Last month a reader emailed us from Lyon. Her employer had rolled out a new “productivity insights” tool that scored every employee’s focus time, flagged long breaks, and — her words — “seems to know when I’m sad.” She had signed the updated IT policy without reading it, like everyone does. Her question was simple: “Is this legal?”
The honest answer is: probably partly, and the illegal part is exactly the part you should check first. European workers have stronger protections against workplace surveillance than employees almost anywhere else in the world — but those protections only help if you know they exist and how to use them. This is the guide I wish someone had handed her before she signed.
What employers actually monitor in 2026
Workplace monitoring is no longer a manager walking past your desk. Modern setups quietly combine several layers:
- Communication scanning — keyword flagging in work emails and chat tools, sometimes with AI summarising the “tone” of your messages.
- Activity tracking — keystroke counts, mouse movement, application usage, screenshots at random intervals.
- Location and access data — badge swipes, Wi-Fi logins, VPN timestamps that reconstruct your day minute by minute.
- AI “insights” — tools that score focus, predict burnout, or rank employees by “engagement” from the data above.
None of this is automatically illegal. But in Europe, every single layer needs a legal basis, a documented purpose, and — this is the part employers hope you never read — proportionality. The monitoring must be no more intrusive than necessary for a legitimate purpose. That one word, proportionality, is where most overreaching systems fail.
Your GDPR rights at work, in plain language
The GDPR applies fully to the employment relationship, and Article 88 lets EU countries add stricter national rules on top. Three rights matter most:
1. The right to be informed (Articles 13–14). Your employer must tell you what is monitored, why, how long data is kept, and who sees it. A vague line in the staff handbook saying “we may monitor IT systems” does not cut it. You are entitled to specifics.
2. The right of access (Article 15). You can file a subject access request — a DSAR — and ask: what data do you hold about me, where did it come from, who receives it, and what automated decisions are made from it? Your employer must reply within one month. This is the single most powerful tool an employee has, and almost nobody uses it.
3. The right to object and the limits on consent. Here is the opinion I promised: the “consent” buried in your employment contract is mostly worthless. European data protection authorities have said for years that consent at work is rarely “freely given” because of the power imbalance — you cannot meaningfully refuse something your boss asks you to sign. If your employer’s entire legal basis for monitoring is “you consented when you signed,” that basis is shaky, and a data protection authority would likely agree with you.
Legitimate interest is the basis employers usually rely on instead — and it requires a balancing test they must be able to show you. Ask for it. “Please share the data protection impact assessment for this monitoring tool” is a sentence that changes the tone of any HR meeting.
The EU AI Act changed the game in August 2025
This is the development most employees missed. Since 2 August 2025, the EU AI Act prohibits emotion inference systems in workplaces and educational institutions. A tool that claims to detect whether you are stressed, sad, bored or disengaged from your face, voice or typing patterns is not in a grey area — it is banned.
Other workplace AI sits in the “high-risk” category: CV screening tools, systems that allocate tasks, evaluate performance, or decide on promotions and terminations. High-risk systems must meet strict requirements — risk management, human oversight, data quality, transparency — and workers must be informed when they are subject to them.
So back to our reader in Lyon: the “productivity insights” scoring is high-risk territory, and the mood detection is flatly prohibited. That email she almost deleted was worth more than she knew.
We asked three chatbots about workplace monitoring law. One confidently cited a dead law.
Because this is an AI tools site, we ran a test. We asked ChatGPT, Claude and Gemini the same question: “Can my employer read my work emails in Germany?”
ChatGPT answered confidently — and cited a section of the German Federal Data Protection Act that was renumbered in the 2018 reform. The section number it gave no longer exists in that form. The substance of its answer was roughly right, but the citation was a ghost.
Claude did something better: it said the answer depends on the works council agreement and the employer’s documented policy, named §87(1) No. 6 of the Works Constitution Act as the co-determination hook, and told us to check the company’s data protection impact assessment. Gemini gave the shortest answer and the most useful practical tip of the three: file an access request first, argue later.
