CP001Disciplinary action on monitoring evidence

Action taken against a person on the basis of what the program observed, short of ending the relationship.

Pillar: CP | Consequence for the person
Sources cited: 9
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
CP001/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, a disciplinary process for handling violations of the security policies is established, communicated, and maintained, and it takes the legal, statutory, contractual, and business requirements into account. It is reviewed at planned intervals and when a change in the law calls for it. What may be relied on to establish a violation is not addressed.
CP001/ATMandatory	Austria	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A workplace disciplinary code has no legal effect without the works council’s consent, so what may follow from what the program observed is settled with the workforce before any case arises.
CP001/FRMandatory	France	Code du travail, articles L1332-1 to L1332-4République française · read 23 Sep 2026	That no sanction may be imposed without the grievance being put to the person in writing, that anything beyond a warning requires an interview at which the person may be assisted and a decision that is reasoned and notified, and that a faulty act may not on its own found proceedings more than two months after the day the employer came to know of it.	No sanction may be taken without the grievance being put to the person in writing at the same time, and a faulty act may not on its own found disciplinary proceedings beyond two months from the day the employer came to know of it, unless criminal proceedings were brought within the same period. The term runs from the moment of knowledge and not from the act.
CP001/ITMandatory	Italy	Statuto dei lavoratori, article 7Parlamento della Repubblica · read 23 Sep 2026	That the disciplinary rules must be brought to the knowledge of workers by posting them where all can read them, that no measure may be taken before the charge has been put to the person and their defence heard, and that nothing heavier than a verbal reprimand may follow within five days of the written charge.	The disciplinary rules, the infractions each sanction attaches to and the procedure for putting a charge are brought to the knowledge of workers by posting them in a place accessible to all, so what may follow from what the program observed is settled before any case arises. Nothing heavier than a verbal reprimand may be applied before five days have passed from the written charge.
CP001/ROMandatory	Romania	Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That accessing the workplace video surveillance system and processing the images of employees for their disciplinary investigation breached the principles of lawfulness and purpose and the conditions of lawfulness, read with article 5 of Law 190/2018, and drew a fine of 24,887 lei (5,000 EUR) and a corrective measure on the use of video monitoring in disciplinary investigations.	A disciplinary investigation that relies on images from the workplace video surveillance system processes personal data, and on the facts the processing was unlawful; the corrective measure requires compliance of video monitoring especially where disciplinary investigations are conducted.
CP001/ESMandatory	Spain	Estatuto de los Trabajadores, articles 54, 55, 58 and 60Real Decreto Legislativo 2/2015 · read 23 Sep 2026	That a sanction rests on the gradation of faults set out in law or in the applicable collective agreement and is communicated in writing where the fault is serious, that a dismissal rests on a serious and culpable breach and is notified with the facts and the date it takes effect, that a worker who represents the workforce is heard in a contradictory proceeding first, and that a fault lapses ten, twenty or sixty days after the undertaking came to know of it.	A sanction rests on the gradation of faults and sanctions set out in the legal provisions or in the applicable collective agreement, and a serious or very serious fault may be sanctioned only by a written communication to the person stating the date and the facts that motivate it. A sanction may not take the form of a cut to rest entitlements or a fine on pay. A fault lapses ten days after the undertaking came to know of it where it is light, twenty where it is serious and sixty where it is very serious, and six months after it was committed in any case.
Recommended	Luxembourgwhere written	Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026	That video surveillance aimed at employees is always surveillance under article L.261-1, that employees have in principle the right not to be under continuous and permanent surveillance, so the inside of an office, an open space, a workshop, or a kitchen with permanent workstations is disproportionate and a camera on a till is pointed at the till and the customers’ side, that footage from a system installed to protect goods may be used against an employee stealing goods and may not be used to find that an employee talks too long with a client or colleague nor as evidence for disciplinary measures, which is a prohibited change of purpose, that cameras do not film places reserved to employees for private use, toilets, changing rooms, smoking corner, rest areas, the délégation’s room, the kitchenette, and that checking that employees work, keep hours, follow instructions, or behave well with customers are not purposes that can be pursued.	Disciplinary measures do not rest on recordings used for a purpose other than the one the system was installed for.
Recommended	Portugalwhere written	Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That the employer defines rules of use and forms of control in an internal regulation, heard by the comissão de trabalhadores and sent to the ACT, after assessing the impact; that the worker is informed before processing of the conditions of private use, the forms of control, the data, the retention period, the tolerance admitted, and the consequences; that control data are kept at most six months save during disciplinary or judicial proceedings; that email addressed to the worker is never opened automatically, even to investigate a disciplinary infraction; that control is not permanent or systematic but pontual, directed to areas of risk, and random; that access to a mailbox is the last resort, in the presence of the worker and preferably of a representative, limited to recipients, subject, date, and time; and that access to the monitoring systems is logged with user, timestamp, operation, sequential id, and hash, signed, analysed under a policy with periodic reports, and the logs kept one year.	On disproportionate use of email a warning to the worker is advisable; control data kept beyond six months rest on a pending disciplinary or judicial proceeding.
Reported	Czechiawhere written	Redefining Threats: Extending the Threat Response Focus from External to Internal ThreatsHološka and Doucek · read 30 Aug 2026	How the examination of an employee is divided between security, human resources, and legal, what a classification level governs once it has been applied, and which restrictions are placed on a person serving out notice when they cannot be placed on everyone.	The final assessment of the examination is made against the organization’s own rules and recommendations, and it is from that assessment that disciplinary proceedings follow, where they follow.