Is social media monitoring legal in Germany?

Employee Monitoring Law Planner does not rule on that; it sets out what the law asks. In Germany: The Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. To uncover a crime: documented facts supporting a suspicion, necessary, and not disproportionate; blanket or suspicion-free covert measures do not meet it. The Federal Labour Court ruled against keylogging without a concrete suspicion. Limits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. Kept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. Kept only as long as the purpose justifies. Tell private from business use so private info

What does an employer need before starting social media monitoring?

It depends on the location. France: Art. 13 information, told before it runs, not in sanitary, break or prayer rooms, keep private use out, Art. 6 basis, justified, proportionate and no generalised screening. Germany: Art. 13 information, documented suspicion, not in sanitary, break or prayer rooms, keep private use out, Art. 6 basis, s 26 with an Art. 6 basis and no generalised screening. Italy: Art. 13 information, not in sanitary, break or prayer rooms, keep private use out, Art. 6 basis, no generalised screening and no inquiry into opinions. The Netherlands: works council consent, Art. 13 information, not in sanitary, break or prayer rooms, keep private use out, Art. 6 basis and no generalised screening. The European Union: Art. 13 information, not in sanitary, break or prayer rooms, keep private use out, Art. 6 basis and no generalised screening. The United Kingdom: Art. 13 information, monitoring policy, exceptional only, keep private use out and Art. 6 basis. Australia: APP 5 notice. New South Wales: APP 5 notice, magistrate authority only, not outside work and owner's consent.

Practices

Social media monitoring: what the law asks at each location

Looks at what people post in their own time. Guidance in the EU rules out generalised screening.

What it watches: what staff post in public, off the employer's systems
Family: Personal life
Reads as this class: for example "social media monitoring" in a practice column

France

7 requirements

Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
Noticestatutory requirementNo information about an employee may be collected by a device not first brought to the employee's knowledge. Code du travail L1222-4CNIL guidance ACT-7
Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
Limitsofficial guidance, not law guidance says noNo generalised screening of employees' social media during employment. WP249 para 5.2(a) official guidance, not law
Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
Lawful basisstatutory requirementEvery restriction on employees' rights justified by the task and proportionate to the aim. Code du travail L1121-1
Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Germany

7 requirements

Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
Limitsofficial guidance, not law guidance says noNo generalised screening of employees' social media during employment. WP249 para 5.2(a) official guidance, not law
Covert monitoringstatutory requirementTo uncover a crime: documented facts supporting a suspicion, necessary, and not disproportionate; blanket or suspicion-free covert measures do not meet it. The Federal Labour Court ruled against keylogging without a concrete suspicion. BDSG s 26(1) sentence 2 Federal Labour Court decision 2 AZR 681/16, named, not quoted
Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
Lawful basisstatutory requirementEmployee data only where necessary for the employment relationship; consent only where genuinely voluntary, in writing or electronically, with notice of the right to withdraw. BDSG s 26(1) sentence 1BDSG s 26(2)
Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Italy

6 requirements

Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
Limitsofficial guidance, not law guidance says noNo generalised screening of employees' social media during employment. WP249 para 5.2(a) official guidance, not law
Limitsstatutory requirement not allowed hereNo investigation of workers' political, religious or union opinions, or of facts irrelevant to their professional aptitude. Workers' Statute Art. 8
Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

The Netherlands

6 requirements

Representative stepstatutory requirementThe works council's consent to an arrangement on processing staff personal data. (where a works council exists) WOR Art. 27(1)(k)WOR Art. 27(2)
Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
Limitsofficial guidance, not law guidance says noNo generalised screening of employees' social media during employment. WP249 para 5.2(a) official guidance, not law
Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

The European Union

5 requirements

Noticestatutory requirementThe Art. 13 information at the time the data is collected: who, why, on which basis, the legitimate interest where that is the basis, recipients, retention, rights. GDPR Art. 13WP249 para 3.1.2
Places kept privateofficial guidance, not law guidance says noLimits by place: never in sensitive areas such as places of worship, sanitary facilities and break rooms. (where it covers toilets or washrooms, showers or bathing areas, change or locker rooms, break rooms or staff lounges and prayer rooms) WP249 para 3.1.1(d) official guidance, not law
Limitsofficial guidance, not law guidance says noNo generalised screening of employees' social media during employment. WP249 para 5.2(a) official guidance, not law
Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis for each purpose; Art. 88 lets national law or collective agreements set more specific employment rules, and is not a basis itself. Consent is rarely free at work; legitimate interest needs a necessary, least intrusive method and a documented balance. GDPR Art. 6GDPR Art. 88WP249 para 3.1.1(a)WP249 para 3.1.1(c)
Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

