Employee monitoring laws in France

The CSE is informed and consulted, before the decision to implement them in the undertaking, on the means or techniques allowing control of employees' activity; L2312-37 item 1 lists the implementation of such means among the one-off consultations. This covers video surveillance, geolocation and vehicle telematics, badge and time clocks, call listening and recording, email and internet logging, screen capture, activity or keystroke software and productivity indicators. A device implemented without this consultation is unlawful, and failure to consult can constitute the offence of obstruction (L2317-1).

In undertakings of at least 50 employees, the CSE is informed and consulted on matters concerning the organisation, management and general running of the undertaking, including the introduction of new technologies and any significant change to health and safety or working conditions (item 4 of L2312-8 II), and on the environmental consequences of those measures (L2312-8 III). The CSE may appoint an expert on such projects (L2315-94 item 2, costs shared 80 percent employer and 20 percent CSE under L2315-80).

The employer's decisions are preceded by the consultation of the CSE (except before a public takeover bid under L2312-49). Draft collective agreements are not submitted to consultation. A monitoring project must therefore be presented to the CSE while it can still influence the decision, before any contract signature or deployment.

Before any monitoring device is implemented, the employer consults the CSE in private undertakings of 50 employees or more (and EPIC and EPA employing private-law staff), or the CSA, CST or CSE and their specialised formations in public bodies. Installing a badge reader or video surveillance of staff without prior CSE consultation in an undertaking of 50 or more is given as an unlawful implementation.

Staff representative bodies must be informed and consulted before any decision to install cameras.

Staff representative bodies must be informed or consulted before any decision to install geolocation in vehicles provided to employees. Each employee is informed of the controller's identity, the purposes, the legal basis, the recipients, the right to object on legitimate grounds, the retention period, the rights of access and rectification and the right to complain to the CNIL, for example by a contract amendment or a service note. The DPO, if any, is involved and the system is entered in the record of processing.

Staff representative bodies are informed and consulted before any decision to install call listening or recording. Employees and callers are informed of the device, the controller, the purposes, the legal basis, the recipients, the retention, the right to object, access and rectification and the right to complain to the CNIL; callers are told orally at the start of the call (existence, purpose, possibility to object before the end of the call) with a pointer to full information. Under labour case law, employees must be told the periods during which they may be listened to or recorded. The DPO is involved and the system entered in the record of processing.

Staff representative bodies are informed or consulted before an activity-control device on IT tools is implemented. Each employee is informed of the purposes, legal basis, recipients, retention, rights of objection, access and rectification and the right to complain to the CNIL, through a charter (annexed or not to the internal rules), an individual note or a service note. The DPO is involved and each IT control system is entered in the record of processing.

Staff representative bodies should be informed or consulted before any decision to install a time or access control device. Each employee is informed clearly, concisely and accessibly of the purposes, the legal basis, the recipients, the retention period, how to exercise rights (access, rectification, erasure, objection where applicable, restriction) and the right to complain to the CNIL, for example through an IT charter or a service note.

Where workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.

Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for at least 6 months (longer where required); inform workers/representatives where used in the workplace; carry out a DPIA where required under GDPR; and where a deployer is a public authority, register the system in the EU database.

Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis, the recipients or categories of recipient, and any intention to transfer to a third country with the existence or absence of an adequacy decision and, for Article 46, 47 or 49(1) transfers, reference to the safeguards and how to obtain a copy. Provide in addition the storage period or the criteria used to determine it, the existence of the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent where consent is the basis, the right to lodge a complaint with a supervisory authority, whether providing the data is a statutory or contractual requirement and the consequences of not providing it, and the existence of automated decision-making including profiling with meaningful information about the logic involved and its significance and envisaged consequences. Before further processing for a new purpose, provide that purpose and the further information first.

Workers must be told that monitoring exists, the purposes for which their data will be processed and any other information needed for fair processing; covert-capable technology makes this more pressing. Section 6.3 adds that communication should be effective and cover the circumstances of monitoring and how workers can prevent their data being captured, and that monitoring policies and rules should be clear and readily accessible.

