Part IV: Tools for Internal Investigations II: Screening of Employee Data, Documents, Emails, and Physical Searches

This Part IV of our Briefing Series explains how companies can lawfully and effectively screen employee data, documents, and emails, and how to conduct proportionate physical searches in a manner that is defensible and operationally practical.

The core message is straightforward: screening measures and searches must be purpose driven and proportionate, based on a valid legal ground under data protection law, and compliant with additional constraints that may arise where private use of company systems is permitted or where telecommunications secrecy or device access rules apply.

In Germany, the relevant legal framework is anchored in the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), the Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), and the Telecommunications Act (Telekommunikationsgesetz – TKG) in certain scenarios.

Wherever possible, companies should favor transparent and open investigative measures and refrain from covert actions unless there is a documented suspicion of a criminal offense and no less intrusive means are available.

For interview based fact finding, see Part III of our Briefing Series. Guidance on governance structures, reporting lines, and decision rights is set out in Part II. A detailed discussion of legal bases, data subject rights, and the exclusion of evidence doctrine follows in Part V.

1. Scope and guiding principles for screening and searches

Employee data screening and workplace searches should be narrowly scoped to answer clearly defined investigative questions and must adhere to the principles of necessity, data minimization, and purpose limitation. As a default, companies should proceed in an open and transparent manner, with clear notice to affected employees and a documented plan setting out what is being searched, why the measure is necessary, and how confidentiality is safeguarded and the use of personal data limited.

The GDPR’s core processing principles apply in full, including lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. The accountability principle, in particular, requires controllers not only to comply with these standards but to be able to demonstrate compliance through appropriate documentation, decision making records, and technical and organizational controls.

Broad, ongoing, or covert monitoring without a specific investigative purpose or concrete factual triggers is impermissible and carries a significant risk of unlawful processing and the exclusion of evidence. Under established German practice, surveillance measures must be limited in scope, targeted to the concrete suspicion, and time bound. In ordinary operations, employees must be informed about the nature, scope, and purpose of any monitoring. Covert measures are reserved for exceptional cases, typically involving suspected criminal conduct, and only where less intrusive alternatives have proven insufficient. These requirements reflect the constitutional right to informational self determination and the proportionality test embedded in GDPR and BDSG practice.

Companies should also plan carefully for transparency obligations and their narrowly defined exceptions. While Articles 13 and 14 GDPR generally require information to be provided to data subjects, Section 33 BDSG permits limited deviations in exceptional circumstances, including where providing information would jeopardize the establishment, exercise, or defense of civil claims or would undermine the purpose of processing for the prevention or investigation of criminal offenses. Any reliance on these exceptions must be assessed on a case by case basis, balanced against data subject interests, and thoroughly documented.

Finally, a data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to employees’ rights and freedoms. This will typically be the case for systematic monitoring, large scale processing, data loss prevention tools with profiling functionality, geolocation of employees, or the deployment of novel or intrusive technologies. In practice, whistleblower systems and many technical surveillance measures will regularly trigger DPIA obligations.

Key Takeaways

• Purpose first: Screening and searches must be narrowly defined, necessary, and proportionate.
• Transparency as default: Open measures with clear notice and documentation are the rule.
• No fishing expeditions: Broad, continuous, or untargeted monitoring is generally impermissible.
• Covert measures are exceptional: Only permissible where there is a documented suspicion of criminal conduct and no less intrusive means.
• Observe information duties: Articles 13/14 GDPR apply; Section 33 BDSG exceptions are narrow and must be carefully documented.
• Check DPIA early: Systematic monitoring, whistleblower tools, or intrusive technologies often trigger DPIA obligations.

2. Legal bases and evidentiary consequences

Employee data screening and workplace searches must be grounded on a valid legal basis. In the German employment context, processing will typically rely on Article 6 GDPR, read in conjunction with Article 88 GDPR and the applicable national implementing rules.

Historically, Section 26 BDSG has provided a specific employment law legal basis, anchored in the concept of “necessity” for purposes related to hiring, performance of the employment relationship, and termination, complemented by a distinct provision for the detection of criminal offenses. Following the ECJ’s judgment of 30 March 2023, which clarified the conditions under which national employment data rules remain permissible under Article 88 (2) GDPR, courts and commentators increasingly emphasize that the GDPR prevails wherever national provisions fail to meet Article 88 requirements. Against this background, a prudent approach is to frame processing primarily under Article 6 GDPR, while observing Section 26 BDSG where applicable and documenting necessity and proportionality with particular rigor.

