Employee monitoring laws in the Netherlands

The entrepreneur needs the consent of the works council for every proposed decision to adopt, amend or withdraw an arrangement on facilities aimed at, or suitable for, observing or checking the presence, behaviour or performance of the persons working in the undertaking (personnel tracking systems: camera surveillance, email and internet monitoring, keystroke and screenshot tools, GPS and vehicle telematics, access badges and biometric time clocks, call recording, productivity scoring), insofar as it concerns all or a group of the persons working in the undertaking. The proposal is submitted in writing with reasons and expected consequences, consent follows at least one consultation meeting, and the entrepreneur states in writing which decision he took and from when he will implement it (27(2)); without consent or the cantonal court's permission the decision is void if the council invokes nullity in writing within one month (27(4) and (5)). The test is suitability, not intent: a facility capable of monitoring staff needs consent even if bought for another purpose. The Autoriteit Persoonsgegevens' 'OR-privacyboekje' gives test questions for personnel tracking systems; the GDPR (lawful basis, proportionality, transparency, a DPIA where the AP list requires one, such as covert camera surveillance by employers) applies on top of consent.

For each decision within art. 27(1), the entrepreneur submits the decision to be taken in writing to the works council with an overview of the reasons and of the consequences it is expected to have for the workforce; the council decides only after at least one consultation meeting and communicates its reasoned decision in writing; after that decision the entrepreneur informs the council as soon as possible in writing which decision he has taken and from which date he will implement it.

Where the entrepreneur has not obtained the council's consent, he may ask the cantonal court for permission to take the decision; the court grants it only if the council's refusal is unreasonable or the decision is required by compelling organisational, economic or social reasons. A decision taken without consent or permission is void if the council invokes nullity in writing within one month after the decision notice or after it became apparent that the decision was being applied (27(5)); the council may ask the court to bar the entrepreneur from applying it (27(6)). Any extra consent rights agreed under art. 32 follow the same rules.

The entrepreneur needs the consent of the works council for every proposed decision to adopt, amend or withdraw an arrangement on the processing and protection of the personal data of the persons working in the undertaking (for example a staff privacy regulation, retention periods, access to HR data, sharing with processors), insofar as it concerns all or a group of the persons working in the undertaking. The proposal is submitted in writing with reasons and expected consequences, consent follows at least one consultation meeting, and the entrepreneur states in writing which decision he took and from when he will implement it (27(2)); without consent or the cantonal court's permission the decision is void if the council invokes nullity in writing within one month (27(4) and (5)). The Autoriteit Persoonsgegevens explains the route in its 'OR-privacyboekje' (the works council's role in privacy at work): an arrangement is any set of rules on processing staff data, including a privacy regulation. Art. 33(3) UAVG adds that criminal-offence data about staff may be processed only under rules adopted through this WOR procedure.

Where workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.

Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for at least 6 months (longer where required); inform workers/representatives where used in the workplace; carry out a DPIA where required under GDPR; and where a deployer is a public authority, register the system in the EU database.

Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis, the recipients or categories of recipient, and any intention to transfer to a third country with the existence or absence of an adequacy decision and, for Article 46, 47 or 49(1) transfers, reference to the safeguards and how to obtain a copy. Provide in addition the storage period or the criteria used to determine it, the existence of the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent where consent is the basis, the right to lodge a complaint with a supervisory authority, whether providing the data is a statutory or contractual requirement and the consequences of not providing it, and the existence of automated decision-making including profiling with meaningful information about the logic involved and its significance and envisaged consequences. Before further processing for a new purpose, provide that purpose and the further information first.

Workers must be told that monitoring exists, the purposes for which their data will be processed and any other information needed for fair processing; covert-capable technology makes this more pressing. Section 6.3 adds that communication should be effective and cover the circumstances of monitoring and how workers can prevent their data being captured, and that monitoring policies and rules should be clear and readily accessible.

