IV008Use of records held for other purposes

The examination, for the purposes of a case, of records the organization holds for unrelated reasons.

Pillar: IV | Investigation and digital forensics
Sources cited: 11
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
IV008/HRMandatory	Croatia	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Recordings from surveillance devices installed as a safety measure are not used for purposes other than those the article states. Those with access to video surveillance footage do not use it contrary to the purpose of protecting persons and property.
IV008/ITMandatory	Italy	Provvedimento n. 107, Amazon Italia LogisticaGarante per la protezione dei dati personali · read 16 Aug 2026	That records of illness, union activity, and family circumstances kept by managers had no lawful basis, and attract the stricter regime.	Records held by line management are the same material by another route: reaching into them needs the ground the monitoring system would have needed.
IV008/ROMandatory	Romania	Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That accessing the workplace video surveillance system and processing the images of employees for their disciplinary investigation breached the principles of lawfulness and purpose and the conditions of lawfulness, read with article 5 of Law 190/2018, and drew a fine of 24,887 lei (5,000 EUR) and a corrective measure on the use of video monitoring in disciplinary investigations.	Images from a workplace video surveillance system used for the disciplinary investigation of employees were, on the facts, processed in breach of the principles of lawfulness and purpose; the release does not say on what conditions such a use would stand.
Recommended	Irelandwhere written	Guidance on the Use of CCTV, For Data ControllersData Protection Commission · read 5 Oct 2026	That staff monitoring by camera belongs to special circumstances only, that employees are told where cameras are and why, that footage justified for security is not used for attendance or performance, that a case-by-case use for a disciplinary matter has to be shown necessary and limited in scope, that covert surveillance is generally unlawful and exceptionally permitted for offences only under a written policy and after a DPIA, and that a DPIA in the employment context could engage trade union or safety representatives.	Footage held for security may be used to investigate an allegation of gross misconduct or another disciplinary matter case by case, where the employer can demonstrate why it is necessary as evidence and that the access is limited in scope to that matter.
Recommended	Luxembourgwhere written	Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026	That video surveillance aimed at employees is always surveillance under article L.261-1, that employees have in principle the right not to be under continuous and permanent surveillance, so the inside of an office, an open space, a workshop, or a kitchen with permanent workstations is disproportionate and a camera on a till is pointed at the till and the customers’ side, that footage from a system installed to protect goods may be used against an employee stealing goods and may not be used to find that an employee talks too long with a client or colleague nor as evidence for disciplinary measures, which is a prohibited change of purpose, that cameras do not film places reserved to employees for private use, toilets, changing rooms, smoking corner, rest areas, the délégation’s room, the kitchenette, and that checking that employees work, keep hours, follow instructions, or behave well with customers are not purposes that can be pursued.	Footage from a system installed to protect goods may be used against an employee stealing goods; using the camera to find that an employee talks too long with a client or colleague, and then the recording as evidence for disciplinary measures, is a change of purpose the Regulation prohibits. Data from a system installed against theft are not turned to disciplinary ends on speeding, travel time, or route.
Recommended	Portugalwhere written	Deliberação n.º 7680/2014, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes da utilização de tecnologias de geolocalização no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That geolocation of vehicles is admitted for fleet management in external service in five activities, that protection of goods is weighed strictly and does not cover every vehicle, that geolocation of mobile phones is excessive for both purposes and the employer neither obtains location data from the operator nor installs GPS applications, that location data are never used to control performance, that indications of a crime may support a criminal complaint and a disciplinary proceeding where the facts themselves breach the worker’s duties, that driving parameters tied to the driver are anonymized, and that the purpose of fleet management is spent in the real-time view or the last position.	Where location data show indications of a crime they may support a criminal complaint, and a disciplinary proceeding where the facts themselves breach the worker’s duties; otherwise the purpose does not shift. Investigation of a disciplinary infraction does not open email addressed to the worker.
Recommended	Swedenwhere written	Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kolla medarbetarnas jobbmobilerIntegritetsskyddsmyndigheten · read 5 Oct 2026	That the bases for monitoring employees are the balancing of interests or, for public authorities, public interest, that consent is not one of them, that security reasons weigh more than efficiency reasons in the balancing, that employees are told in advance which controls may be made, that data collected for one purpose are not used for an incompatible other, and that the employer normally has no right to the content of an employee’s private files or emails.	Data collected for one purpose are not used for an incompatible other. Operational data are not turned to the evaluation of an individual’s performance.