The United Kingdom

5 requirements

Noticestatutory requirementThe Art. 13 information at collection, and tell workers about monitoring in an accessible way. UK GDPR Art. 13ICO monitoring guidance para 1.9
Written policyofficial guidance, not lawMonitoring policies that set out the nature, purpose and extent of monitoring, brought to workers' attention and matching what happens. ICO monitoring guidance para 1.12(b) official guidance, not law
Covert monitoringofficial guidance, not lawCovert monitoring only exceptionally, for suspected crime or gross misconduct, authorised by senior management after an assessment, tightly targeted and time-limited, never in toilets or changing rooms. ICO monitoring guidance para 1.19(a)ICO monitoring guidance para 1.19(b) Human Rights Act, Article 8, named, not quoted official guidance, not law
Personal devicesofficial guidance, not lawWhen workers use their own devices, make sure private use is not captured. (if personal devices are monitored) ICO monitoring guidance para 3.11(c) Human Rights Act, Article 8, named, not quoted official guidance, not law
Lawful basisstatutory requirementAn Art. 6 basis chosen for the specific purpose and documented from the start; consent rarely valid; legitimate interests with a recorded assessment. UK GDPR Art. 6ICO monitoring guidance para 1.4(a)ICO monitoring guidance para 1.4(b)ICO monitoring guidance para 1.4(d)
Retentionstatutory requirementA retention schedule justified by business need, reviewed, and not kept in case a use turns up. UK GDPR Art. 5ICO monitoring guidance para 1.15
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Australia

1 requirements

Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

New South Wales

4 requirements

Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
Covert monitoringstatutory requirementNo covert surveillance of employees at work without a covert surveillance authority from a Magistrate; surveillance without the notice Part 2 asks for is covert. NSW WSA s 19NSW WSA s 22
Covert monitoringverification requiredNo communication, publication or possession of records obtained by a device used outside the conditions of the Act. NSW SDA s 11NSW SDA s 12NSW SDA s 14
Outside workstatutory requirement not allowed hereNo surveillance with a work surveillance device while the employee is not at work, except computer surveillance of the use of equipment or resources the employer provided or paid for. (if it runs outside work) NSW WSA s 16
Personal devicesstatutory requirementTracking a person, or monitoring a computer they own, needs their consent; the employer's own devices rest on its possession or control. (if personal devices are monitored) NSW SDA s 9NSW SDA s 10
Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Victoria

1 requirements

Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

The Australian Capital Territory

3 requirements

Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
Covert monitoringstatutory requirementNo covert surveillance of a worker without a covert surveillance authority from the Magistrates Court. ACT WPA s 35
Outside workstatutory requirement not allowed hereNo surveillance of a worker who is not in a workplace, except data surveillance of employer-supplied equipment and tracking that cannot be switched off. (if it runs outside work) ACT WPA s 42
Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Queensland

1 requirements

Noticestatutory requirementNotify individuals of the collection and the APP 5 matters. (when you say the Privacy Act applies) APP 5
Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

The United States

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

New York

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Connecticut

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Delaware

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

California

2 requirements

Noticestatutory requirementAt or before collection, tell staff the categories collected, the purposes, and how long each is kept. (when you say the business meets the CCPA thresholds) CCPA 1798.130(a)(5)(C)CCPA 1798.100
Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionstatutory requirementRetention periods disclosed and no longer than reasonably necessary. (when you say the business meets the CCPA thresholds) CCPA 1798.100
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Illinois

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Texas

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Florida

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Maryland

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Massachusetts

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Michigan

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Montana

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Nevada

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

New Hampshire

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Oregon

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Pennsylvania

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Washington

1 requirements

Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Ontario

0 requirements

Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law

Findings this practice can raise

The example "social media monitoring" in a practice column reads as this class. Words are matched whole.

See the specimen plan run Plan your own list