International employees often assume their employer can read every email, watch every screen and review every camera feed at will. German law says otherwise: your employer may only monitor you where a specific legal basis permits it, only in a proportionate way — and where a works council exists, monitoring technology generally may not even be introduced without its agreement. Surveillance that crosses these lines is more than a compliance problem: it can render the evidence unusable in dismissal litigation, support damages claims under Art. 82 GDPR, and hand you significant leverage in exit negotiations. In our practice, a dismissal built on unlawfully gathered monitoring data is among the most attackable there is.
The legal framework: three layers of protection
Workplace monitoring in Germany sits at the intersection of three regimes:
- § 26 BDSG — employee data may only be processed where necessary for the employment relationship. For investigations into suspected criminal conduct, § 26(1) sentence 2 BDSG demands a documented, concrete suspicion and a strict proportionality check before any measure is taken.
- The GDPR — the general principles of lawfulness, purpose limitation, data minimisation and transparency (Art. 5 GDPR) apply fully at work. Consent is rarely a workable basis: because of the structural power imbalance, employee consent is only valid in narrow situations (§ 26(2) BDSG) — and it can be withdrawn.
- § 87(1) Nr. 6 BetrVG — where a works council exists, it co-determines the introduction and use of any technical system objectively capable of monitoring employee behaviour or performance. The BAG reads this extremely broadly: capability suffices, monitoring intention is irrelevant, and practically every modern workplace tool — ticketing systems, Microsoft 365, badge readers, call analytics — falls under it. Deployment without a works-council agreement is unlawful.
The dogmatic footing of the German employee-data rules has been questioned by the CJEU, and reform has long been discussed — but the practical tests below remain the standards German labor courts apply.
Email and internet monitoring
Where private use is prohibited
If your contract or an IT policy prohibits private use of company email and internet, the employer has more room: it may run proportionate spot checks of business correspondence and connection logs for compliance purposes, and it may access your mailbox for business continuity during absences. Even then, it may not place you under permanent, comprehensive surveillance: the BAG has repeatedly stressed that constant monitoring pressure violates the general personality right, so blanket full-content logging is inadmissible regardless of what the policy says.
Where private use is permitted or tolerated
If private use is allowed — or has been silently tolerated for years, which courts treat similarly — the analysis changes significantly. Your private emails and browsing enjoy heightened protection. Whether telecommunications secrecy additionally binds the employer here was long disputed; court practice tends to reject that strict view, but the point is not finally settled. In practice: accessing the content of private communication requires a strong, documented justification, and generalised review is off-limits.
What is never permitted
Permanent full-content capture of email, chat or browsing, reading clearly private messages beyond what a documented legitimate purpose strictly requires, and covert suspicion-less „fishing expeditions” — none of these are lawful under any policy.
Video surveillance
Open cameras
Visible cameras with signage are permissible for defined purposes — theft prevention in retail, security in sensitive areas — if proportionate. They may not be used for continuous performance monitoring of workstations; break rooms, sanitary facilities and changing areas are absolutely off-limits.
Covert cameras
Covert video surveillance is a last-resort measure. The case law permits it only where there is a documented, concrete suspicion of a criminal offence or similarly serious misconduct against an identifiable group of employees, milder means have been exhausted, and the measure is limited in time and space (§ 26(1) sentence 2 BDSG). A hidden camera installed on vague suspicion, or aimed at the entire workforce, is unlawful.
Keyloggers and screen recording
The BAG decided in 2017 (2 AZR 681/16) that keylogger software — recording every keystroke and taking regular screenshots — may not be used without a concrete, documented suspicion of a crime or a similarly serious breach of duty. The employer there had deployed the keylogger „into the blue” — the findings were unusable and the dismissal failed. The same logic applies to continuous screen-capture tools and so-called „bossware” productivity trackers.
GPS tracking, access logs and badge data
- GPS in company vehicles is permissible for legitimate fleet purposes such as logistics coordination or theft protection — not for continuous movement profiling of the driver, and never covertly. Tracking outside working hours is particularly problematic where private use is allowed.
- Access logs and badge data may be collected for security and working-time purposes; repurposing them to evaluate behaviour collides with purpose limitation (Art. 5(1)(b) GDPR) and with § 87(1) Nr. 6 BetrVG.
