Findings
13 Lawful basis not recorded for an EU or UK line
In the EU and the UK every monitoring purpose needs its own Art. 6 basis, documented from the start. Consent is rarely free at work. In Germany section 26(1) sentence 1 of the BDSG is not a basis on its own (C-34/21): the basis is an Art. 6(1) ground or a works agreement meeting Art. 88(2).
For the DPO: Which Art. 6 basis covers this practice, or which works agreement meeting Art. 88(2), and where is it documented?
Where it comes from, location by location
- Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
- Lawful basisofficial guidance, not lawEmployers should not rely on consent for video; national law or works agreements may set employment rules. EDPB video guidelines para 3.3(b) official guidance, not law
- Lawful basisstatutory requirementEmployee data only where necessary for the employment relationship; consent only where genuinely voluntary, in writing or electronically, with notice of the right to withdraw. BDSG s 26(1) sentence 1BDSG s 26(2)
- Lawful basisstatutory requirementEvery restriction on employees' rights justified by the task and proportionate to the aim. Code du travail L1121-1
- Lawful basisstatutory requirementAn Art. 6 basis chosen for the specific purpose and documented from the start; consent rarely valid; legitimate interests with a recorded assessment. UK GDPR Art. 6ICO monitoring guidance para 1.4(a)ICO monitoring guidance para 1.4(b)ICO monitoring guidance para 1.4(d)
- Lawful basisstatutory requirementCriminal offence data only under official authority or where law authorises it, with an Art. 6 basis as well. GDPR Art. 10
- Lawful basisofficial guidance, not lawOffence data only under official authority or a specific condition in domestic law. ICO monitoring guidance para 1.6 official guidance, not law