Employers are permitted to implement certain monitoring measures for remote work – such as tracking working hours or analyzing login data. However, permanent surveillance through keyloggers, webcams, or screen recordings is generally prohibited. Every monitoring measure must be transparent, proportionate, and – where applicable – coordinated with the works council.
What is Remote Work Monitoring?
Remote work monitoring encompasses all measures employers use to verify the work performance, working hours, or conduct of employees working from home. The spectrum ranges from simple time tracking to technical surveillance tools.
This topic is highly relevant: According to the German Federal Statistical Office (Destatis), approximately 24.1 percent of all employed persons in Germany worked from home at least partially in 2024. This development has increased many managers' desire to track their teams' productivity.
This creates a fundamental tension: On one side stands the employer's legitimate interest in organizing work processes and monitoring performance. On the other side stand employees' fundamental rights – particularly their right to privacy and the protection of their home. This tension makes remote work monitoring a legally sensitive issue.
Legal Framework
GDPR and German Federal Data Protection Act (BDSG) Section 26
Every monitoring measure in remote work involves the processing of personal data and is therefore subject to data protection law. The central legal basis is formed by the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
According to Section 26 BDSG, the processing of employee data is only permissible if it is necessary for the execution of the employment relationship. This means: A measure must serve a legitimate purpose, be suitable and necessary, and must not disproportionately affect employees' interests.
Employers can base monitoring measures on various legal grounds: contract fulfillment (Art. 6 para. 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 lit. f GDPR), or – in rare cases – employee consent. However, consent in employment relationships is critically viewed, as genuine voluntariness is difficult to prove due to the dependent nature of the relationship.
Employees' Fundamental Rights
The general right to privacy (Art. 2 para. 1 in conjunction with Art. 1 para. 1 of the German Basic Law) protects the right to informational self-determination – meaning every person's right to decide how their personal data is used. Any form of employee monitoring interferes with this fundamental right.
In remote work, an additional protection applies: the inviolability of the home under Art. 13 of the German Basic Law. This fundamental right also applies vis-à-vis employers and sets particularly high barriers for monitoring measures that intrude into the private sphere.
Works Council Co-determination
If a works council exists in the company, it has a mandatory co-determination right when introducing technical devices capable of monitoring employees' behavior or performance (Section 87 para. 1 no. 6 of the German Works Constitution Act – BetrVG). Important: The mere capability for monitoring is sufficient – regardless of whether the employer actually intends to use the function.
In practice, this means: Before a company introduces time tracking software, login tracking, or other digital tools, the works council must be involved. A works agreement creates clear rules and legal certainty for both parties.
What's Allowed? What's Prohibited?
Permitted Monitoring Measures
Not every form of monitoring in remote work is impermissible. The following measures are generally legally acceptable:
Time tracking: In a landmark ruling in 2022, the German Federal Labor Court (BAG) decided that employers are obligated to systematically record their employees' daily working hours. Analyzing login data – i.e., when an employee logs into and out of the company system – is therefore not only permitted but required.
Random checks: Occasion-based, selective checks of email or internet usage can be permissible – particularly if private use of the work device is explicitly prohibited. Obviously private content must not be read.
Results-based monitoring: Reviewing work results, conducting goal-setting meetings, or holding regular feedback sessions are unproblematic and often more effective than technical surveillance.
Prohibited Monitoring Measures
Comprehensive, suspicionless surveillance is generally impermissible. The following measures are prohibited:
Keyloggers: Software that records all keystrokes is generally prohibited according to a ruling by the German Federal Labor Court (July 27, 2017 – 2 AZR 681/16). Suspicionless use constitutes a serious violation of personal rights.
Permanent video surveillance: Activating the webcam without consent or permanent camera monitoring in the home office is impermissible. Even requiring cameras to be on during video conferences is legally disputed.
Secret monitoring: Covert surveillance of emails, chat messages, or phone calls violates personal rights and may be criminally relevant.
Unannounced home visits: The employer may not enter employees' homes without express consent – even to inspect the workspace.
GPS tracking without cause: Location tracking via company phones or other devices is only permitted in exceptional cases and with works council approval.
Overview: Permitted vs. Prohibited
Special Case: Suspicion of Misconduct
In cases of concrete, substantiated suspicion of serious misconduct – such as time theft – extended monitoring measures may be permissible. However, strict requirements apply:
- The suspicion must be based on concrete facts, not mere assumptions
- The least intrusive suitable measure must be chosen
- The works council must be involved
- The measure must be time-limited
Time theft – such as pretending to work by providing false information in the time tracking system – can justify immediate dismissal (German Federal Labor Court, ruling of September 26, 2013 – 2 AZR 682/12). However, the employer bears the burden of proof and must carefully document all steps.
