Surveillance of employees: risks and requirements

Covert surveillance of employees

Private investigation in employment relationships can be complex and may involve investigating criminal offences in the workplace, uncovering suspected breaches of contract such as feigning illness, discovering engagement by employees in competitive activities or other gainful employment while on sick leave (Federal Labour Court, 29 June 2017 – 2 AZR 597/16) and honesty tests. The legality of covert surveillance by private detectives has not been uniformly regulated by law. In fact, it is based on the principles established by the Federal Labour Court, which primarily concern data protection regulations. A possible standardisation under an Employee Data Act (cf. draft bill of October 2024) has not yet been enacted.

Permissibility under data protection law

In legal terms, surveillance by a private detective qualifies as data collection for employment purposes. Information about the employee's personal and professional situation is obtained and made available to the employer in surveillance reports. Automated data collection or processing is not relevant for this purpose; factual actions are sufficient (Federal Labour Court, 20 June 2013 – 2 AZR 546/12). Surveillance involves an intense intrusion into the legal sphere of employees, particularly into their general right to privacy and their right to informational self-determination (Art. 2 para. 1 in conjunction with Art. 1 para. 1 German Basic Law (Grundgesetz – GG). This means that, in the case of covert surveillance, the processing of employee data must be based on the general clause of Art. 6 General Data Protection Regulation (GDPR) and the general processing principles outlined in Art. 5 GDPR must be complied with. Covert surveillance may be lawful under these strict conditions if its purpose is to pursue the employer’s legitimate interests without overriding the employee’s interests or fundamental rights and freedoms (Art. 6(1)(f) GDPR).

The European Court of Justice (ECJ) decision of 30 March 2023 (case C-34/21) raised questions regarding the permission criterion set out in section 26 (1) sentence 2 German Data Protection Act (Bundesdatenschutzgesetz – BDSG) specifically in the use of detectives. The section states that: “Employees’ personal data may be processed to detect crimes only if there is a documented reason to believe the data subject has committed a crime while employed, the processing of such data is necessary to investigate the crime and is not outweighed by the data subject’s legitimate interest in not processing the data, and in particular the type and extent are not disproportionate to the reason.” (NZA 2017, 1086). The ECJ held that the provisions of the GDPR take precedence over national regulations that do not contain more specific provisions or simply reiterate their wording. This renders the national regulations inapplicable. However, the requirement to document factual indications, serves as an additional protection measure relating to the transparency of processing, meaning it can also be considered applicable within the scope of the opening clause in Art. 88(2) GDPR. Otherwise, the principles of the GDPR, which essentially contain similar standards, apply.

Consequently, employers face higher hurdles, particularly when it comes to weighing up possible overriding interests of employees. This reflects a trend in European (employee) data protection law to limit processing to what is absolutely necessary.

Concrete initial suspicion

The use of detectives is only permissible for repressive purposes. This requires a reasonable initial suspicion based on concrete and objective evidence. Such evidence must give rise to suspicion of a criminal offence or at least serious, ongoing conduct in breach of contract. For the suspicion to be considered sufficiently objectifiable, it must relate to a defined group of employees. A covert investigation conducted arbitrarily, i.e. without concrete grounds for suspicion, in order to investigate possible misconduct by the employee is inadmissible from the outset.

A simple suspicion according to section 152 para. 2 German Code of Criminal Procedure (Strafprozessordnung - StPO) is considered sufficient by the courts (Federal Labour Court, 20 October 2016 – 2 AZR 395/15). This may apply for example, if an employee has announced a future incapacity to work or if there is suspicion of bribery based on information from the workforce and anonymous customer reports.

The evidence should be documented. Employers should record the specific suspicions and, in particular, document in writing any resulting damage, identify the suspects and set out the basis for the suspicion. The private investigation must not reveal any evidence that would justify its initiation.
If there are clear signs of a criminal offence or serious breach of contract and the employee belongs to the group of suspects defined on the basis of objective criteria, the employment contract in conjunction with section 242 German Civil Code (Bürgerliches Gesetzbuch – BGB) may require the employee to accept proportionate investigative measures.

