MD018Covert monitoring on prior suspicion

Observation conducted without notice, following a specific suspicion already held. The suspicion is what permits the observation, not what the observation is for.

Pillar: MD | Monitoring and detection
Sources cited: 8
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD018/CoEMandatory	Council of Europe	López Ribalda and Others v. SpainEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That those criteria are weighed rather than counted, and that surveillance without notice can survive where a suspicion preceded it.	The suspicion has to exist before the observation begins, and the scope and duration have to answer to it.
MD018/SEMandatory	Sweden	Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026	That camera surveillance of a staff room over five nights without a legal basis breached article 6(1), that the absence of clear signage or other effective notice breached 15 § kamerabevakningslagen, that the absence of information to the persons filmed breached article 13, and that the three together cost SEK 300,000; and that signs at staff entrances without the DPO’s contact details breached article 13 and were ordered corrected within four weeks.	A hidden camera with sound and image in a room staff were permitted to use, run for five nights, had no legal basis. Hidden cameras are excluded.
MD018/CHMandatory	Switzerland	BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	That covert spyware on an employee’s computer for three months, taking screenshots, is behaviour monitoring prohibited by article 26 ArGV 3 and disproportionate, that a signed IT usage directive gives general notice of controls and does not authorize it, that the lawful sequence is technical prevention, then anonymized analysis of logs, then named analysis of access logs on concrete suspicion of abuse, that the evidence so obtained is excluded because the employee’s personality interest outweighs the interest in the truth, and that the dismissal resting on it was annulled.	A signed IT usage directive gives general notice of controls and does not authorize covert spyware; the sequence is technical prevention, anonymized log analysis, then named analysis on concrete suspicion. The prosecution of offences inside the business is for the police and not for the business, and monitoring data collected impermissibly are mostly unusable in criminal proceedings.
Recommended	Hungarywhere written	A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That consent is a basis for workplace processing only exceptionally, that the employer’s legitimate interest with a documented balancing test is the basis for checks, that gradual checking and the employee’s presence are the safeguards, that cameras are not operated for the primary observation of employees and are barred from changing rooms, washrooms, and break rooms, with recordings kept three working days as a rule and hidden cameras prohibited, that the e-mail account is checked under an internal policy, in steps from address and subject to content, and that the content of private e-mails is not inspected even after notice.	The use of a hidden camera is prohibited.
Recommended	Irelandwhere written	Guidance on the Use of CCTV, For Data ControllersData Protection Commission · read 5 Oct 2026	That staff monitoring by camera belongs to special circumstances only, that employees are told where cameras are and why, that footage justified for security is not used for attendance or performance, that a case-by-case use for a disciplinary matter has to be shown necessary and limited in scope, that covert surveillance is generally unlawful and exceptionally permitted for offences only under a written policy and after a DPIA, and that a DPIA in the employment context could engage trade union or safety representatives.	Covert surveillance is generally unlawful and permitted exceptionally, case by case, where the data are kept for preventing, detecting, or investigating offences; it rests on a written policy stating purpose, justification, procedure, measures, and safeguards, follows a DPIA, is focused and of short duration, records only the individuals and locations concerned, and ceases if no evidence is obtained within a reasonable period.
Recommended	United Kingdomwhere written	Employment practices and data protection: monitoring workersInformation Commissioner's Office · read 30 Aug 2026	What the British regulator expects of an employer that watches its workers, told apart as what an employer must do and what it should, and the conditions it sets on watching them without telling them.	Watching without telling is unlikely to be justified in most circumstances, and where it is, the conditions are set out. It should be authorized only by senior management. An impact assessment must be carried out. There should be grounds for suspecting criminal activity or an equivalent such as gross misconduct, and a view that telling the workforce would prejudice detecting it. It should be strictly targeted at obtaining evidence within a set timeframe, kept to the shortest possible, and it should not continue once the investigation is complete. It should not reach places where a worker would reasonably expect privacy, and in most circumstances it should not capture communications a worker would reasonably expect to be private.