Consequences of Violations
For Employers
Companies that unlawfully monitor employees risk significant consequences:
- GDPR fines: Up to 20 million euros or 4 percent of global annual revenue
- Evidence exclusion: Unlawfully collected data often cannot be used in dismissal protection proceedings
- Damages: Affected employees can claim compensation under Art. 82 GDPR
- Reputational damage: Loss of trust among the workforce and negative external perception
For Employees
Employees must also reckon with consequences if they breach their duties:
- Warning: For first-time or minor violations
- Ordinary termination: For repeated breaches of duty
- Immediate dismissal: For serious breach of trust such as proven time theft
5 Practical Tips for HR Professionals
- Create transparency: Inform employees clearly and in advance about any form of data collection. Covert surveillance destroys trust and is usually unlawful.
- Involve the works council: Coordinate all technical measures with the works council early on. A works agreement creates legal certainty.
- Check proportionality: Ask yourself with every measure: Is it really necessary? Is there a less intrusive alternative? Does the monitoring interest outweigh personal rights?
- Maintain documentation: Record decisions, measures, and their justifications in writing – this provides protection in case of disputes.
- Trust over control: The most effective "monitoring" in remote work consists of clear goal agreements, regular feedback sessions, and a trust-based management culture. Studies show: Excessive control often has a demotivating and counterproductive effect.
Frequently Asked Questions About Remote Work Monitoring
Can my employer monitor me when I work from home?
In principle, yes – but only within narrow legal limits. Time tracking and analysis of login data is permitted and even mandatory. However, permanent surveillance through keyloggers, webcams, or screen recordings is prohibited. Every measure must be proportionate and transparent.
What is a keylogger and is its use permitted?
A keylogger is software that records and stores all keystrokes on a computer. Its use is generally prohibited according to a 2017 German Federal Labor Court ruling. Only in cases of concrete, substantiated suspicion of a crime or serious breach of duty may it exceptionally be permissible.
Can the employer monitor my login times?
Yes. For time tracking purposes, this is even mandatory – as clarified by the German Federal Labor Court in 2022. Login data documents the hours worked. However, it does not allow conclusions about what you actually did during the time you were logged in.
Is video surveillance permitted in the home office?
No. Permanent webcam surveillance in the home office is impermissible. Even requiring cameras to be on permanently during video conferences is legally problematic. A Dutch court even declared a dismissal invalid that was issued because an employee refused to keep their camera on.
Can my boss come to my home unannounced?
No. Without your express consent, the employer may not enter your home – this is protected by Art. 13 of the German Basic Law (inviolability of the home). A right of access can be contractually agreed, but then only applies with prior notice, a concrete reason, and your consent.
What co-determination rights does the works council have?
The works council has a mandatory co-determination right under Section 87 para. 1 no. 6 BetrVG for all technical devices capable of monitoring. The mere capability is sufficient – regardless of whether the monitoring function is actually used.
What penalties apply for illegal employee monitoring?
Employers risk GDPR fines of up to 20 million euros or 4 percent of global annual revenue. Additionally, evidence may be excluded in court proceedings, affected parties may claim damages, and significant reputational damage may occur.
What applies when time theft is suspected?
In cases of concrete, substantiated suspicion – not mere assumption – extended monitoring measures may be permissible. However, the employer must choose the least intrusive measure, involve the works council, and document everything. In cases of proven time theft, immediate dismissal is possible.
Conclusion
Remote work monitoring operates within a narrow legal framework. Employers may and must record working hours, but surveillance beyond this is subject to strict requirements. Transparency, proportionality, and involvement of the works council are the cornerstones of legally compliant monitoring.
For HR professionals, the principle applies: Trust is more effective than control. Clear goal agreements, regular feedback, and an open communication culture are better instruments for ensuring productivity in remote work – and they simultaneously strengthen employee retention.
Sources
- German Federal Data Protection Act (BDSG) Section 26. Federal Republic of Germany, 2018. https://www.gesetze-im-internet.de/bdsg_2018/__26.html
- General Data Protection Regulation (GDPR). European Union, 2016. https://gdpr.eu/
- German Works Constitution Act (BetrVG) Section 87 para. 1 no. 6. Federal Republic of Germany, 1972. https://www.gesetze-im-internet.de/betrvg/__87.html
- German Basic Law (GG) Art. 2, Art. 13. Federal Republic of Germany, 1949. https://www.gesetze-im-internet.de/gg/
- German Federal Labor Court ruling on time tracking. BAG, 2022 (1 ABR 22/21).
- German Federal Labor Court ruling on keyloggers. BAG, July 27, 2017 (2 AZR 681/16).
- German Federal Labor Court ruling on time theft. BAG, September 26, 2013 (2 AZR 682/12).
- Home office statistics Germany 2024. Federal Statistical Office (Destatis), 2024. https://www.destatis.de
- Employee monitoring in the home office: What is permitted? Haufe, 2023.
- Data protection-compliant employee monitoring. activeMind AG, 2024. https://www.activemind.de/magazin/ueberwachung-mitarbeiter/
-
Make a better pre-selection — even before the first interview
In just a few minutes, Aivy shows you which candidates really fit the role. Beyond resumes based on strengths.
