TURGERLEGAL - Expertise. Reliability. Dedication
Software monitoring: Your rights as an employee
Expert article in labor law
Software-based monitoring: What rights will employees have in 2026?
Screen recording, keystroke logging, location tracking in Microsoft Teams, GPS tracking in company cars: The technical possibilities for digitally monitoring employees through software will reach unprecedented levels by 2026. According to a Capterra study, 23 percent of employees in Germany are already being monitored by their employers using software. However, what is technically feasible often proves to be legally inadmissible. This article explains which forms of software monitoring in the workplace are legally permissible and what rights you have as an employee.
Software monitoring 2026: Legal foundations and their limitations
The permissibility of any software monitoring in the employment relationship is governed by a complex interplay of various legal provisions. At the heart of this is Section 26 Paragraph 1 of the German Federal Data Protection Act (BDSG): Personal data of employees may only be processed if this is necessary for the establishment, execution, or termination of the employment relationship. Articles 6 and 88 of the GDPR also apply. Overriding these are the general right of personality under Article 2 Paragraph 1 in conjunction with Article 1 Paragraph 1 of the German Basic Law (GG), as well as the principle of proportionality.
Every monitoring measure must overcome three hurdles: it requires a legitimate purpose, it must be suitable, necessary, and proportionate, and it must be communicated transparently to employees. Covert monitoring is therefore only permissible in very limited exceptional cases. In addition, Section 87 Paragraph 1 No. 6 of the German Works Constitution Act (BetrVG) applies: any technical device capable of monitoring the behavior or performance of employees is subject to the mandatory co-determination rights of the works council. The employer's intention is irrelevant, as the mere possibility of monitoring is sufficient.
Germany still lacks a standalone employee data protection law. Discussions on this topic have been ongoing since 2012, and a draft bill from the previous legislative period was not adopted. This results in a patchwork of regulations encompassing the GDPR, the BDSG (Federal Data Protection Act), the BetrVG (Works Constitution Act), and case law – leaving considerable room for disputed individual cases.
Anyone wishing to defend themselves against specific software monitoring or to have its legality reviewed should not rely on rules of thumb, but rather have the specific measure assessed under labor law, as the legal classification often changes even due to small details of the technical design.
Permissible measures in 2026: Login logs, time tracking, visible cameras
Not every instance of digital data collection automatically constitutes unlawful surveillance. Various measures are lawful – provided they are clearly limited and transparently communicated – as they serve a legitimate business interest and only minimally affect employees.
For example, the following are legal:
- Documentation of working time using login/logout logs or digital time recording systems (even mandatory according to the Federal Labour Court's decision on working time recording of 13 September 2022, 1 ABR 22/21)
- Logging of access to and entry into IT systems for IT security and compliance reasons.
- Visible video surveillance for the protection of property and security in entrance, storage or checkout areas – with clearly recognizable markings.
- Anonymized or pseudonymized analyses to improve workflows
- Random checks in cases of justified, documented suspicion of breaches of duty
Location data may also be collected if it is necessary for fulfilling the work task, for example, for drivers or field service employees whose routes need to be planned. Data collection must be limited to working hours; continuous location tracking during breaks or after work is generally inadmissible.
The monitoring of work emails occupies a special position: As long as the private use of work email accounts is prohibited, the employer may access the content, provided the principle of proportionality is observed. However, if private use is expressly or implicitly permitted, the confidentiality of telecommunications applies. In such cases, content monitoring is only permissible in exceptional circumstances.
What is illegal: keyloggers, covert screen recording, emotion recognition
The Federal Labor Court has established a clear limit regarding the use of keyloggers. In its ruling of July 27, 2017 (2 AZR 681/16), it determined that employers are not permitted to install software on company computers that records all keystrokes in order to gather information "at random." Data obtained in this way may neither serve as grounds for dismissal nor be used as evidence in court proceedings, as it is subject to a prohibition on its use in legal proceedings.
Similar standards apply to covert screen recording, automatic tracking of mouse movements, or unprovoked productivity evaluations that continuously monitor employees. Such measures are generally disproportionate, infringe on personal rights, and cannot be justified by consent or a company agreement.
Specifically, the following are typically inadmissible:
- Keyloggers and keyboard recordings without concrete, documented suspicion of a crime
- Covert screen or webcam recordings at the workplace and in the home office
- Covert video surveillance in social areas, changing rooms and sanitary facilities – without exception
- Continuous location tracking outside of working hours, for example with company cars or company mobile phones
- Content analysis of permissible private email or messaging communication
- Automatically reading Slack, Teams, or other chat histories without cause or notification.
Furthermore, since February 2, 2025, the use of emotion recognition in the workplace has been completely prohibited under Article 5 of the EU AI Regulation. AI systems that draw conclusions about moods, stress, or engagement from voice, facial expressions, or other biometric characteristics may not be used in the office or in home offices. Violations can be punished with fines of up to €35 million or 7 percent of global annual turnover.
If you suspect that your employer is using unauthorized software, you should secure evidence if possible and have the further course of action legally coordinated, because the procedural prohibition of use can be crucial in later disputes.
Covert surveillance: Under what conditions is it exceptionally permissible?
Covert surveillance is not generally prohibited. The Federal Labor Court and data protection authorities permit it under very strict conditions, provided all other options have been exhausted and there is a well-founded suspicion of wrongdoing.