The crime detection pathway remains a narrow exception subject to strict conditions. Under Section 26 (1), sentence 2 BDSG, employers must be able to demonstrate (i) documented and factual indications of a criminal offense committed in the employment context, (ii) that the chosen measure is necessary and proportionate to detect the offense, and (iii) that the employee’s legitimate interests do not outweigh the employer’s interests, taking into account the nature and scope of the measure. Less intrusive alternatives must be considered and exhausted first.

In addition, employers must respect purpose limitation and purpose change rules. The reuse of lawfully collected employee data for investigative purposes may require a separate legal basis and a documented purpose change assessment. This may include reliance on Section 24 BDSG for processing necessary to assert, exercise, or defend civil claims, combined with appropriate safeguards such as pseudonymization or encryption.

Finally, companies should anticipate admissibility risks. German labor courts recognize that serious data protection or privacy violations may lead to the exclusion of evidence, particularly where constitutional rights are affected. Even lawfully obtained data must be evaluated in a manner consistent with the original processing purpose. While violations of co determination requirements or internal policies alone do not automatically render evidence inadmissible, unlawful data collection can do so, following a case by case constitutional balancing.

Legal Basis & Evidence – Key Points

• Article 6 GDPR as the anchor: Frame screening and searches primarily under the GDPR; apply Section 26 BDSG with caution post ECJ (30 March 2023).
• Section 26 BDSG crime exception is narrow: Requires documented suspicion, necessity, proportionality, and exhaustion of milder means.
• Mind purpose limitations: Re use of existing data may trigger a purpose change assessment and a new legal basis (e.g. Section 24 BDSG).
• Document proportionality carefully: Legal basis, balancing, and safeguards should be recorded in detail.
• Evidence at risk: Serious privacy violations can lead to exclusion of evidence in labor court proceedings.

3. Digital sources and investigation pathway

Most investigations start with company data. The investigation pathway should follow a “business first” and minimally invasive approach. Employers should initially focus on clearly business related repositories such as shared drives, document management systems, collaboration platforms, ticketing or CRM systems, and audit or access logs. Only where these sources do not sufficiently answer the investigative questions, and where justified by necessity and proportionality, should companies move on to individual mailboxes, endpoint imaging, or mobile device data.

Email and messaging

Where private use of company systems is expressly prohibited and effectively enforced, employers may review business communications in line with necessity and proportionality, provided that blanket or permanent monitoring is avoided. Where private use is permitted or tolerated, access must be handled with particular caution.

Whether allowing private use triggers telecommunications secrecy obligations under the TDDDG/TKG remains a contested issue in Germany. However, there is a significant body of authority – including several data protection supervisory authorities – taking the restrictive view that private use subjects employers to telecommunications secrecy, which would prohibit access to communication content except under narrow statutory exceptions. Although some commentators argue that Section 3 TDDDG does not apply to employers even in private-use scenarios, companies should not rely on the more permissive interpretation without careful legal assessment. Given the severity of the potential consequences – including criminal liability under Section 206 of the German Criminal Code (Strafgesetzbuch – StGB) and the risk of evidence being excluded in court – employers who permit private use should, as a matter of prudence, refrain from screening email content unless they can demonstrate compliance with telecommunications secrecy requirements or have implemented robust measures to separate private from business communications.

In practice, risk mitigating measures are essential: employers should favor traffic data and logs over content review, apply tight temporal scopes, sender/recipient filters, and keyword limitations, and ensure that clearly private communications are excluded. A case specific balancing of interests should be documented.

Documents and collaboration tools

Modern collaboration suites can generate analytics that indirectly monitor employee behavior or performance. Employers should rely on aggregated or role based insights, restrict access on a strict need to know basis, and disable or limit profiling type features unless a valid legal basis exists. Where tools are capable of monitoring performance or behavior, works council co determination under Section 87 (1) no. 6 Works Constitution Act (Betriebsverfassungsgesetz – BetrVG) is typically required, with guardrails documented in a works agreement.

