under section 87(1) no. 6 of the Works Constitution Act. It covers “the introduction and use of technical devices designed to monitor the behavior or performance of employees” (our translation).

In Sweden, IMY says an employer’s right to monitor staff is governed first by employment law and collective agreements. The co-determination act (MBL, section 11) makes an employer with a collective agreement negotiate with the union before an important change to its operations, or to working conditions for the union’s members. IMY notes that such a duty can apply to workplace cameras.

For the UK, the ICO says you “should seek and document the views of your workers or their representatives (such as trade unions).” Check your own country’s employment law before you buy a tool.

Two French decisions show where the line sits

The real estate company is the clearer case. Its software marked 3 to 15 minutes without a keystroke or mouse movement as idle, and idle time staff could not justify or make up could be docked from pay. The CNIL noted that time away from the keyboard can be real work, such as meetings or calls, so the tool could not count hours reliably. It found no legal basis for that or for the screenshots, which could capture personal emails, chats and passwords.

The company had also filmed staff continuously with two cameras. Its written notice to staff fell short, and oral briefings left no record, so the CNIL found breaches of the information rules too.

The Amazon case shows the other side. In December 2023, the CNIL fined Amazon France Logistique 32 million euros, mainly over indicators drawn from the handheld scanners its warehouse staff use. Amazon appealed, and on December 23, 2025, France’s Conseil d’État cut the fine to 15 million euros.

Guess which part survived. The court found that three scanner indicators did not breach the legitimate interest rule. One flagged two scans less than 1.25 seconds apart; another recorded idle time only after more than ten minutes in a row. What it kept was the data minimization breach: storing all the indicators for 31 days, for several purposes at once, when Amazon could not show why each needed that long.

Findings on staff information and security, which Amazon did not contest, also stood. Our reading: a narrow measurement tied to a clear purpose can pass, while keeping everything for 31 days cannot. Amazon runs warehouses, not an office, and the court judged it on those facts. Breaches of Articles 5 and 6 can cost up to 20 million euros or 4% of worldwide turnover, whichever is higher, under Article 83(5).

Design choices that lower the risk

Each choice below is tied to what a regulator wrote.

• Aggregate where you can. IMY says the employer must first decide whether the purpose needs follow-up on individuals or whether group level is enough. The ICO suggests “aggregated analytics reports” that “identify trends without identifying individual workers.”
• Keep raw data local and show the employer less. The 2017 opinion says both what is recorded and “the information that is shown to the employer, should be minimized as much as possible.” It describes systems that record data “without presenting it to the employer.” Processing on the worker’s own machine and sharing only a summary follows that logic, in our reading.
• Skip keystroke logging and screenshots. The ICO calls keystroke monitoring behavioral biometric data where a worker can be identified by typing rhythm. The CNIL found that screenshots could capture passwords.
• Sample instead of recording all day. The 2017 opinion lists “sampling instead of continuous monitoring” as a limit and says personal files and communications should not be monitored. Its list of disproportionate software also includes logging which apps were used and for how long, so keep even app logs short and narrow.
• Set a short retention period up front. The ICO says “you should not retain information just in case.” Amazon could not justify keeping every indicator for 31 days.
• Let individuals opt in, as a safeguard. A volunteer who picks one task to record is close to the EDPB’s film crew example. Given IMY’s position, we would still document legitimate interest as the basis and treat opt-in as extra protection.

What this means for you: a checklist for a 20-person company

The decision is how much detail you need. A tally kept by staff, or a log from systems you already run, carries far less risk. Our pieces on noticing what to automate and task mining versus process mining compare those options. If you still want to record work, this order follows the sources:

1. Write the purpose in one sentence, such as “find repeated data entry worth automating.” The ICO’s first test asks for a legitimate interest.
2. Try the least intrusive option first and write down why it is not enough (ICO; WP29 2017).
3. Do not use consent as the legal basis (EDPB 05/2020; ICO; IMY). Write a legitimate interest assessment that answers the ICO’s three questions.
4. Run a DPIA before any recording starts (Article 35; WP248’s workstation example) and keep it on file.
5. Check national law and involve staff representatives. In Germany that means the works council, if you have one (BetrVG section 87); in Sweden, a union you have a collective agreement with (MBL section 11). Elsewhere, at least record staff views, as the ICO advises.
6. Tell staff in writing before collection, including the legitimate interest and their right to object (Articles 13 and 21). Oral notice was not enough in the CNIL case.
7. Collect the minimum for a set sample period: no keystrokes or screenshots, and group reports rather than personal scores (Article 5(1)(c); WP29 2017; ICO; IMY).
8. Set and keep a deletion date for raw data once the candidates are found (Article 5(1)(e); the Conseil d’État on 31 days).
9. Keep the data out of pay and performance reviews. IMY says data collected for one purpose must not be used for other incompatible ones, and performance follow-up must be a stated purpose from the start. In the CNIL case, idle time could be docked from wages.

The French real estate company removed its software during the inspection. The CNIL chose not to name it because of its small size and that quick removal, and still fined it 40,000 euros. The cheaper version of that lesson is to write the DPIA before installing anything.

How we made this

We read the GDPR text, the 2017 working party opinion, the EU guidelines on impact assessments and on consent, the ICO’s monitoring guidance, IMY’s page and the two French decisions on October 20, 2026. The Swedish, German and French quotes are our own translations. We tested no monitoring tool, and none of this is legal advice.

Sources

• Regulation (EU) 2016/679 (GDPR): recital 43 and Articles 4, 5, 6(1)(f), 7(4), 13, 21, 35, 83(5) and 88. Text read from the EU Publications Office copy of the Official Journal.
• Article 29 Working Party, Opinion 2/2017 on data processing at work (WP249), adopted June 8, 2017.
• Article 29 Working Party, Guidelines on Data Protection Impact Assessment (WP248 rev.01), October 2017.
• European Data Protection Board, Guidelines 05/2020 on consent, version 1.1, May 2020, paragraphs 21 to 23.
• Information Commissioner’s Office, Data protection and monitoring workers and different methods of monitoring, under review after the Data (Use and Access) Act.
• Integritetsskyddsmyndigheten (IMY), Kontroll och övervakning av anställda, updated June 15, 2026.
• CNIL, Surveillance excessive des salariés : sanction de 40 000 euros, decision SAN-2024-021 of December 19, 2024.
• Conseil d’État, decision no. 492830, December 23, 2025 (Amazon France Logistique v. CNIL, reviewing CNIL decision SAN-2023-021).
• Germany, Betriebsverfassungsgesetz section 87; Sweden, lag (1976:580) om medbestämmande i arbetslivet.