Employee monitoring laws in France
Yes, provided the monitoring is proportionate to the purpose, the social and economic committee has been informed and consulted beforehand, and staff were told individually — French law bars any personal data collection by a device the employee was not told about.
Who has to agree before you start
The fact that decides the timeline, and the one that differs most between countries.
The workforce must be consulted first
The comité social et économique must be informed and consulted before any technique permitting monitoring of employee activity is introduced. It is a consultation right rather than a veto, but going ahead without it is an offence of obstruction and is the fact that unravels the rest of the rollout.
Representatives must be informed and consulted, or negotiated with, before the decision is taken. They cannot block it, but doing it in the wrong order is itself the breach — and in France skipping it is a criminal offence independent of any data-protection issue.
GDPR and the Loi Informatique et Libertés, with the Code du travail adding a proportionality limit and a prior consultation duty, and CNIL guidance on workplace monitoring.
The law that applies in France
Named so you can check us, and so your own counsel has somewhere to start.
| Instrument | What it requires |
|---|---|
| Code du travail art. L.1222-4 | No information concerning an employee personally may be collected by a device that has not been brought to their knowledge beforehand. This is what makes covert monitoring unusable in France as a general practice rather than merely risky. |
| Code du travail art. L.1121-1 | Restrictions on individual rights and freedoms must be justified by the nature of the task and proportionate to the aim pursued — the proportionality test every French monitoring measure is judged against. |
| Code du travail art. L.2312-38 | Requires the CSE to be informed and consulted, prior to their introduction, on the processing of automated personnel management data and on any technique permitting monitoring of employees' activity. |
| GDPR Arts. 6(1)(f) and 35 | Legitimate interests is the practical basis — the CNIL treats employee consent as generally invalid — and a DPIA is expected for systematic monitoring of employees. |
How a rollout is done here
- Define the purpose precisely and narrowly first. The proportionality test under L.1121-1 is applied against the stated purpose, so a vague one fails before the facts are reached.
- Inform and consult the CSE before introduction, with the documentation it needs to form a view.
- Inform employees individually and in advance — art. L.1222-4 makes prior knowledge a condition of the data being collectable at all.
- Run the DPIA and record the legitimate-interests balancing test.
- Update the register of processing activities and, where you have one, the IT charter annexed to the internal rules.
- Set a retention period and enforce it; the CNIL treats indefinite retention of monitoring data as a standalone breach.
What gets a rollout refused
- Introducing the tool and consulting the CSE afterwards. Prior consultation is the requirement, and the failure is an offence of obstruction independent of any data-protection issue.
- Constant or systematic surveillance of individuals. The CNIL has fined employers for permanent monitoring, and disproportionality is the ground it reaches for most often.
- Relying on employee consent as the lawful basis.
- Keeping monitoring data indefinitely, or letting it feed individual performance assessment without ever having told anyone it would.
Monitoring staff in France — questions
Does the CSE have a veto?
No. L.2312-38 is an information-and-consultation right, not a consent right of the German or Dutch kind. But the consultation must be genuine and must happen before introduction, and skipping it constitutes obstruction — a criminal offence — as well as undermining the defensibility of everything collected afterwards.
Can we monitor employees without telling them?
As a general practice, no. Art. L.1222-4 prohibits collecting personal information through a device that was not brought to the employee's knowledge beforehand. French case law has admitted narrowly framed exceptions in specific litigation contexts, but they are exceptions argued after the fact, not a basis on which to design a monitoring programme.
What makes monitoring proportionate in French terms?
Collecting the least that achieves a clearly stated purpose. In practice that means metadata rather than content, aggregate rather than individual where the purpose allows, a defined retention period, and no continuous recording of what is on screen. A tool that cannot capture screen content has a materially shorter proportionality argument than one where the feature exists and is turned off.
Sources and scope
Primary source: France regulator and statute references, last read 2026-09-17.
This page is a plain-English summary of published law and regulator guidance, not legal advice, and it is not a substitute for advice on your own facts. Employment and data protection law changes; each page states the date its sources were last read. Before monitoring staff anywhere, take advice from qualified counsel in that country.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.