MD005Network and egress monitoring

The inspection of traffic leaving the organization’s control for volume, destination, or content.

Pillar: MD | Monitoring and detection
Sources cited: 15
Added: 30 AUGUST 2026
Updated: 20 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD005/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be identified before anything is collected through the traffic inspection, and whatever more specific rule the member state has made under article 88 applies on top of it. Consent is rarely that ground in an employment relationship, since it has to be freely given and the imbalance there makes that doubtful.
MD005/CoEMandatory	Council of Europe	Bărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.	Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach the inspection of traffic is not decided in it.
MD005/ATMandatory	Austria	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the traffic inspection having legal effect, and the threshold is whether it touches human dignity.
MD005/BEMandatory	Belgium	Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026	Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own.	What is collected is aggregate and by workstation. Attributing it to a worker is a separate operation with conditions of its own.
MD005/FRMandatory	France	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the traffic inspection in place, and the worker informed before it reaches them.
MD005/DEMandatory	Germany	Betriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026Beschluss 1 ABR 16/23Bundesarbeitsgericht, First Senate · read 16 Aug 2026	Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.	The works council has to agree before introducing the traffic inspection, and again on the manner in which it is used. What brings a device under that agreement is what it is capable of: a system that let supervisors hear conversations between employees was caught by it although nothing was recorded or kept.
MD005/ITMandatory	Italy	Legge 20 maggio 1970, n. 300, article 4Parliament of Italy · read 11 Aug 2026	That an instrument from which remote monitoring may follow is permitted only for stated purposes, and only after a union agreement or an authorization.	An agreement with the union representatives, or failing that an authorization from the labor inspectorate, is required before installing the traffic inspection.
MD005/NLMandatory	Netherlands	Wet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026	Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.	The works council has to consent before any arrangement governing the traffic inspection is adopted, amended, or withdrawn.
MD005/NOMandatory	Norway	Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around.	Monitoring a worker’s use of electronic equipment, internet use included, is not open to the employer at all unless the purpose is administering the network or detecting and resolving a security breach in it.
MD005/PLMandatory	Poland	Kodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026	That monitoring of a worker’s official electronic mail is open only where it is indispensable to an organisation of work permitting full use of working time and to the proper use of the work tools provided, that it may not violate the secrecy of correspondence, and that the same provisions, and with them the procedure of article 22(2), reach every other form of monitoring used for those purposes.	Inspection of traffic leaving the organization is a form of monitoring other than electronic mail, and the code carries to it the same provisions and the same procedural regime. The condition attached is the purpose: article 22(3) extends to another form of monitoring where its use is necessary to an organisation of work permitting full use of working time or to the proper use of the work tools provided.
MD005/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Criteria for use, drawn up with the participation of the workers’ representatives, and express prior information to the workers, are required before putting the traffic inspection into operation.
MD005/GBMandatory	United Kingdom	Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	The closed list of purposes for which an employer may intercept communications on its own system, and the four conditions on doing it, of which one is telling everyone who may use the system.	Inspection that amounts to interception in the course of transmission is authorized only on the express consent of the system controller, only for a purpose in the list, and only where it is effected solely to monitor or record communications relevant to the activities carried on and the system is provided wholly or partly in connection with them.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	Proxies that break the encrypted connection should be placed at the boundary to external networks so that what passes can be examined, they are themselves protected from unauthorized access, and security relevant events on them are detected automatically. An organizational rule is to be drawn up stating the data protection conditions under which the log data may be evaluated by hand.