Monitoraġġ tal-login u tkeċċija sommarja: x'jippermetti l-GDPR lil min iħaddem

An employer may not build a summary dismissal on the covert analysis of an employee’s login and logout data. On 7 July 2026 the subdistrict court (kantonrechter) in The Hague set aside such a dismissal, holding that the employer had no adequate legal basis under the GDPR, that the monitoring was neither proportionate nor the least intrusive means available, and that absence from the company network does not prove that no work was done. Monitoring is not forbidden as such: it can be lawful where the employer has a concrete reason, has informed employees in advance and chooses the least intrusive means.

Is-sentenza hija Rechtbank Den Haag tas-7 ta' Lulju 2026, ECLI:NL:RBDHA:2026:18633. Min iħaddem li jissuspetta li impjegat qed jaħdem strutturalment inqas sigħat milli miftiehem irid jaġixxi b'attenzjoni: is-suspett irid ikun konkret qabel ma jibda kwalunkwe monitoraġġ, l-impjegat irid ikun jaf minn qabel li dan it-tip ta' dejta tista' tiġi vverifikata, u anke diskrepanza ġenwina fid-dejta rarament tkun biżżejjed waħedha biex iġġorr l-akbar sanzjoni fil- liġi tax-xogħol Olandiża.

X’ġara f’dan il-każ?

The employee had been employed since 2022 by EControls Europe B.V., a technology company based in Delfgauw, most recently in a management role in finance and IT. In the summer of 2025 his partner fell seriously ill. With management’s agreement he subsequently worked from home more often, partly in order to care for his young children. His performance was assessed positively during staff appraisals, and at the beginning of 2026 he even received a pay rise.

Later, the employer began to doubt his commitment. The trigger was two routine reminder letters, one from the accountant and one from Statistics Netherlands (CBS), concerning outstanding administrative obligations. Without first asking the employee for an explanation, the employer analysed the login and logout data for the period from 20 January to 20 February 2026 of his user account on the company network. On this basis the employer put the shortfall at some 29 hours over a period of four and a half weeks, and dismissed him summarily on 23 February 2026 for structural hour shortfalls and for not being open about them. The court, working through the same data, arrived at a difference of about 27 hours over that period, or a little over an hour per working day.

Why was there no valid GDPR basis?

Billi analizza d-dejta tal-login u l-logout, l-impjegatur kien qed jipproċessa d-dejta personali tal-impjegat. Tali pproċessar jeħtieġ bażi legali skont il-GDPR. F'relazzjoni ta' impjieg, id-dipendenza fuq interess leġittimu hija l-għażla ovvja, iżda dan jeħtieġ aktar minn sempliċi xewqa min-naħa tal-impjegatur li jeżerċita superviżjoni. L-impjegatur irid ikun jista' juri interess konkret u attwali, li l-ipproċessar huwa meħtieġ biex iservi dak l-interess, u li l-interessi u d-drittijiet fundamentali tal-impjegat ma jegħlbuhx.

Il-monitoraġġ tal-konformità mal-arranġamenti tal-impjieg jista' fil-prinċipju jikkostitwixxi interess leġittimu ta' min iħaddem. F'dan il-każ, madankollu, iż-żewġ ittri ta' tfakkira ma kinux biżżejjed għal dak il-għan. Ma indikaw l-ebda nuqqas ta' sigħat u xorta taw lill-impjegat l-opportunità li jissodisfa l-obbligi amministrattivi tiegħu. Għalhekk ma kien hemm l-ebda bażi konkreta biżżejjed għall-ipproċessar: ma kinitx kwistjoni ta' fatt stabbilit jew suspett speċifikament issostanzjat, iżda indikazzjoni indiretta li ġiet tradotta, mingħajr ebda konverżazzjoni mal-impjegat, f'investigazzjoni sigrieta.

Barra minn hekk, l-impjegat ma kienx jaf li d-dejta tal-login u l-logout tiegħu setgħet tintuża għal dan it-tip ta’ kontroll. Il-politika tax-xogħol mid-dar, li kienet għadha kemm ġiet stabbilita, ma pprovdiet l-ebda bażi ċara għal dan lanqas. L-impjegati jridu jkunu jistgħu jifhmu liema dejta qed tinġabar, għal liema skop, u taħt liema ċirkostanzi jistgħu jiġu mmonitorjati. Il-fatt li x-xogħol mid-dar kien espressament permess, parzjalment minħabba ċ-ċirkostanzi personali tal-impjegat, jagħmel in-nuqqas ta’ trasparenza aktar sinifikanti: kien preċiżament f’dak il-kuntest li min iħaddem messu għamilha ċara minn qabel x’kien mistenni f’termini ta’ sigħat tax-xogħol, disponibbiltà, u kwalunkwe reġistrazzjoni tal-ħin.

