Alessandro AleddaInsider Threat and Risk

INTRA/CoECouncil of Europe

What the record establishes for the Council of Europe, measure by measure, and what each source requires of the measure it governs.

Binding
14
Recommended
0
Reported
0
Measures touched
14 of 110
Sources cited
4
ControlSourceWhat it establishesPrerequisite or recommendation
14Mandatory
CP002/CoETermination of employmentMandatoryFlorindo de Almeida Vasconcelos Gramaxo v. PortugalEuropean Court of Human Rights, Fourth Section · read 11 Aug 2026López Ribalda and Others v. SpainEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That geolocation of a company vehicle, inside and outside working hours, did not violate article 8 on the facts, by four votes to three.Dismissal on geolocation and dismissal after covert cameras have both been examined under article 8 and survived on their facts, which settles the method and not the outcome.
DP007/CoEData loss prevention deploymentMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach a capability that inspects material other than correspondence is not decided in it.
MD004/CoEEndpoint activity monitoringMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach an agent recording what is done on a device is not decided in it.
MD005/CoENetwork and egress monitoringMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach the inspection of traffic is not decided in it.
MD006/CoEElectronic mail and collaboration monitoringMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case was decided on that monitoring itself: the employer read the content of a worker’s messaging account.
MD008/CoEAccess to the content of communicationsMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Correspondence keeps its protection even where private use of a work device breaks the rules, so the six criteria apply to opening it and not only to logging it.
MD011/CoEPrivileged session recordingMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach the recording of a session held under elevated entitlement is not decided in it.
MD012/CoEUser and entity behavior analyticsMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach an engine deriving a baseline from activity is not decided in it.
MD013/CoEPhysical access monitoringMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach a record of entry to premises is not decided in it.
MD014/CoEVideo surveillance of the workplaceMandatoryLópez Ribalda and Others v. SpainEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That those criteria are weighed rather than counted, and that surveillance without notice can survive where a suspicion preceded it.Cameras without notice have survived where a specific suspicion came first and the scope and duration were held tight. The criteria are weighed, not counted.
MD015/CoEGeolocation of vehicles and devicesMandatoryFlorindo de Almeida Vasconcelos Gramaxo v. PortugalEuropean Court of Human Rights, Fourth Section · read 11 Aug 2026‘Just more surveillance’: The ECtHR and workplace monitoringMole and Mangan · read 11 Aug 2026That geolocation of a company vehicle, inside and outside working hours, did not violate article 8 on the facts, by four votes to three.Tracking a company vehicle through and beyond working hours has survived on its facts, on a bench divided four to three, with the mileage relied on separated from the location data as a whole. A case note reads the majority as having placed the technology itself largely beyond examination, so the survival is weaker authority than it appears.
MD016/CoEMeasurement of pace and performanceMandatoryBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case concerned the reading of a worker’s messages, and whether the criteria reach a rate of work derived from the traces of the work is not decided in it.
MD018/CoECovert monitoring on prior suspicionMandatoryLópez Ribalda and Others v. SpainEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That those criteria are weighed rather than counted, and that surveillance without notice can survive where a suspicion preceded it.The suspicion has to exist before the observation begins, and the scope and duration have to answer to it.
MD019/CoEMonitoring outside working hoursMandatoryFlorindo de Almeida Vasconcelos Gramaxo v. PortugalEuropean Court of Human Rights, Fourth Section · read 11 Aug 2026That geolocation of a company vehicle, inside and outside working hours, did not violate article 8 on the facts, by four votes to three.Observation running through and beyond working hours has survived on its facts, which does not settle that it survives on any others.