Privacy at work: monitoring, cameras and employment data

Privacy at work: monitoring, cameras and employment data

An access pass, camera, business mailbox or personnel file contains information about you. Employer ownership of equipment does not make every form of monitoring permissible. An employer may nevertheless have legitimate security or misconduct-investigation interests. Identify the information collected, purpose and consequences first. Specific questions and a careful record make a privacy discussion more practical than assumptions about everything a system might technically be able to do.

Monitoring requires an appropriate legal basis, necessity and balancing of interests; employee consent is often problematic because of dependency.

Hidden monitoring has strict additional conditions and is not an ordinary substitute for transparent policy.

The works council may have consent rights concerning tracking systems, but that does not replace your individual privacy rights.

1. Describe the processing before reaching conclusions

Identify the system and what it records: logins, location, visits, images, productivity or communications. Security logs may later be used to assess employees, so ask about the actual and announced purpose. Check the privacy statement, handbook and separate notices you received. Distinguish data about you from general business information. Ask which organisation is responsible, whether an outside supplier processes data and who sees the results. A foreign supplier does not automatically make monitoring unlawful, but raises access, transfer and safeguard questions. Describe observations rather than treating a system's potential capabilities as proof that they are being used. Dates, messages and identifiable uses help frame a question the employer can answer concretely.

2. Assess necessity and proportionality

An employer must explain why processing is needed and why a less intrusive approach will not suffice. Protecting money or customer data may be a purpose but does not justify every method automatically. Consider duration, frequency, staff affected and sensitivity. Continuous screenshots differ from a limited investigation into a particular event. Ask whether security data are later used for performance assessments or disciplinary action. Signing a handbook does not resolve every question. Because employment involves dependency, freely given consent is often difficult to establish. Request a separate explanation of purpose, legal basis and balancing, and put uncertainties in writing. Assess both the original collection and later uses instead of assuming one valid security purpose covers all employment decisions.

3. Cameras, location and covert monitoring

Images and location data can reveal much about behaviour and contacts. A sign announcing cameras does not make every use permissible. Ask which area is filmed, whether audio is recorded and why continuous tracking is needed. Covert monitoring has strict additional requirements: suspicion or a practical problem is not blanket permission for unlimited surveillance. AP guidance addresses a targeted, temporary approach and prior consideration of risks. Do not disable security systems through technical countermeasures. Gather policy, relevant messages and a chronology instead, and request explanation. If accused of misconduct, assess both the monitoring and the resulting employment measure. A privacy issue and an allegation about conduct are related questions but do not automatically determine one another's outcome.

4. Works council, privacy officer and personnel records

The works council often has a formal role concerning rules for staff-data processing and employee-tracking systems. This can also arise where a system could track staff but is not yet used that way. Ask what was approved and within which limits. A data protection officer, where appointed, supervises privacy compliance internally; HR is not automatically that same independent role. For your own file, request access specifically to your personal data. The right concerns personal data and processing information, not necessarily every entire document or other people's data. Indicate the period, category or decision you need to understand. This produces a useful request and distinguishes it from a general employment complaint or a demand for unrestricted corporate files.

5. Prepare access, correction or complaint requests

State whether you seek an explanation, access, correction of factual errors or assessment of unlawful processing. Identify events and retain your sent request. A disagreement with an assessment is not always an objective inaccuracy requiring deletion; ask to attach your response and explain the processing. An organisation should normally respond to a privacy request within one month; conditional extensions require timely explanation. If refused, request reasons and available challenge or complaint routes. Share only identification information that is necessary. An AP complaint and a court claim about pay or dismissal have different purposes and deadlines. Record those separately rather than expecting the privacy regulator to grant the employment remedy you want.

Example: security logs become performance scores

In a performance meeting you learn that login times are used as productivity figures. Ask which records are involved, how remote work and other tasks count, what purpose was announced and who checks the figures. Record factual errors in the assessment too; a privacy request alone does not answer the performance criticism.

6. Handle health, home working and evidence safely

Medical data require additional protection. Discuss diagnoses and medical limitations with the occupational physician; managers do not automatically have access to your full medical file. Home working does not lower the threshold for technical surveillance. Ask whether task and outcome agreements achieve the same purpose less intrusively. Prepare a chronology and keep material lawfully available to you. Do not download customer databases or colleagues' mailboxes to prove a point. Store documents securely and share selectively with an adviser. Privacy rights do not suspend employment-law deadlines. A dismissal, pay suspension or penalty may require immediate action alongside an access request. Keep both tracks visible so that a slow information dispute does not prevent timely protection of your income or job.

Identify system, data, period and concrete consequences.

Keep the privacy notice, monitoring policy and relevant messages.

Ask about legal basis, necessity, access and retention.

Involve the works council or data protection officer where appropriate.

Track employment-dispute deadlines alongside the privacy request.

Is monitoring lawful because my employer owns the laptop?

Ownership does not create unlimited monitoring rights. Processing must satisfy privacy rules and fit an explained purpose. The content, scope and consequences of monitoring matter as well as the equipment's ownership.

Can I always obtain the entire personnel file without redactions?

Access rights concern your personal data and processing information. They do not automatically give an unfiltered copy of every document. Other people's rights and applicable exceptions may matter; request an explained decision rather than assuming unrestricted access.

Does works-council approval settle everything?

No. Collective participation and the lawfulness of specific data processing are separate issues. Approval does not remove individual rights or automatically justify every later use of the system for different employment decisions.

Does my dismissal deadline wait for the AP?

Do not assume so. A privacy complaint or access request does not automatically suspend statutory employment-law deadlines. With dismissal or another urgent measure, obtain immediate advice on action needed in parallel with the privacy process.

Sources and editorial notes
Sources current as of: October 18, 2026
1. Autoriteit Persoonsgegevens: additional requirements for covert monitoring
Publisher: Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl/themas/werk-en-uitkering/controle-van-werknemers/voorwaarden-voor-heimelijke-controle-werknemers
2. Autoriteit Persoonsgegevens: works councils and employee-tracking systems
Publisher: Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl/themas/werk-en-uitkering/ondernemingsraad/de-or-en-personeelsvolgsystemen
3. Autoriteit Persoonsgegevens: home working and monitoring
Publisher: Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/corona/veilig-thuiswerken-tijdens-corona
4. Autoriteit Persoonsgegevens: access rights and response times
Publisher: Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/privacyrechten/recht-op-inzage
The source publications are in Dutch. All language editions cover Dutch law.