Why was the monitoring disproportionate?

Even had the employer had a legitimate interest, the monitoring would still have had to be proportionate: the seriousness and scope of the intrusion into the employee’s privacy must be in proportion to the reason for, and purpose of, the investigation. That proportionality was lacking here. The employer analysed the data of a single employee for around a month, without informing him in advance or first asking for an explanation, while there was only a limited and indirect reason to do so.

The employer should also have assessed whether the same objective could have been achieved by less intrusive means – the so-called subsidiarity test. During the hearing, the manager stated that a conversation with the employee had deliberately been avoided, because the employer feared he would adjust his behaviour once he became aware of the investigation. The subdistrict court did not find this a convincing reason. Adjusting potentially improper conduct is precisely the outcome an employer should want to achieve through a conversation, a warning, or an improvement plan. By deliberately forgoing this and opting immediately for covert monitoring, the employer used too drastic a measure without first trying the less intrusive alternatives.

Do login data prove that someone did not work?

On the merits too, the subdistrict court found the data insufficiently convincing. Not being logged into the company network does not automatically mean that someone is not working. The employee’s role also involved analysis, planning, consultation, supervision and telephone contact – activities that do not necessarily require an active network connection. Login and logout data record system activity, not the full scope of someone’s work performance.

The subdistrict court considered it possible that working offline explained part of that difference of roughly 27 hours, though not all of it. Even so, an average of just over an hour per working day was insufficient to conclude that structurally and significantly fewer hours had been worked than agreed. At most, the data amounted to an indication, not conclusive evidence of serious misconduct or intentional deception.

How does the GDPR breach affect the dismissal?

L-illegalità tal-ipproċessar tad-dejta ma tfissirx awtomatikament li kwalunkwe użu ta’ dik id-dejta fil-proċedimenti ta’ tkeċċija ġie eskluż, iżda dan idgħajjef serjament l-affidabbiltà u l-persważività tal-investigazzjoni. Min iħaddem ibbaża t-tkeċċija sa ċertu punt fuq dejta li kienet inġabret mingħajr informazzjoni ċara minn qabel, analizzata mingħajr raġuni konkreta speċifikament relatata ma’ nuqqas ta’ sigħat, miksuba permezz ta’ mezzi ta’ kontroll eċċessivament intrużivi, u li tat biss stampa limitata tax-xogħol attwali mwettaq. Mingħajr aktar investigazzjoni, mingħajr ma l-impjegat jinstema’, u mingħajr eżempji konkreti ta’ xogħol li ma twettaqx, l-ebda kawża urġenti għal tkeċċija ma setgħet tiġi derivata minn dan. Il-ksur tal-GDPR għalhekk ma kienx kwistjoni separata ta’ privatezza, iżda parti mit-tħejjija u s-sostanzjazzjoni inadegwati tat-tkeċċija sommarja.

How does this ruling fit earlier case law?

The subdistrict court in The Hague is not alone in this. As early as 2017, the European Court of Human Rights (ECtHR) formulated, in the widely discussed case of Bărbulescu v. Romania (ECtHR 5 September 2017, no. 61496/08), an assessment framework for employer monitoring that continues to influence Dutch case law. The ECtHR held that, when assessing digital monitoring of employees, regard should be had to, among other things: whether the employee had been informed in advance of the possibility of monitoring, how extensive and intrusive the monitoring had been, whether the employer had a legitimate reason for the monitoring, whether less intrusive methods were available, what consequences the monitoring had for the employee, and whether adequate safeguards had been provided.

This assessment framework recurs, for example, in a 2021 ruling of the Central Netherlands District Court (ECLI:NL:RBMNE:2021:6071). In that case, an employer monitored an employee’s email use following two internal signals, without it being clear how intrusive this monitoring had been or whether the employee had been informed in advance of the possibility of monitoring. Because the employer failed to provide sufficient transparency about this, the subdistrict court was unable to establish whether the Bărbulescu criteria had been met, nor whether the investigation’s findings were independent of any unlawful monitoring. The request for dissolution of the employment contract already foundered on this lack of clarity.

That digital monitoring is not inherently unlawful is shown by a more recent ruling of the North Holland District Court of 12 December 2025 (ECLI:NL:RBNHO:2025:14471). In that case, an employer launched an IT investigation into an employee after he had threatened to leak company data externally and a colleague had reported possible IT misuse. The subdistrict court ruled that this was not an untargeted fishing expedition, but an investigation with a concrete and current basis, so that the findings could indeed be relied upon to justify the summary dismissal.

