MD013Physical access monitoring

The recording of entry to and movement within controlled premises.

Pillar: MD | Monitoring and detection
Sources cited: 14
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD013/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be identified before anything is collected through the access-control recording, and whatever more specific rule the member state has made under article 88 applies on top of it. Consent is rarely that ground in an employment relationship, since it has to be freely given and the imbalance there makes that doubtful.
MD013/CoEMandatory	Council of Europe	Bărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.	Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach a record of entry to premises is not decided in it.
MD013/HRMandatory	Croatia	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Surveillance devices are permitted to control entries to and exits from work premises and spaces and to reduce the workers’ exposure to robbery, burglary, violence, theft, and similar events at or in connection with work. Every access to video surveillance footage is recorded by an automated log holding the time, the place, and the identity of the person accessing.
MD013/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Access control is named among the systems the cooperation procedure governs, so it is settled with the workforce before it is introduced.
MD013/FRMandatory	France	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the access-control recording in place, and the worker informed before it reaches them.
MD013/DEMandatory	Germany	Betriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026	Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.	The works council has to agree before introducing the access-control recording, and again on the manner in which it is used.
MD013/ITMandatory	Italy	Legge 20 maggio 1970, n. 300, article 4Parliament of Italy · read 11 Aug 2026	That an instrument from which remote monitoring may follow is permitted only for stated purposes, and only after a union agreement or an authorization.	An agreement with the union representatives, or failing that an authorization from the labor inspectorate, is required before installing the access-control recording.
MD013/NLMandatory	Netherlands	Wet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026	Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.	The works council has to consent before any arrangement governing the access-control recording is adopted, amended, or withdrawn.
MD013/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Criteria for use, drawn up with the participation of the workers’ representatives, and express prior information to the workers, are required before putting the access-control recording into operation.
MD013/SEMandatory	Sweden	Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026	That surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6, that the balancing is made purpose by purpose, that the integrity interest at a workplace weighs heavily as a starting point since an employee does not usually expect to be watched, and that surveillance to handle medicine incidents prevailed because it was limited to relevant areas, access was limited to three post-holders, logged, and used as a last resort, and the activity was one where employees could expect cameras more than usual.	Access to recordings limited to three post-holders, logged in the software and checkable afterwards, used only where other ways of tracing a loss have failed, is what made a surveillance of a dispensing area proportionate.
Recommended	European Unionwhere written	Secure personal dataEuropean Data Protection Board · read 1 Sep 2026	What controlling access to a building is taken to consist of, area by area, and what the Board says is owed before access to those areas is recorded.	Where access to a room holding material whose loss would bear seriously on the people it concerns is recorded, two things are owed before it is: the people who handle the data are told the system exists, and the staff representatives are informed and consulted.
Recommended	Luxembourgwhere written	Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026	That video surveillance aimed at employees is always surveillance under article L.261-1, that employees have in principle the right not to be under continuous and permanent surveillance, so the inside of an office, an open space, a workshop, or a kitchen with permanent workstations is disproportionate and a camera on a till is pointed at the till and the customers’ side, that footage from a system installed to protect goods may be used against an employee stealing goods and may not be used to find that an employee talks too long with a client or colleague nor as evidence for disciplinary measures, which is a prohibited change of purpose, that cameras do not film places reserved to employees for private use, toilets, changing rooms, smoking corner, rest areas, the délégation’s room, the kitchenette, and that checking that employees work, keep hours, follow instructions, or behave well with customers are not purposes that can be pursued.	A server room, archives, a safe or secured room, and storage areas where no employee works permanently are zones where a camera is in principle proportionate; a workshop, an office with a permanent workstation, and the staff representation’s office or its sole access are not.