CNIL guidance on employee monitoring and workplace video surveillance

Before any monitoring device is implemented, the employer consults the CSE in private undertakings of 50 employees or more (and EPIC and EPA employing private-law staff), or the CSA, CST or CSE and their specialised formations in public bodies. Installing a badge reader or video surveillance of staff without prior CSE consultation in an undertaking of 50 or more is given as an unlawful implementation.

Staff representative bodies must be informed and consulted before any decision to install cameras.

Staff representative bodies must be informed or consulted before any decision to install geolocation in vehicles provided to employees. Each employee is informed of the controller's identity, the purposes, the legal basis, the recipients, the right to object on legitimate grounds, the retention period, the rights of access and rectification and the right to complain to the CNIL, for example by a contract amendment or a service note. The DPO, if any, is involved and the system is entered in the record of processing.

Staff representative bodies are informed and consulted before any decision to install call listening or recording. Employees and callers are informed of the device, the controller, the purposes, the legal basis, the recipients, the retention, the right to object, access and rectification and the right to complain to the CNIL; callers are told orally at the start of the call (existence, purpose, possibility to object before the end of the call) with a pointer to full information. Under labour case law, employees must be told the periods during which they may be listened to or recorded. The DPO is involved and the system entered in the record of processing.

Staff representative bodies are informed or consulted before an activity-control device on IT tools is implemented. Each employee is informed of the purposes, legal basis, recipients, retention, rights of objection, access and rectification and the right to complain to the CNIL, through a charter (annexed or not to the internal rules), an individual note or a service note. The DPO is involved and each IT control system is entered in the record of processing.

Staff representative bodies should be informed or consulted before any decision to install a time or access control device. Each employee is informed clearly, concisely and accessibly of the purposes, the legal basis, the recipients, the retention period, how to exercise rights (access, rectification, erasure, objection where applicable, restriction) and the right to complain to the CNIL, for example through an IT charter or a service note.

The device must be brought to the knowledge of the persons concerned before it is put in place, to meet the employer's duties of loyalty and information (Code du travail L1222-4 and GDPR article 13).

Employees and visitors are informed by permanently displayed, visible signs in the areas concerned carrying at least a camera pictogram, the purposes, the retention period, the name or role and telephone number of the controller or DPO, the existence of data protection rights, and the right to complain to the CNIL with its contact details. The rest of the article 13 information (legal basis, recipients including those outside the EU, automated decision-making or profiling if any) may be given by other means such as a website.

Cameras must not film staff break or rest areas or toilets; where vending machines are damaged, the camera films only the machines, not the whole room. They must not film union or staff representative premises, nor the access to them where it leads only to those premises.

A geolocation device in a vehicle provided to an employee may not be used to check speed limits or to monitor the employee permanently; in particular not in the vehicle of an employee free to organise their own travel (such as a sales representative), not to follow staff representatives in their mandate, not to collect location outside working time (commute, breaks), even against theft or to check vehicle-use rules, and not to calculate working time where another device already exists.

Employees must be able to deactivate the collection or transmission of location outside working time. The employer may check the number or duration of deactivations, ask the driver for explanations and sanction abuse. Employees are informed of the installation and can access their location data on request.

Real-time listening and recording of calls at work are possible where the need is recognised and proportionate: occasional listening or recording to train or evaluate employees, to improve service quality, or in limited cases provided by law as proof of a contract or transaction. Only the data needed are processed (identification of the employee and evaluator, technical call data, the professional evaluation).

The employer may not set up permanent or systematic listening or recording save where a legal text provides for it (emergency services, for example), and may not record all calls to deal with abusive callers: a less intrusive means is chosen, such as a system letting the employee trigger recording when a problem arises.

Devices for managing working hours and presence must be proportionate. Controlling hours with biometric devices (fingerprint, facial recognition) or with systematic photographs at each clock-in appears excessive and contrary to data minimisation for the purpose of time control.

Placing staff under permanent surveillance is in general an excessive interference with their rights. Exceptions are limited to cases justified by the nature of the task where the device does not serve to watch how staff perform (for example permanent geolocation of an emergency vehicle so the nearest crew can be dispatched).

Software recording every keystroke (keylogger) to monitor an employee, including one teleworking, is disproportionate: it cannot separate professional from personal information, risks capturing private-life elements and places the person under constant surveillance. The internet and email fiche treats keyloggers as unlawful save an exceptional circumstance tied to a strong security imperative.

Telework does not change the limits on control. The following are incompatible with the principles: constant video (webcam) or audio surveillance, such as requiring an employee to stay on video all day; permanent screen sharing; keyloggers; and requiring very frequent actions to prove presence (clicking every few minutes, taking photos at intervals). Control by objectives over a period, reasonable and measurable, and regular reporting by the employee are suggested instead.

In principle there may be no screen capture coupled with call recording: a screenshot is a frozen image of an isolated action that does not faithfully reflect the work and is likely to be neither relevant nor proportionate whatever the purpose; it risks capturing private items (personal emails, instant messages, passwords, union activity).

Recording a video of the screen together with the call can be proportionate only for training staff, with all of these safeguards: employees are informed; the video is limited to the business application window concerned; it runs only during a call (starting when the handset is lifted and stopping when it is replaced); it concerns only people with a real training need (inexperienced or new staff) and in volumes matched to the capacity to analyse them; employees are trained only on their own recordings unless others are anonymised; access is limited and logged; and all call-recording safeguards apply. Used for evaluation, internal fraud or any purpose other than training, the coupling is disproportionate.

The employer defines the retention period of images in line with the purpose; in principle it does not exceed one month, and a few days usually suffice to check an incident. Images extracted for disciplinary or criminal proceedings are logged in a dedicated register and kept for the proceedings. The maximum period may not be set by the recorder's storage capacity.

Unless a text sets a specific period or there is a particular justification, recordings may be kept up to six months at most and analysis documents up to one year. A good practice is buffer recording: listen within days, write the analysis, then delete the recording and keep only the analysis.

In principle location data are not kept more than two months; they may be kept one year when used to optimise rounds or to prove services performed where no other proof is possible, and five years when used to track working time.

The employer may not receive an automatic copy of all messages sent or received by employees, which is excessive. Connection logs must not be kept beyond six months.