The sign should be placed so that people notice the surveillance before they walk into the covered zone, at roughly eye level. Camera positions need not be revealed so long as there is no doubt which areas are monitored and the context is unambiguous; people must be able to judge what a camera captures so they can avoid it or adapt their behaviour.

The employer must clearly tell employees that a tracking device is installed in the company vehicle they drive, that their movements are recorded while they use it and, depending on the technology, that their driving behaviour may be recorded too; ideally this notice is shown clearly inside each vehicle where the driver can see it.

Before any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.

Workers and their representatives should be told about every data collection process, the rules governing it and their rights.

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, erasing or rectifying inaccurate data without delay; keep it in a form permitting identification no longer than the purpose requires; and secure it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical or organisational measures. The controller is responsible for all six principles and must be able to demonstrate compliance with them.

Criminal-offence data about personnel in the controller's service may be processed only in accordance with rules adopted following the procedure of the Works Councils Act, that is with the works council's consent under WOR art. 27(1)(k) (or the equivalent employee representation route). This covers internal fraud and theft investigations, covert camera footage used to establish an offence and incident registers about employees; the Autoriteit Persoonsgegevens' DPIA list names covert camera surveillance by employers against theft or fraud (a DPIA is required even in incidental cases) and staff blacklists (art. 33(4)(c) permit).

Covert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.

Reasonable expectations are judged objectively, by whether a neutral third party would expect monitoring in that situation. An employee at the workplace in most cases does not expect to be monitored by the employer; monitoring is not expected in private gardens, living areas, examination and treatment rooms, and it is an intense intrusion in sanitary or sauna facilities, where no surveillance should take place. People can also expect freedom from monitoring in publicly accessible areas used for rest, recovery and leisure or where they sit and talk (restaurant tables, parks, cinemas, fitness facilities). A sign announcing cameras does not change what people can objectively expect.

To keep the balance under legitimate interest, the employer should put limits on monitoring suited to its form: geographical limits (monitoring only in specific places, and never in sensitive areas such as places of worship, sanitary facilities and break rooms), data limits (no monitoring of personal electronic files and communications) and time limits (sampling rather than continuous monitoring).

Given how sensitive location data is, a lawful basis for following where employees' vehicles are beyond agreed working hours will rarely exist. If there is a real need, such as theft prevention, the implementation should be proportionate: no location registered outside hours unless the vehicle leaves a broadly defined region, and location revealed only on a break-glass basis when it does.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orientation, unless one of the Article 9(2) conditions applies: explicit consent, employment and social security law obligations, vital interests where the data subject cannot consent, the legitimate activities of a not-for-profit body, data manifestly made public by the data subject, legal claims or courts acting judicially, substantial public interest under Union or Member State law, preventive or occupational medicine and health or social care under an obligation of professional secrecy, public health, or archiving, research and statistics under Article 89(1). The condition applies in addition to an Article 6 lawful basis, never in place of it.

Facial recognition and other biometrics carry heightened risks and must respect lawfulness, necessity, proportionality and minimisation; the controller should first weigh the effect on fundamental rights and look at less intrusive means. Article 9 applies when three criteria meet: physical, physiological or behavioural characteristics, a specific technical processing, and the purpose of uniquely identifying a person. Classifying people by age or gender without templates to identify them is outside Article 9, but storing templates to recognise someone again (re-entry, repeat targeting) is inside it from the start. Biometric recognition that private organisations install for their own ends will in most cases need explicit consent from everyone concerned.

Under GDPR art. 9(2)(g), biometric data for uniquely identifying a person may be processed only where necessary for authentication or for security purposes, and (since the Verzamelwet gegevensbescherming, in force 1 September 2026) only insofar as necessary because of a weighty public interest in lawful access to particular places, buildings, services, products, information systems or work process systems. Convenience, cost saving and time registration are not such an access need (the AP has fined an employer for fingerprint-based time registration); outside this exception, explicit consent under art. 22(2)(a), rarely freely given by employees, is the only route. The Autoriteit Persoonsgegevens' DPIA list (Staatscourant 2019, 64418) requires a DPIA for large-scale or systematic biometric processing.