The sign should be placed so that people notice the surveillance before they walk into the covered zone, at roughly eye level. Camera positions need not be revealed so long as there is no doubt which areas are monitored and the context is unambiguous; people must be able to judge what a camera captures so they can avoid it or adapt their behaviour.

The employer must clearly tell employees that a tracking device is installed in the company vehicle they drive, that their movements are recorded while they use it and, depending on the technology, that their driving behaviour may be recorded too; ideally this notice is shown clearly inside each vehicle where the driver can see it.

No information concerning an employee personally may be collected by a device ("dispositif") that has not first been brought to the employee's knowledge. This is the individual notice duty for every monitoring technology: video, geolocation, badge systems, call recording, IT and email logging, screen capture, keystroke or activity software. Evidence gathered through an undisclosed device is, in principle, not usable to justify a sanction.

The device must be brought to the knowledge of the persons concerned before it is put in place, to meet the employer's duties of loyalty and information (Code du travail L1222-4 and GDPR article 13).

An employee is expressly informed, before they are used, of the professional evaluation methods and techniques applied to them. The results are confidential. Evaluation methods and techniques must be relevant to the purpose pursued. Productivity scoring, call evaluation and dashboard indicators used to evaluate staff fall under this duty.

No information concerning a job candidate personally may be collected by a device ("dispositif") that has not first been brought to the candidate's knowledge. Covert collection, for example undisclosed background scraping, recorded interviews or tracking tools, is prohibited.

Employees and visitors are informed by permanently displayed, visible signs in the areas concerned carrying at least a camera pictogram, the purposes, the retention period, the name or role and telephone number of the controller or DPO, the existence of data protection rights, and the right to complain to the CNIL with its contact details. The rest of the article 13 information (legal basis, recipients including those outside the EU, automated decision-making or profiling if any) may be given by other means such as a website.

Before any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.

Workers and their representatives should be told about every data collection process, the rules governing it and their rights.

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, erasing or rectifying inaccurate data without delay; keep it in a form permitting identification no longer than the purpose requires; and secure it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical or organisational measures. The controller is responsible for all six principles and must be able to demonstrate compliance with them.

Covert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.

Reasonable expectations are judged objectively, by whether a neutral third party would expect monitoring in that situation. An employee at the workplace in most cases does not expect to be monitored by the employer; monitoring is not expected in private gardens, living areas, examination and treatment rooms, and it is an intense intrusion in sanitary or sauna facilities, where no surveillance should take place. People can also expect freedom from monitoring in publicly accessible areas used for rest, recovery and leisure or where they sit and talk (restaurant tables, parks, cinemas, fitness facilities). A sign announcing cameras does not change what people can objectively expect.

To keep the balance under legitimate interest, the employer should put limits on monitoring suited to its form: geographical limits (monitoring only in specific places, and never in sensitive areas such as places of worship, sanitary facilities and break rooms), data limits (no monitoring of personal electronic files and communications) and time limits (sampling rather than continuous monitoring).

Cameras must not film staff break or rest areas or toilets; where vending machines are damaged, the camera films only the machines, not the whole room. They must not film union or staff representative premises, nor the access to them where it leads only to those premises.

Given how sensitive location data is, a lawful basis for following where employees' vehicles are beyond agreed working hours will rarely exist. If there is a real need, such as theft prevention, the implementation should be proportionate: no location registered outside hours unless the vehicle leaves a broadly defined region, and location revealed only on a break-glass basis when it does.

A geolocation device in a vehicle provided to an employee may not be used to check speed limits or to monitor the employee permanently; in particular not in the vehicle of an employee free to organise their own travel (such as a sales representative), not to follow staff representatives in their mandate, not to collect location outside working time (commute, breaks), even against theft or to check vehicle-use rules, and not to calculate working time where another device already exists.

Employees must be able to deactivate the collection or transmission of location outside working time. The employer may check the number or duration of deactivations, ask the driver for explanations and sanction abuse. Employees are informed of the installation and can access their location data on request.

Real-time listening and recording of calls at work are possible where the need is recognised and proportionate: occasional listening or recording to train or evaluate employees, to improve service quality, or in limited cases provided by law as proof of a contract or transaction. Only the data needed are processed (identification of the employee and evaluator, technical call data, the professional evaluation).