For covert software monitoring – for example, targeted monitoring of data access, email traffic, or screen activity – to be exceptionally lawful, the following conditions must all be met:
- Concrete, substantiated suspicion of a criminal offense or serious breach of duty towards the employer
- Focus on the specific suspect – no comprehensive monitoring of uninvolved employees
- Unsuccessful or demonstrably hopeless use of milder measures (employee interview, open review, random checks)
- Proportionality between the intensity of the intervention and the interest in clarification in the specific case
- Temporal and substantive limitations – no continuous or blanket measure
- Thorough documentation of the suspicions and the less restrictive measures already used.
In practice, the requirements are considerable. The absence of even a single prerequisite – such as the necessary level of suspicion or documentation – usually renders the measure unlawful. The consequences are twofold: the measure violates data protection law, and the information obtained as a result is either inadmissible or only admissible to a limited extent in labor court proceedings.
Even in cases of lawful covert surveillance, the co-determination rights of the works council remain in effect. A secret operation without informing the council is only permissible in very limited emergency situations; the works council must generally be involved.
Your rights: information, participation, prohibition of the use of evidence, compensation for damages
Employees are by no means defenseless against unlawful software monitoring. The GDPR, the BDSG (German Federal Data Protection Act), the BetrVG (German Works Constitution Act), and the general right of personality together form a comprehensive set of concrete claims that can be enforced both individually and in combination.
Of central importance is the right of access pursuant to Article 15 GDPR: You have the right to know which personal data concerning you is being processed, for what purpose, on what legal basis, and to which recipients it is being disclosed. In addition, pursuant to Article 16 GDPR, you can request the rectification of inaccurate data, and pursuant to Article 17 GDPR, you can request its erasure if the processing is unlawful.
If data was collected unlawfully and allegations or a dismissal lead to legal proceedings, the procedural prohibition on the use of such evidence generally applies. Labor courts admit unlawfully obtained evidence only in rare exceptional cases; usually, it is inadmissible. As a result, numerous dismissals based on suspicion and unlawful software surveillance fail.
Further options for action:
- Complaints can be lodged with the relevant state data protection authority at the employer's place of business; both anonymous and open complaints are possible.
- Compensation for damages pursuant to Art. 82 GDPR for material and non-material damage – compensation for pain and suffering in cases of serious violations of personal rights
- Initiative via the works council: Demand for a company agreement or a court order prohibiting measures that violate co-determination rights.
- Right to an injunction against the employer directly in cases of particularly serious interference.
- A claim for protection against unfair dismissal must be filed within three weeks if an employment law measure is linked to the monitoring (§ 4 KSchG).
Have the measures in question reviewed by an employment lawyer at an early stage, because the correct interaction of information, data protection and employment law determines whether a surveillance case ultimately results in a correction, a claim for damages or a prohibition on the use of the evidence.
When is legal advice advisable in cases of software monitoring?
Legally, software monitoring represents a complex web of data protection, labor, and works constitution law. Legal advice is therefore valuable in various situations: when using new tracking functions in Microsoft Teams, Slack, or similar platforms; when faced with allegations by the employer based on monitoring data; in cases of dismissal related to IT analysis; or in cases of covert surveillance while working from home.
An employment lawyer examines the legal basis of the measure, the validity of any existing works agreement, the co-determination situation, and the admissibility of the collected data in the proceedings. They assert rights of access under Article 15 GDPR, formulate claims for damages under Article 82 GDPR, and represent clients in proceedings before the labor court and the data protection supervisory authority. In the case of dismissals, the three-week deadline stipulated in Section 4 of the German Dismissal Protection Act (KSchG) must be observed.
Early legal assessment is particularly recommended when working from home. This area often presents situations where private and professional life merge, meaning that even minor intrusions into spatial privacy can be disproportionate. The use of employees' personal devices (BYOD) also raises specific questions, such as the separation of professional and private data.
Seek advice before responding to an accusation or giving your consent! While a subsequent correction is possible, it is significantly more complex than a thorough initial assessment.
Conclusion: Software monitoring is subject to clear legal requirements.
Technical feasibility does not automatically equate to legal permissibility. The digital monitoring of employees is subject to strict legal requirements from 2026 onwards, specifically Section 26 of the German Federal Data Protection Act (BDSG), the General Data Protection Regulation (GDPR), the Works Constitution Act (BetrVG), the general right of personality, and – since February 2, 2025 – the EU AI Regulation with its prohibition on emotion recognition. Keyboard monitoring, covert screen recording, and continuous location tracking are generally unlawful; transparent time tracking, access logging, and proportionate video surveillance, however, are permissible.
Employees have a comprehensive set of legal tools at their disposal: the right to information, the right to erasure, the right to lodge a complaint with the data protection supervisory authority, the right to claim damages, and – in court proceedings – a far-reaching prohibition on the use of evidence. Those affected should adhere to the short deadlines set out in labor court proceedings, document evidence, and seek legal advice promptly in order to fully enforce their rights.
Have workplace surveillance measures legally assessed and secure legal support in labor law to successfully defend against data protection violations, unlawful surveillance and infringements of your personal rights.
Make an inquiry now
We will be happy to provide you with comprehensive, personal advice on your concerns.
