Is it legal in the EU to use network logs in a disciplinary case?
Sometimes, but it depends on national law and on how the logs were collected and announced. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., personal data collected for one purpose, such as network security, may be used for another only where the new purpose is compatible or another legal basis applies, and employees must have been informed about the monitoring. National employment law adds its own conditions: some countries require prior notice or a works agreement, and courts in several Member States have excluded evidence gathered through monitoring that was hidden or disproportionate. So before a log is used against anyone, take legal advice, involve the data protection officer and check what employees were told. NetSenX logs describe device activity and are kept for your plan's retention period; whether they are admissible is a legal question.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we keep network security monitoring from becoming employee surveillance?
- Can an unused office computer be used by attackers?
- How do we spot activity on a computer that should be idle?
- What should IT do with the computers of employees on long-term leave?
- How do we monitor contractors' laptops on our network?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).