- Location data from phones and laptops follows the same pattern: narrow purpose, transparency, no permanent movement profiles.
Unlawful surveillance in dismissal litigation: the Beweisverwertungsverbot
Here is where the topic matters most for a dismissed employee. German civil procedure has no rule that unlawfully obtained evidence is automatically excluded. The labor courts balance the employer’s interest in the evidence against the gravity of the privacy violation. The pattern in the BAG case law:
- Covert measures without the required concrete suspicion — keyloggers, hidden cameras, secret full-mailbox reviews — regularly lead to a Beweisverwertungsverbot: the evidence, and often everything derived from it, cannot support the dismissal.
- Open, signposted surveillance is treated differently: the BAG has allowed video evidence of deliberate misconduct from an openly operated camera even where aspects of the data-protection framework, such as retention limits, were violated.
- A violation of works-council co-determination (§ 87 BetrVG) alone does not automatically create an evidence bar — but it adds real weight to the balancing and is a serious flaw in the employer’s overall position.
The honest summary: exclusion is likely for serious, covert, suspicion-less intrusions — but it is never guaranteed. That uncertainty cuts both ways, and it is precisely why surveillance defects are such effective settlement leverage within a Kündigungsschutzklage.
Your remedies
- Challenge the evidence in dismissal litigation — often the difference between a lost case and a strong settlement — especially for a fristlos dismissal built on the monitoring findings.
- Damages under Art. 82 GDPR — unlawful monitoring supports claims for non-material damages; awards vary widely with the gravity and duration of the intrusion.
- An access request under Art. 15 GDPR — force disclosure of what was collected about you, with which tools and for which recipients.
- Complaints to the works council (§ 85 BetrVG) and to the data protection supervisory authority (Art. 77 GDPR).
Worked example
IT support specialist in Bonn, €5,200 gross monthly, 6 years of service. The employer suspects „excessive private internet use”, silently installs a browser-monitoring extension that captures screenshots every 30 seconds for three weeks — no documented suspicion of a crime, no works-council agreement although a Betriebsrat exists — and issues a fristlose Kündigung for working-time fraud based on the captured material.
We file the Kündigungsschutzklage within the three-week deadline and attack on three fronts: the screenshot evidence is inadmissible under the BAG keylogger line (covert, suspicion-less, continuous); the tool violated § 87(1) Nr. 6 BetrVG; and even taken at face value, the alleged private browsing would at most have justified a warning, not summary dismissal.
Outcome at the Gütetermin: the employer withdraws the fristlose Kündigung, converts to an ordinary termination with the full 3-month notice period paid (€15,600), pays severance of 1.0 monthly salaries per year of service (€31,200) plus €2,500 as compensation for the data-protection violation, and issues a Grade-2 reference. Total value: approximately €49,300 — against an opening position of immediate termination with nothing.
Frequently asked questions
Can my employer monitor me in my home office?
The same rules apply — if anything, more strictly, because the monitoring reaches into your home. Webcam surveillance, always-on cameras and continuous screen capture at home are inadmissible. Activity indicators in collaboration tools are a grey zone that a works-council agreement should regulate.
Is Microsoft 365 or Teams telemetry legal?
The platforms as such are lawful, but their analytics functions are exactly what § 87(1) Nr. 6 BetrVG targets. In companies with a Betriebsrat they are typically regulated in a detailed Betriebsvereinbarung — ask the works council what evaluations it permits.
I signed a consent form for monitoring. Am I stuck?
Probably not. Employee consent is only valid if it was genuinely voluntary (§ 26(2) BDSG), which courts assess sceptically given the power imbalance — and consent can be withdrawn with effect for the future at any time.
My employer read my private emails and cited them in the dismissal. What now?
Preserve everything and get advice quickly. This fact pattern frequently supports both an admissibility challenge and an Art. 82 GDPR damages claim — and the three-week deadline for challenging the dismissal runs regardless.
Does secret monitoring make my dismissal automatically invalid?
No — but it makes the employer’s evidence vulnerable, which often collapses the case in practice. There is no automatism, so the argument is best deployed strategically within a Kündigungsschutzklage, not relied on as a guarantee.