The employer may not set up permanent or systematic listening or recording save where a legal text provides for it (emergency services, for example), and may not record all calls to deal with abusive callers: a less intrusive means is chosen, such as a system letting the employee trigger recording when a problem arises.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orientation, unless one of the Article 9(2) conditions applies: explicit consent, employment and social security law obligations, vital interests where the data subject cannot consent, the legitimate activities of a not-for-profit body, data manifestly made public by the data subject, legal claims or courts acting judicially, substantial public interest under Union or Member State law, preventive or occupational medicine and health or social care under an obligation of professional secrecy, public health, or archiving, research and statistics under Article 89(1). The condition applies in addition to an Article 6 lawful basis, never in place of it.

Facial recognition and other biometrics carry heightened risks and must respect lawfulness, necessity, proportionality and minimisation; the controller should first weigh the effect on fundamental rights and look at less intrusive means. Article 9 applies when three criteria meet: physical, physiological or behavioural characteristics, a specific technical processing, and the purpose of uniquely identifying a person. Classifying people by age or gender without templates to identify them is outside Article 9, but storing templates to recognise someone again (re-entry, repeat targeting) is inside it from the start. Biometric recognition that private organisations install for their own ends will in most cases need explicit consent from everyone concerned.

Devices for managing working hours and presence must be proportionate. Controlling hours with biometric devices (fingerprint, facial recognition) or with systematic photographs at each clock-in appears excessive and contrary to data minimisation for the purpose of time control.

Prohibited AI practices. Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education (except where the AI system is intended for medical or safety reasons, Art. 5(1)(f)), biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).

Video analytics that read workers' facial expressions automatically or flag deviations from set movement patterns are disproportionate to employees' rights and generally unlawful, and are likely to involve profiling and automated decisions; employers should refrain from facial recognition technology, and marginal exceptions cannot justify its general use. Under the GDPR, biometric identification also needs an Article 9(2) exception.

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before the processing begins; a single assessment may address a set of similar operations presenting similar risks. An assessment is required in particular for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based, for large scale processing of special category or criminal offence data, and for systematic monitoring of a publicly accessible area on a large scale. Seek the advice of the data protection officer where one is designated, and where appropriate seek the views of data subjects or their representatives. The assessment must contain at least a systematic description of the envisaged operations and purposes including any legitimate interest pursued, an assessment of the necessity and proportionality of the operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Carry out a review where necessary and at least when the risk represented by the processing operations changes.

Where monitoring, particularly with new technology, probably carries high risk, such as systematic and extensive automated evaluation with significant effects, the employer must assess its impact on data protection (a DPIA), and if the residual risk remains high it must consult the supervisory authority before starting. EDPB Opinion 12/2018 later confirmed that employee monitoring can meet the vulnerable data subjects and systematic monitoring criteria for a DPIA.

Whatever legal ground is used, the employer should apply proportionality and subsidiarity and should run a proportionality test before processing begins: whether the processing is needed for a legitimate purpose, whether it is fair, proportionate to the concern and transparent, and which measures keep any intrusion into private life and the secrecy of communications to the minimum. The test can sit inside a data protection impact assessment, and section 6.2 repeats it for every monitoring tool before deployment.

Software that logs keystrokes and mouse movements, captures screens at random or set intervals, logs applications used and for how long, or switches on webcams to collect footage is disproportionate, and a legitimate interest ground for it will very rarely exist, recording keystrokes and mouse movements being the Opinion's example. The risks of remote working should be met proportionately, whatever the technology, especially where business and private use blur.

Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract between the data subject and the controller, is authorised by Union or Member State law that lays down suitable safeguards, or is based on the data subject's explicit consent. Where the contract or explicit consent route is used, implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express a point of view and to contest the decision. Such decisions must not be based on special categories of personal data unless explicit consent or substantial public interest applies and suitable safeguards are in place.