Surveillance to be proportionate

Firstly, the surveillance or covert observation must be suitable for achieving the employer's intended goal of revealing suspicious conduct. To this end, the detective must act lawfully. Surveillance from public places, streets and paths is permitted. However, entering the employee's premises or making recordings, is prohibited under section 201a para. 1 no. 2 German Criminal Code.

Secondly, the use of a detective must be necessary and the only effective option for sufficiently clarifying the circumstances. If other equally effective means that are less restrictive of the employee's right to privacy are available, they must be preferred. If, for example, there is a suspicion of working time fraud as a result of the presentation of incorrect certificates of incapacity for work, this suspicion must first be addressed by an assessment by the Medical Service or by questioning other employees (Federal Labour Court 25 July 2024 – 8 AZR 225/23).

Thirdly, the surveillance must be adequate and the employer's interest in investigating must outweigh the employee's interests deserving protection. Different criteria may be taken into account when weighing up these interests, including the employee's previous conduct and the overall nature of the employment relationship, such as the frequency of sick leave related to disagreeable appointments, or other conflicts. Additionally, the degree of suspicion and the severity of the alleged offence may be taken into account. Finally, the secrecy of the detective's actions, the duration of the surveillance, and the methods employed (such as questioning, observation, monitoring correspondence and taking photographs) are also relevant.

Timewise, there are currently no specific time limits established by case law. However, surveillance over a period of 20 days has been considered disproportionate by the Regional Labour Court of Rhineland-Palatinate (judgment of 27 April 2017 – 5 Sa 449/16). Commentary sometimes sets the limit at two weeks. In any event, permanent, intense surveillance is subject to judicial approval under section 163 et seq. German Code of Criminal Procedure and is prohibited for employers.

Data minimisation

Only data that is essential for explaining the suspicion may be collected and processed during the gathering of information. Data that does not serve this purpose, in particular personal data of third parties, must be deleted immediately. Sustained surveillance of the employee's privacy is not permitted. If it is foreseeable that the private investigation will not produce any results, the surveillance is to be stopped immediately. For this purpose, it may be useful to request interim reports. The information should only be made available to the employer’s staff if it is absolutely necessary (the “need-to-know principle”).

Duty to provide information following surveillance

The use of detectives is only effective if the surveillance is undertaken secretly. According to Art. 14 GDPR, employers are, in principle, obliged to inform the employee as the data subject about the data collection in a timely manner. However, in the case of covert surveillance, the exceptions set out in Art. 33 para. 1 no. 2 lit. a German Data Protection Act and Art. 14 (5)(b) GDPR are in most cases likely to justify that the data subject is only informed after the surveillance has ended. At that point it is mandatory to provide the information.

Co-determination rights to be observed

The works council generally has no right of co-determination regarding the use of private investigation. Exceptions may apply if the surveillance is undertaken using technical equipment in accordance with section 87 para. 1 no. 6 German Works Constitution Act. If the detective is placed in the company to monitor suspicious employees over a longer period of time, the right to participate under section 99 German Works Constitution Act is triggered, especially if individual employees are to be monitored. However, this requires that the detectives must follow the instructions of the employer in whose business they are employed.

Consequences

According to established case law, if the private detective's investigation reveals that the employee has committed a criminal offence or intentionally breached his employment contract, the employer may demand reimbursement of the costs incurred in connection with hiring the detective for the breach of employment contract obligations. This applies subject to the proviso that the findings qualify as evidence in legal proceedings.

If the covert surveillance by the private detective turns out to be unlawful, the employer may face severe penalties, such as claims for damages and injury compensation claims. In addition, the unlawful monitoring of employees may also have administrative and criminal consequences.

Conclusion: Only ultima ratio

Employers should consider using private investigation in the context of an employment relationship only as the last resort and should document their use thoroughly and consistently. Future legislation on employee data protection should incorporate exceptions to transparency obligations for employees to facilitate legally compliant covert surveillance.