Germany: Employee monitoring by keylogger software unlawful except in case of severe suspicions

Keylogger software captures any keyboard input on the PC on which the software is installed. If used by employers, keylogger software enables to comprehensively monitor an employee’s activities on a business computer, including any use for private purposes. The keylogger software used in the case at hand also created screenshots of the computer screen at regular intervals. In the case, the keylogger recordings revealed that the employee had spent substantial working time using the computer for private purposes. On this basis, the employer dismissed the employee without notice. The BAG held that keylogger recordings created as a “shot in the dark”, i.e. without a specific suspicion against the employee concerned, cannot be used as valid evidence in court proceedings.

The BAG’s position on keylogger software is in line with the recent Opinion of the Article 29 Working Party on data processing at work (WP 249, adopted on 8 June 2017). In this Opinion, the Working Party stated that logging employees’ keystrokes or mouse movements or capturing screenshots in remote working scenarios is highly unlikely to be justified based on legitimate interest of the employer. According to the Article 29 Working Party, using such monitoring technologies is typically disproportionate in order to address the risk of unauthorized access, loss or destruction of information.

By way of background, German data protection law is generally strict in relation to employee data processing, and in particular employee monitoring. As a principle, employers may process personal data for employment-related purposes only where strictly necessary for hiring decisions or carrying out or terminating the employment contract. According to German case law, hidden employee monitoring measures are typically only permissible if they are based on a specific suspicion that an employee has committed a severe breach of contractual duty or a crime, and is subject to a balancing of interest test. Openly communicated monitoring measures can be permitted if required to protect legitimate interests of the employer, depending on the scope and circumstances as well as on available alternatives (e.g., for fleet management purposes). Beyond the strict requirements from a data protection perspective, introducing employee monitoring measures also triggers works council co-determination rights in Germany.