Finally, for the purposes of evidence in dismissal cases, it is relevant that the Supreme Court, on 13 March 2026 (ECLI:NL:HR:2026:409), emphasised that a court basing its ruling on a summary dismissal partly on digital evidence, such as camera footage, must ensure that the employee has genuinely been able to view that material and comment on it. If this does not happen, the right to be heard (hoor en wederhoor) and equality of arms are violated under Article 19(1) of the Dutch Code of Civil Procedure and Article 6 ECHR. This line of reasoning is equally relevant where an employer, as in the EControls case, bases a dismissal on login and logout data: here too, the employee must be given a genuine opportunity to view and challenge that evidence before a court bases a decision on it.

Why was there no urgent cause for summary dismissal?

A valid summary dismissal requires an urgent cause within the meaning of Article 7:677(1) and Article 7:678(1) of the Dutch Civil Code. Such cause must be accepted with great restraint and must be based on provable facts; the burden of assertion and proof lies with the employer. In this case, there was an insufficient factual basis for this. The employer had not first asked the employee for an explanation, had relied on covertly collected data, had failed to adequately take into account work carried out outside the company network, had given no prior warning or opportunity to improve, and had given insufficient weight to the employee’s personal circumstances. The subdistrict court therefore ruled that the summary dismissal was not justified, and that the employer should first have used less intrusive measures.

What did the employer have to pay?

Because the dismissal had not been validly given, the employer was ordered to pay several forms of compensation: fair compensation (billijke vergoeding) of €60,000 gross, compensation for irregular termination of €11,544.34 gross, and the statutory transition payment (transitievergoeding). The claimed fair compensation was €90,000. In determining the amount of the fair compensation, the subdistrict court took into account that the employee had been confronted, from one day to the next, with the most severe sanction available under liġi tax-xogħol, filwaqt li kien qed iwettaq xogħol tajjeb u min iħaddmu ma kienx segwa proċess preliminari bir-reqqa. It-tpaċijiet li min iħaddmu kien applika kontra l-kumpens statutorju fiss ġew ukoll revokati.

X'għandek tiċċekkja bħala min iħaddem?

Covert monitoring is only defensible where it meets the principles of Article 5 GDPR, such as lawfulness, transparency and data minimisation, and rests on a legal basis under Article 6 GDPR. Article 88 GDPR allows more specific rules for the employment relationship, but it is no blank cheque; the same framework applies to sorveljanza bil-kamera fuq il-post tax-xogħol.

• Record in your homeworking policy what is expected on working hours, availability, output and time registration.
• Tell employees in advance which digital data you collect, for what purpose and when it may be checked.
• Ask the works council for consent before introducing a monitoring system or a rule on personal data processing (Article 27(1) of the Works Councils Act, WOR); without consent you need permission from the subdistrict court (kantonrechter).
• If you doubt an employee’s hours, talk to the employee first and consider time registration, a warning or an improvement plan.
• Do not treat login and logout times as proof of hours worked; use them only as part of a careful investigation.
• Give a summary dismissal only on proven facts, immediately and with the reason stated, as Article 7:677(1) BW requires.

X'għandek tiċċekkja bħala impjegat?

If you have been dismissed summarily, you have two months to ask the subdistrict court to set the dismissal aside or to award compensation. Act quickly and collect evidence of the work you actually did.

• Check whether your employer’s policy told you in advance that login data or other digital data could be monitored.
• Ask in writing for the data and the analysis on which the dismissal is based; under Article 15 GDPR you have a right of access to your personal data.
• Collect evidence of offline work: calls, meetings, documents, planning and supervision.
• Note the date of the dismissal and the reason given, and diarise the two-month deadline.
• Check whether your employer offset amounts against your final pay; in this case the court reversed such deductions.

What can we do for you with a summary dismissal based on monitoring?

tagħna avukati tat-tkeċċija act for employees and employers in disputes about digital monitoring and summary dismissal.

• We review the dismissal letter, the monitoring policy and the data used within one working day.
• We file the petition with the subdistrict court within the two-month deadline.
• We calculate the transition payment, the compensation for irregular termination and a claim for fair compensation.
• We assess a monitoring tool or homeworking policy against the GDPR and the works council’s right of consent before you introduce it.
• We prepare the conversation with the employee and the written warning or improvement plan.

sommarju

• On 7 July 2026 the subdistrict court in The Hague set aside a summary dismissal based on covert analysis of login data (ECLI:NL:RBDHA:2026:18633).
• Monitoring needs a concrete reason, prior information to the employee and the least intrusive means; two routine reminder letters were not enough.
• Not being logged in does not prove that someone did not work.
• The employer had to pay €60,000 gross fair compensation, compensation for irregular termination and the transition payment.
• Monitoring can be lawful, as a December 2025 ruling of the North Holland District Court shows, where the trigger is concrete and serious.

Mistoqsijiet frekwenti