A DPIA is required where processing is likely to result in high risk, including large-scale systematic monitoring of areas open to the public (Article 35(3)(c)) and large-scale processing of special categories (Article 35(3)(b)); national DPIA lists must be consulted, and since typical surveillance purposes often call for one, many video surveillance cases will need a DPIA, whose outcome should drive the measures chosen. If high risk remains despite planned measures, the supervisory authority must be consulted before processing starts.

Placing staff under permanent surveillance is in general an excessive interference with their rights. Exceptions are limited to cases justified by the nature of the task where the device does not serve to watch how staff perform (for example permanent geolocation of an emergency vehicle so the nearest crew can be dispatched).

Software recording every keystroke (keylogger) to monitor an employee, including one teleworking, is disproportionate: it cannot separate professional from personal information, risks capturing private-life elements and places the person under constant surveillance. The internet and email fiche treats keyloggers as unlawful save an exceptional circumstance tied to a strong security imperative.

Telework does not change the limits on control. The following are incompatible with the principles: constant video (webcam) or audio surveillance, such as requiring an employee to stay on video all day; permanent screen sharing; keyloggers; and requiring very frequent actions to prove presence (clicking every few minutes, taking photos at intervals). Control by objectives over a period, reasonable and measurable, and regular reporting by the employee are suggested instead.

No one may restrict the rights of persons or individual and collective freedoms unless the restriction is justified by the nature of the task to be performed and proportionate to the aim pursued. Every monitoring device, rule or practice (video, geolocation, IT logging, call recording, time clocks, productivity indicators) must therefore be justified by the task and proportionate to its purpose; the courts derive from this article the employee's right to respect for private life at the workplace and during working time. The CNIL reads it as the first of three cumulative conditions for any activity-control device.

In principle there may be no screen capture coupled with call recording: a screenshot is a frozen image of an isolated action that does not faithfully reflect the work and is likely to be neither relevant nor proportionate whatever the purpose; it risks capturing private items (personal emails, instant messages, passwords, union activity).

Recording a video of the screen together with the call can be proportionate only for training staff, with all of these safeguards: employees are informed; the video is limited to the business application window concerned; it runs only during a call (starting when the handset is lifted and stopping when it is replaced); it concerns only people with a real training need (inexperienced or new staff) and in volumes matched to the capacity to analyse them; employees are trained only on their own recordings unless others are anonymised; access is limited and logged; and all call-recording safeguards apply. Used for evaluation, internal fraud or any purpose other than training, the coupling is disproportionate.

Monitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.

Output from electronic surveillance should never be the sole input when a worker's performance is judged.

Employers should keep monitoring data accurate and retain it only as long as necessary; section 6.4 adds that data from monitoring should be stored for the shortest time needed, under a specified retention period, and deleted once no longer needed.

Footage may not be kept longer than the purpose needs, subject to any national storage periods. Since damage is usually noticed within a day or two, footage should in most cases be erased after a few days, ideally automatically, and the longer the period, especially beyond 72 hours, the more justification is needed. Where the controller stores footage, storage must be shown to be necessary and the period must be clearly defined for each purpose; retaining specific footage longer to pursue an identified incident remains possible.

The employer defines the retention period of images in line with the purpose; in principle it does not exceed one month, and a few days usually suffice to check an incident. Images extracted for disciplinary or criminal proceedings are logged in a dedicated register and kept for the proceedings. The maximum period may not be set by the recorder's storage capacity.

Unless a text sets a specific period or there is a particular justification, recordings may be kept up to six months at most and analysis documents up to one year. A good practice is buffer recording: listen within days, write the analysis, then delete the recording and keep only the analysis.

In principle location data are not kept more than two months; they may be kept one year when used to optimise rounds or to prove services performed where no other proof is possible, and five years when used to track working time.

The employer may not receive an automatic copy of all messages sent or received by employees, which is excessive. Connection logs must not be kept beyond six months.

Keep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.

Where employees use their own devices, the employer must have measures to tell private from business use so that private information is not monitored; security scanning tools can reach all data on a device and must be carefully managed, and parts of the device presumed private (such as the photo folder) should in principle stay closed to the employer. Tracking where a personal device is and what traffic it carries may be unlawful if it captures private and family life. Section 6.1 adds that employees should be able to shield private communications from work monitoring.

