MD014Video surveillance of the workplace

The recording of images of places in which work is carried out.

Pillar: MD | Monitoring and detection
Sources cited: 30
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD014/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be identified before anything is collected through the cameras, and whatever more specific rule the member state has made under article 88 applies on top of it. Consent is rarely that ground in an employment relationship, since it has to be freely given and the imbalance there makes that doubtful.
MD014/CoEMandatory	Council of Europe	López Ribalda and Others v. SpainEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That those criteria are weighed rather than counted, and that surveillance without notice can survive where a suspicion preceded it.	Cameras without notice have survived where a specific suspicion came first and the scope and duration were held tight. The criteria are weighed, not counted.
MD014/ATMandatory	Austria	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the cameras having legal effect, and the threshold is whether they touch human dignity.
MD014/HRMandatory	Croatia	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Surveillance devices are a means of occupational safety used on the conditions of the Act, barred from rooms for personal hygiene and changing, and the recordings are not used for purposes other than those of the article, not shown in public or to persons without authority over safety, and kept from unauthorized persons. Video surveillance of employees is lawful only where the conditions of the implementation act and of the occupational safety rules are met, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing; the purpose is one necessary and justified for the protection of persons and property, and access to footage belongs to the responsible person and those authorized. Video surveillance of workers needs no consent of the worker and rests on the two Acts; the employer informs the workers in an appropriate way before introducing it and before the decision to install, and seeks the works council’s prior consent where devices follow all movements throughout working time.
MD014/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Cameras are for the security of persons, the protection of property, and the supervision of production, and may not be aimed at a particular employee outside three named cases, nor placed in lavatories, changing rooms, or rooms set aside for personal use. Less intrusive means are examined first, and a notice is displayed where the cameras are.
MD014/FRMandatory	France	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The committee has to be informed and consulted before the decision to install the cameras, and the workers informed before they are recorded.
MD014/DEMandatory	Germany	Betriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026	Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.	The works council has to agree before introducing the cameras, and again on the manner in which it is used.
MD014/GRMandatory	Greece	Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026Απόφαση 23/2021Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα · read 5 Oct 2026Οδηγία 1/2011 της ΑΠΔΠΧ για τη χρήση συστημάτων βιντεοεπιτήρησης, άρθρο 7Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα · read 5 Oct 2026	That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors.	CCTV in workplaces, publicly accessible or not, is permitted only where necessary for the protection of persons and property, and employees are informed in writing of its installation and operation. Cameras in offices, a meeting room, a secretariat, and a kitchenette, with the image transmitted in real time to the manager’s screen, breached articles 5(1)(a), 5(1)(b), and 5(2) of the Regulation; the fine was 15,000 EUR with an order to remove the cameras within one month and destroy the material. A video surveillance system is not used to monitor employees inside the workplace save in exceptional cases justified by the nature and conditions of the work and necessary for health and safety or for the protection of critical areas; in a typical office it is confined to entrances and exits, cash desks, safes, or equipment being covered with the camera on the asset, and real-time watching of operators of high-risk machinery is allowed for immediate intervention; cameras are barred from dining and recreation areas.
MD014/ITMandatory	Italy	Legge 20 maggio 1970, n. 300, article 4Parliament of Italy · read 11 Aug 2026	That an instrument from which remote monitoring may follow is permitted only for stated purposes, and only after a union agreement or an authorization.	An agreement with the union representatives, or failing that an authorization from the labor inspectorate, is required before installing the cameras.
MD014/LUMandatory	Luxembourg	Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026	That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence.	Video surveillance aimed at employees is surveillance under article L.261-1 and follows its information and prior-opinion procedure. Employees have in principle the right not to be under continuous and permanent surveillance; the inside of an office, an open space, a workshop, or a restaurant kitchen with permanent workstations is disproportionate, a camera on a till is pointed at the till and the customers’ side, the field of view is limited to the surface the purpose needs, and no camera films toilets, changing rooms, the smoking corner, rest areas, the kitchenette, or the délégation’s room. Cameras inside the agencies of a transport company and a camera reaching a neighbouring plot breached minimisation and were ordered removed or reoriented; employees not informed individually of the controller, the DPO, the purposes, the legitimate interests, the recipients, and their rights were owed that information within four months; the fine was EUR 4,900.
MD014/NLMandatory	Netherlands	Wet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026	Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.	The works council has to consent before any arrangement governing the cameras is adopted, amended, or withdrawn.
MD014/PLMandatory	Poland	Kodeks pracy, article 22(2)Sejm of the Republic of Poland · read 20 Sep 2026	That image recording at work is open for four purposes only, one of them keeping secret information whose disclosure could harm the employer, that its purposes, scope and manner are fixed in the collective agreement, the work regulations or an announcement, that it is notified two weeks before it starts and handed to each worker before they are admitted to work, and that recordings are kept three months.	Special supervision of the workplace, or of the area around it, by technical means recording images is open to the employer for four purposes and no others: the safety of workers, the protection of property, the control of production, and keeping secret information whose disclosure could expose the employer to harm. Sanitary rooms, changing rooms, canteens and smoking rooms are outside it unless it is indispensable for one of those purposes and will not violate the dignity or other personal rights of the worker, in particular through techniques preventing those present from being recognised.