Prohibited AI practices. Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education (except where the AI system is intended for medical or safety reasons, Art. 5(1)(f)), biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).

Video analytics that read workers' facial expressions automatically or flag deviations from set movement patterns are disproportionate to employees' rights and generally unlawful, and are likely to involve profiling and automated decisions; employers should refrain from facial recognition technology, and marginal exceptions cannot justify its general use. Under the GDPR, biometric identification also needs an Article 9(2) exception.

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before the processing begins; a single assessment may address a set of similar operations presenting similar risks. An assessment is required in particular for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based, for large scale processing of special category or criminal offence data, and for systematic monitoring of a publicly accessible area on a large scale. Seek the advice of the data protection officer where one is designated, and where appropriate seek the views of data subjects or their representatives. The assessment must contain at least a systematic description of the envisaged operations and purposes including any legitimate interest pursued, an assessment of the necessity and proportionality of the operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Carry out a review where necessary and at least when the risk represented by the processing operations changes.

Where monitoring, particularly with new technology, probably carries high risk, such as systematic and extensive automated evaluation with significant effects, the employer must assess its impact on data protection (a DPIA), and if the residual risk remains high it must consult the supervisory authority before starting. EDPB Opinion 12/2018 later confirmed that employee monitoring can meet the vulnerable data subjects and systematic monitoring criteria for a DPIA.

Whatever legal ground is used, the employer should apply proportionality and subsidiarity and should run a proportionality test before processing begins: whether the processing is needed for a legitimate purpose, whether it is fair, proportionate to the concern and transparent, and which measures keep any intrusion into private life and the secrecy of communications to the minimum. The test can sit inside a data protection impact assessment, and section 6.2 repeats it for every monitoring tool before deployment.

Software that logs keystrokes and mouse movements, captures screens at random or set intervals, logs applications used and for how long, or switches on webcams to collect footage is disproportionate, and a legitimate interest ground for it will very rarely exist, recording keystrokes and mouse movements being the Opinion's example. The risks of remote working should be met proportionately, whatever the technology, especially where business and private use blur.

Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract between the data subject and the controller, is authorised by Union or Member State law that lays down suitable safeguards, or is based on the data subject's explicit consent. Where the contract or explicit consent route is used, implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express a point of view and to contest the decision. Such decisions must not be based on special categories of personal data unless explicit consent or substantial public interest applies and suitable safeguards are in place.

A DPIA is required where processing is likely to result in high risk, including large-scale systematic monitoring of areas open to the public (Article 35(3)(c)) and large-scale processing of special categories (Article 35(3)(b)); national DPIA lists must be consulted, and since typical surveillance purposes often call for one, many video surveillance cases will need a DPIA, whose outcome should drive the measures chosen. If high risk remains despite planned measures, the supervisory authority must be consulted before processing starts.

Monitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.

Output from electronic surveillance should never be the sole input when a worker's performance is judged.

Employers should keep monitoring data accurate and retain it only as long as necessary; section 6.4 adds that data from monitoring should be stored for the shortest time needed, under a specified retention period, and deleted once no longer needed.

Footage may not be kept longer than the purpose needs, subject to any national storage periods. Since damage is usually noticed within a day or two, footage should in most cases be erased after a few days, ideally automatically, and the longer the period, especially beyond 72 hours, the more justification is needed. Where the controller stores footage, storage must be shown to be necessary and the period must be clearly defined for each purpose; retaining specific footage longer to pursue an identified incident remains possible.

Keep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.

Where employees use their own devices, the employer must have measures to tell private from business use so that private information is not monitored; security scanning tools can reach all data on a device and must be carefully managed, and parts of the device presumed private (such as the photo folder) should in principle stay closed to the employer. Tracking where a personal device is and what traffic it carries may be unlawful if it captures private and family life. Section 6.1 adds that employees should be able to shield private communications from work monitoring.

