Employee Monitoring: What Employers Can and Cannot Do

Email review, internet logs, keystroke tools, vehicle trackers — the legal frame that governs watching people at work.

Employers have legitimate interests — security, compliance, protecting systems and confidential information — and employees do not abandon privacy at the office door. Irish and European law resolves that tension through a consistent set of principles: monitoring must have a defined purpose, a lawful basis, transparency, and proportionality — the least intrusive means that achieves the purpose.

Two facts shape everything else. First, consent rarely works as a basis in employment, because the power imbalance makes it unfree; employers must instead justify monitoring on legitimate interests, properly balanced. Second, secret monitoring is exceptional: covert surveillance is defensible only in narrow circumstances, typically the investigation of specific serious wrongdoing where telling the employee would defeat the purpose — and even then it must be targeted and time-limited.

Email and internet monitoring

Blanket, continuous reading of employee email is very hard to justify; targeted review for defined purposes — security scanning, investigating a specific well-founded concern, business continuity during absence — can be. The policy matters enormously: employees must know what is monitored, how, and why, and the monitoring actually conducted must match what the policy says.

Personal use creates the hard edges. Where personal use of work systems is permitted or tolerated, personal correspondence retains stronger protection, and wholesale reading of clearly personal messages is where employers overstep. The practical advice to employers is to design review processes that filter for relevance; the practical advice to employees is to keep genuinely private life off work systems.

The proportionality test in practice

For any monitoring measure, the questions run: what specific problem does this solve; is there a less intrusive way to solve it; is the scope (who, what, when) no wider than needed; how long is the data kept; who can see it; and have those affected been told? A measure that fails these questions fails, whatever the contract says.

Documenting that analysis — in substance a data protection impact assessment for the more intrusive tools — is not bureaucracy; it is the difference between a defensible system and an indefensible one when a dispute arrives.

Location tracking, vehicles and devices

Trackers in company vehicles can be justified for fleet management, security and lone worker safety — and become disproportionate when they track outside working hours, monitor private use of a vehicle the employee is permitted to use personally, or morph into continuous performance surveillance. Device management on phones and laptops follows the same logic: security functions are one thing; reading the content of an employee's life on a mixed-use device is another.

Monitoring evidence in disciplinary processes

Monitoring data — logs, footage, message trails — increasingly founds disciplinary action, and its provenance gets tested: was the monitoring itself lawful, within policy and proportionate? Evidence gathered through unlawful or covert monitoring is vulnerable to challenge in the process and before the Workplace Relations Commission, and separately exposes the employer to data protection consequences. For employees, an access request directed at the monitoring data and how it was gathered is often the first practical step in contesting the process.

Getting it right by design

For employers the checklist is stable: written monitoring policy that matches reality; purposes defined and narrow; no covert monitoring outside genuinely exceptional investigation scenarios; retention short and stated; access to monitoring data restricted; and the intrusive tools assessed before deployment, not after the grievance. For employees: read the policy, assume work systems are visible, and take advice early when monitoring surfaces in a dispute — the data protection and employment law angles are strongest when run together.

Frequently asked questions

Can my employer read my work emails?

For defined, legitimate purposes and within a policy you have been told about — targeted review can be lawful. Blanket continuous reading, or wholesale reading of clearly personal messages, is where monitoring becomes disproportionate and challengeable.

Is covert monitoring ever legal?

Only exceptionally — typically targeted, time-limited surveillance investigating specific serious wrongdoing where notice would defeat the purpose. Routine secret monitoring of staff is not defensible.

Can consent in my contract authorise monitoring?

Consent is rarely valid in employment because it is not freely given — employers must justify monitoring on other bases, principally legitimate interests properly balanced against your privacy.

My employer tracks the company van. Can it track me after hours?

Tracking justified for work purposes becomes disproportionate outside working time, especially where private use of the vehicle is permitted. Out-of-hours tracking needs specific justification it will rarely have.

Monitoring evidence is being used against me in a disciplinary. What can I do?

Test its provenance: was the monitoring lawful, within the published policy, proportionate? An access request for the monitoring data and its context is the usual first step, and unlawfully gathered evidence can be challenged in the process and any WRC claim.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.