MD014/PTMandatory	Portugal	Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026	That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound.	Remote surveillance to control professional performance is prohibited; it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it; the worker is informed of its existence and purpose and the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”.
MD014/ROMandatory	Romania	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Video surveillance at the workplace on the employer’s legitimate interest rests on the five conditions of article 5, the 30-day retention among them. Accessing the workplace video surveillance system and processing the images of employees, including for their disciplinary investigation, breached articles 5(1)(a), 5(1)(b), and 6(1) of the Regulation read with article 5 of Law 190/2018; the fine was 24,887 lei (5,000 EUR), with a corrective measure on video monitoring in disciplinary investigations.
MD014/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Camera images may be processed for the control functions in article 20.3, on condition of express prior information to the workers and their representatives.
MD014/SEMandatory	Sweden	Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026Kamerabevakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026	That camera surveillance of a staff room over five nights without a legal basis breached article 6(1), that the absence of clear signage or other effective notice breached 15 § kamerabevakningslagen, that the absence of information to the persons filmed breached article 13, and that the three together cost SEK 300,000; and that signs at staff entrances without the DPO’s contact details breached article 13 and were ordered corrected within four weeks.	Cameras at work serve the prevention of accidents, theft, sabotage, or crime, limited to the areas and times the purpose needs; filming employees to check how they perform is not allowed; toilets, changing rooms, hidden cameras, and sound are excluded or rarely permitted; notice is given by clear signage or in another effective way, the sign showing the purpose and the controller’s contact details. Camera surveillance of a staff room for five nights without a legal basis, without signage or other effective notice, and without information to the persons filmed breached article 6(1), 15 § of the camera surveillance act, and article 13, and cost SEK 300,000; signs at staff entrances without the DPO’s contact details breached article 13. At a workplace the integrity interest weighs heavily as a starting point, since an employee does not usually expect to be watched; it is outweighed where the surveillance is limited to relevant areas, access is limited, logged, and a last resort, and the activity is one where cameras are to be expected.
Recommended	Hungarywhere written	A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That consent is a basis for workplace processing only exceptionally, that the employer’s legitimate interest with a documented balancing test is the basis for checks, that gradual checking and the employee’s presence are the safeguards, that cameras are not operated for the primary observation of employees and are barred from changing rooms, washrooms, and break rooms, with recordings kept three working days as a rule and hidden cameras prohibited, that the e-mail account is checked under an internal policy, in steps from address and subject to content, and that the content of private e-mails is not inspected even after notice.	Cameras are not operated for the primary observation of employees and their work, their primary purposes are those of the Szvtv. (life and safety, dangerous substances, business and bank secrets, property), none sit in changing rooms, showers, washrooms, medical rooms, or break rooms save to protect an asset there with the field of view on the asset, recordings are kept three working days as a rule, and the notice states for each camera its purpose and field of view.
Recommended	Irelandwhere written	Guidance on the Use of CCTV, For Data ControllersData Protection Commission · read 5 Oct 2026	That staff monitoring by camera belongs to special circumstances only, that employees are told where cameras are and why, that footage justified for security is not used for attendance or performance, that a case-by-case use for a disciplinary matter has to be shown necessary and limited in scope, that covert surveillance is generally unlawful and exceptionally permitted for offences only under a written policy and after a DPIA, and that a DPIA in the employment context could engage trade union or safety representatives.	Staff monitoring by camera occurs in special circumstances only; cameras are focused on areas of particular risk and kept out of break rooms, changing rooms, and toilets; a system justified for security or health and safety is not used for attendance or performance; monitoring of staff by managerial staff in a manned workplace is unlikely to be justifiable.
Recommended	Switzerlandwhere written	Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	What counts as a behaviour monitoring system (cameras in work rooms, microphones, continuous positioning, IT tools that monitor computer or phone activity at work or at home, sensors capturing biometric or physiological data, and AI tools for automated analysis of employee-based data), the three conditions of admissibility of a system needed for other reasons (a clearly overriding other interest, proportionality, and the participation of employees in planning, installation, hours of operation, and retention), the written justification produced to the labour inspectorate on request, and the data rules (prior detailed information, shortest predetermined retention, access limited to those authorized to evaluate, no archiving after the control, an internal regulation on rights and duties, monitored areas marked).	Video cameras in work rooms or vehicle cabins that can record undeclared what employees do and how are behaviour monitoring; cameras may stand where staff are present rarely and briefly, car parks, entrances and exits, dangerous machines, vaults, stores of dangerous goods; cameras against customer theft are positioned so that staff are practically not captured and their positions and fields of view discussed with the staff; monitored areas are marked; a door-closing sensor on toilets is impermissible.