The National Commission on Informatics and Liberty (CNIL) recalls the lawful conditions governing the implementation by an employer of monitoring systems for their staff's activity.
Such a system must meet three cumulative conditions to be lawful. First, it must be justified by the nature of the task and proportionate to the intended purpose, without causing excessive interference with employees' privacy, which remains protected in the workplace. Constant surveillance is considered excessive, except for specific exceptions. For example, a keystroke logger ("keylogger") is deemed disproportionate, whereas quarterly productivity monitoring is acceptable. The system must not have a hidden objective.
Second, employee representative bodies, such as the Social and Economic Committee (CSE) for companies with 50 or more employees, must be consulted beforehand. Third, the data subjects must be informed before the system is implemented. The employer is required to document their compliance process, including the proportionality analysis and information measures. In case of non-compliance, employees may contact the CNIL, the labor inspectorate, the prefecture for cameras in publicly accessible areas, or judicial authorities.