Electronic communications from work premises, their content and traffic data, may fall within private life and correspondence under Article 8 of the European Convention on Human Rights and deserve the same protection as analogue communications. Employer ownership of the devices does not take away employees' right to confidentiality of their communications, correspondence and the location data tied to them, and tracking employees' location through their own or company devices should go no further than a legitimate purpose strictly requires.

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exercise of official authority, or legitimate interests that are not overridden by the data subject's interests, rights and freedoms. Public authorities cannot rely on legitimate interests for processing carried out in performance of their tasks. Where the basis is legal obligation or public task, that basis must be laid down in Union or Member State law and the purpose must be determined in it. Before processing for a purpose other than the one collected for, without consent or a legal mandate, assess compatibility against the link between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.

Article 88 is addressed to Member States: it lets national law or collective agreements set more specific rules for handling workers' personal data across the employment relationship, from hiring through the running of the contract, work organisation, equality, health and safety, protection of property and the exercise of employment rights, to its end. An employer therefore identifies, for every country in which it employs people, which national employment-context rules made under this article apply, and applies the safeguards those rules must contain for dignity, legitimate interests and fundamental rights: openness about the processing, data passed between companies in the same group, and any system used to monitor people at work. The article is not itself a lawful basis; the Article 6 basis, and an Article 9 condition where special category data is involved, is still needed (CJEU C-34/21 found that a national rule which only restates the general conditions of the Regulation is not a more specific rule under this article).

For most processing at work the employer cannot and should not rely on workers' consent, because the relationship makes refusal costly and consent must be freely given, specific, informed and revocable; where a real or possible prejudice follows from refusing, the consent is invalid. Even where consent could be free, pre-set device settings or installing monitoring software do not amount to consent, which requires an active expression of will. Section 6.2 limits free consent to exceptional cases where acceptance or refusal carries no consequence at all.

An employer relying on legitimate interest must show that the purpose is legitimate, that the chosen method or technology is necessary for it and proportionate to the business need, and that it runs in the least intrusive way, aimed at the specific area of risk. It must be able to show the measures that balance its interest against workers' rights, and the worker keeps the right to object on compelling legitimate grounds. Section 6.2 adds that this ground works only where the processing is strictly needed.

Because of the imbalance of power between employer and employee, employers should in most cases not rely on consent for video processing, since staff consent will rarely be free. National law or collective agreements (works agreements included) may set specific rules for processing employees' data in the employment context under Article 88.

5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.

Process personal data relating to criminal convictions and offences, or related security measures, only under the control of official authority or where Union or Member State law authorises the processing and provides appropriate safeguards for the rights and freedoms of data subjects. A comprehensive register of criminal convictions may be kept only under the control of official authority. An Article 6 lawful basis is required in addition.

Employers should not screen employees' social media profiles on a generalised basis. Targeted observation may be lawful under legitimate interest only where it is shown to be necessary (the Opinion's example is checking former employees' professional profiles during a non-compete period), no less invasive means exist, and those concerned have been told how far the observation goes.

Employers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.

Employers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.

Deploying a data loss prevention tool on outgoing email must be fully justified to balance the employer's interest with employees' rights, because false positives expose legitimate and personal messages. The rules the system uses to flag an email should be fully transparent to users, and when an email is flagged the sender should be warned before it is sent, with the option to cancel.

Access and attendance systems, including those using biometrics or device tracking, can give an invasive view of workers' activity. A system recording who enters a secure area can rest on legitimate interest if necessary and if workers are adequately informed, but constantly watching how often and exactly when each worker enters and leaves cannot be justified once the same records serve a second purpose such as appraising performance.

Telematics collect data about the driver as well as the vehicle. Even with a legitimate interest or legal duty, the employer should first assess necessity, proportionality and subsidiarity. If a work vehicle may also be used privately, the key safeguard is letting the employee switch off location tracking temporarily when circumstances justify it (a doctor's visit, for example). The data must not be reused illegitimately, for example to follow and assess staff: vehicle trackers are for vehicles, not staff (Opinion 13/2011).