Electronic communications from work premises, their content and traffic data, may fall within private life and correspondence under Article 8 of the European Convention on Human Rights and deserve the same protection as analogue communications. Employer ownership of the devices does not take away employees' right to confidentiality of their communications, correspondence and the location data tied to them, and tracking employees' location through their own or company devices should go no further than a legitimate purpose strictly requires.

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exercise of official authority, or legitimate interests that are not overridden by the data subject's interests, rights and freedoms. Public authorities cannot rely on legitimate interests for processing carried out in performance of their tasks. Where the basis is legal obligation or public task, that basis must be laid down in Union or Member State law and the purpose must be determined in it. Before processing for a purpose other than the one collected for, without consent or a legal mandate, assess compatibility against the link between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.

Article 88 is addressed to Member States: it lets national law or collective agreements set more specific rules for handling workers' personal data across the employment relationship, from hiring through the running of the contract, work organisation, equality, health and safety, protection of property and the exercise of employment rights, to its end. An employer therefore identifies, for every country in which it employs people, which national employment-context rules made under this article apply, and applies the safeguards those rules must contain for dignity, legitimate interests and fundamental rights: openness about the processing, data passed between companies in the same group, and any system used to monitor people at work. The article is not itself a lawful basis; the Article 6 basis, and an Article 9 condition where special category data is involved, is still needed (CJEU C-34/21 found that a national rule which only restates the general conditions of the Regulation is not a more specific rule under this article).

For most processing at work the employer cannot and should not rely on workers' consent, because the relationship makes refusal costly and consent must be freely given, specific, informed and revocable; where a real or possible prejudice follows from refusing, the consent is invalid. Even where consent could be free, pre-set device settings or installing monitoring software do not amount to consent, which requires an active expression of will. Section 6.2 limits free consent to exceptional cases where acceptance or refusal carries no consequence at all.

An employer relying on legitimate interest must show that the purpose is legitimate, that the chosen method or technology is necessary for it and proportionate to the business need, and that it runs in the least intrusive way, aimed at the specific area of risk. It must be able to show the measures that balance its interest against workers' rights, and the worker keeps the right to object on compelling legitimate grounds. Section 6.2 adds that this ground works only where the processing is strictly needed.

Because of the imbalance of power between employer and employee, employers should in most cases not rely on consent for video processing, since staff consent will rarely be free. National law or collective agreements (works agreements included) may set specific rules for processing employees' data in the employment context under Article 88.

5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.

Process personal data relating to criminal convictions and offences, or related security measures, only under the control of official authority or where Union or Member State law authorises the processing and provides appropriate safeguards for the rights and freedoms of data subjects. A comprehensive register of criminal convictions may be kept only under the control of official authority. An Article 6 lawful basis is required in addition.

Employers should not screen employees' social media profiles on a generalised basis. Targeted observation may be lawful under legitimate interest only where it is shown to be necessary (the Opinion's example is checking former employees' professional profiles during a non-compete period), no less invasive means exist, and those concerned have been told how far the observation goes.

Employers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.

Employers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.

Deploying a data loss prevention tool on outgoing email must be fully justified to balance the employer's interest with employees' rights, because false positives expose legitimate and personal messages. The rules the system uses to flag an email should be fully transparent to users, and when an email is flagged the sender should be warned before it is sent, with the option to cancel.

Access and attendance systems, including those using biometrics or device tracking, can give an invasive view of workers' activity. A system recording who enters a secure area can rest on legitimate interest if necessary and if workers are adequately informed, but constantly watching how often and exactly when each worker enters and leaves cannot be justified once the same records serve a second purpose such as appraising performance.

Telematics collect data about the driver as well as the vehicle. Even with a legitimate interest or legal duty, the employer should first assess necessity, proportionality and subsidiarity. If a work vehicle may also be used privately, the key safeguard is letting the employee switch off location tracking temporarily when circumstances justify it (a doctor's visit, for example). The data must not be reused illegitimately, for example to follow and assess staff: vehicle trackers are for vehicles, not staff (Opinion 13/2011).