Do we need works council approval for network security monitoring?
Possibly, depending on your country and on how the monitoring could be used. In Germany, section 87(1) no. 6 of the Works Constitution Act (Betriebsverfassungsgesetz) gives the works council a right of co-determination over introducing and using technical systems designed to monitor employees' behaviour or performance; many companies agree a works agreement before deploying security tools. Other countries give employee representatives information and consultation rights, and the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). lets national law add rules for the employment context. Involve the works council or employee representatives early, explain that the purpose is attack detection on devices, what is and is not recorded, who sees the alerts and how long data is kept. NetSenX's published description of what it reads makes that conversation concrete; the legal assessment stays with you.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we see personal devices connected to the office network?
- Is it risky to let new employees use personal laptops on the company network?
- Can we get a list of every device that joined the office network this month?
- How can we tell if a remote employee's laptop connects through anonymising services?
- What are the security risks of hiring remote workers we have never met?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).