The takeaway is one I will keep repeating on this site: AI chatbots are excellent at explaining your rights and terrible at citing the current law. Use them to understand the landscape, then verify every article number against your national data protection authority’s website before you quote it to HR.
Country spotlights: where you work changes what applies
Germany has the strongest setup. Under the Works Constitution Act, the works council must agree before any technical system capable of monitoring employees is introduced — and most employers do have works councils in larger companies. No agreement, no rollout. If your German employer installed monitoring without the Betriebsrat’s sign-off, that alone can make it unlawful.
France runs through the CNIL. Monitoring must be proportionate to its stated aim, employees must be informed individually, and certain types of surveillance (like continuous video of workstations) are essentially off the table. The CNIL has fined employers for excessive monitoring and publishes clear guidance in French and English.
The Netherlands requires the works council’s consent for monitoring systems under the Works Councils Act. Dutch employers also face the practical reality that the Dutch DPA is one of Europe’s most active enforcers on employee data.
The UK is no longer under the EU GDPR but its UK GDPR mirrors it, and the Information Commissioner’s Office published detailed employment monitoring guidance. The principles — lawfulness, fairness, transparency, proportionality — are the same.
A pattern worth noticing: in every one of these countries, the employer’s obligations start with telling you and justifying it. Secrecy is itself a violation.
Read this before you sign anything
Short sentences. Important ones.
- Never sign an updated IT policy the day it arrives. Take it home. Read the monitoring section twice.
- “For security purposes” is not a blank cheque. Ask what exactly is collected and why each item is necessary.
- If a tool scores or ranks you, ask whether a human reviews the score before any decision is made. The AI Act requires meaningful human oversight for high-risk systems.
- Keep a copy of every policy version you sign. Employers update these quietly.
- You cannot be punished for exercising your data rights. Retaliation for a subject access request is itself unlawful.
My stance, stated plainly
Keystroke logging measures presence, not productivity, and any manager who confuses the two is bad at their job. The research on this is not ambiguous: heavy-handed monitoring damages trust, increases stress, and the “productivity gains” evaporate within months as people optimise for the metric instead of the work. European law happens to agree with the evidence here — proportionality is not just a legal nicety, it is a description of what actually works. If your employer’s monitoring could not survive being explained honestly to the team, that is not a communications problem. It is a compliance problem.
What to do on Monday morning: a practical checklist
Step one: find out what is actually running. Check your signed IT policy, staff handbook, or intranet privacy notice. Look for named tools, data categories, and retention periods. If the document is vague, email HR or the data protection officer with one sentence: “Please confirm which employee monitoring systems are currently in use and share the relevant privacy notice.” Put it in writing.
Step two: file a subject access request. Address it to the data protection officer or HR. A simple template: “Under Article 15 GDPR, I request a copy of all personal data you hold about me, the purposes of processing, the categories of data, the recipients, the retention periods, and meaningful information about any automated decision-making or profiling applied to me.” They have one month. Keep the sent email.
Step three: check the works council angle. In Germany, the Netherlands and several other countries, monitoring needs employee-representative agreement. Ask your works council or staff representatives whether they approved the system. If there is no works council and you are in a country where one should exist, that is a separate conversation worth having.
Step four: escalate properly if something smells wrong. Start internally — the data protection officer is legally required to be independent. If that goes nowhere, your national data protection authority accepts complaints from individuals, usually through an online form, free of charge. You do not need a lawyer to file one.
Step five: talk to colleagues, not just chatbots. Individual complaints get individual answers. Works councils, unions and staff associations turn individual answers into policy. The strongest workplace privacy protections in Europe were not won by individuals filing requests alone.
One last thing for the Lyon reader
We wrote back to her with the emotion-inference point first, because it was the clearest win: that feature of the tool is prohibited, full stop. Then the access request template. Then the suggestion to ask whether the works council equivalent — the comité social et économique — had been consulted. She replied a week later: HR had “paused the wellbeing module pending review.” Paused pending review is corporate for “you were right.” Know your rights, put things in writing, and do not sign on the day.
1 thought on “AI at Work in Europe: Your Rights Against Workplace Monitoring and GDPR (2026)”