Endpoints and keyloggers

Targeted imaging of laptops or the collection of specific folders may be permissible where necessary and proportionate. By contrast, keyloggers, continuous screen capture, or similar “total surveillance” tools are generally unlawful, absent a concrete suspicion of a criminal offense or serious breach – and even then only if narrowly tailored. German courts have repeatedly rejected evidence obtained through keylogging without a concrete suspicion.

Mobility and GPS

Tracking company vehicles or devices may be permissible during working hours for defined operational or safety purposes, but not during breaks or off duty time. For safety critical roles or asset protection, limited GPS tracking may be justified under Article 6 (1) (f) GDPR or, in narrow cases, Section 26 BDSG, provided tracking is strictly confined to working time.

Bring-Your-Own-Device (BYOD) scenarios require particular care. A robust setup should separate personal and business data through mobile device management solutions, limit collection to business data, and rely on consent only where it is truly voluntary, informed, revocable, and beneficial to the employee.

Process hygiene

Sound process design is critical. Employers should provide clear notices in policies or works agreements, limit access to investigation data to a need to know circle, and log all searches, queries, and exports. Where investigations involve systematic monitoring, data loss prevention tools, or geolocation, a Data Protection Impact Assessment (DPIA) will often be required pursuant to Article 35 GDPR. For processors and cross border transfers, Article 28 GDPR agreements, appropriate transfer mechanisms, and verification of safeguards for non EEA recipients are essential.

4. Physical searches, CCTV, and sensitive zones

Physical searches should be rare, risk-based, and framed by policy or works agreements. Random, announced bag checks at store exits or controlled access to restricted areas can be permissible if proportionate, nondiscriminatory, and transparently communicated. Lockers, desks, and other company property may be inspected where necessary for defined purposes and in a manner that minimizes intrusion, for example in the presence of a witness and with the employee invited to attend if feasible. Private belongings require consent or strong, documented grounds in exceptional cases.

Video surveillance must be purpose limited and confined to justified areas such as entrances, high-risk zones, or cash points. Cameras are prohibited in locations with a high expectation of privacy, such as changing rooms and sanitary facilities, and covert CCTV is restricted to exceptional crime-detection cases backed by concrete suspicion and as a last resort. Employers should provide clear signage where cameras operate, define retention periods as short as possible, and evaluate footage only when a legitimate reason arises. Assess legal bases cumulatively across affected persons. For employees, Section 26 BDSG and Article 6 GDPR may both need to be examined; for non-employees, rely on Article 6 GDPR.

For searches that intersect with interviews or disciplinary steps, maintain the separation between fact-finding and decision-making described in Part II, and align with the fair-interview practices in Part III. Preserve chain of custody and document necessity at each step to mitigate evidentiary exclusion risks.

5. Works council co-determination and data-sharing boundaries

Most systems that can monitor behavior or performance trigger co-determination under Section 87 (1) no. 6 BetrVG. German labor courts interpret this widely. Collection, use, and analysis phases can each be “monitoring,” and even general-purpose tools can be in scope. As a result, many IT and collaboration platforms are subject to co-determination and require tailored works agreements. A works agreement may also serve as a specific legal basis for processing under Section 26 (4) BDSG in conjunction with Article 88 GDPR, but it cannot lower GDPR’s fundamental protections.

The works council’s information right is broad but not limitless. Any transfer of personal data to the works council constitutes processing and needs a legal basis and necessity for the works council’s statutory tasks. The works council is bound by confidentiality, but transfers still must respect employees’ personality rights and data minimization.

6. Process, documentation, and international alignment

Investigative screening should run on a written plan that states purpose, scope, legal basis, roles, and timelines, and that records key necessity and proportionality judgments. Where crime detection is invoked, document the specific indications, the narrower alternatives considered and rejected, and why the chosen measure is the last resort. Maintain a chain of custody for collected data, control access tightly, and use defensible deletion schedules. Anticipate evidence-admissibility risks. Severe violations can lead to exclusion of evidence, and courts will conduct constitutional balancing to determine use; violations of co-determination alone do not mandate exclusion, but unlawful acquisition can.

For multinational groups of companies, align global protocols with German specifics. Across jurisdictions, keeping monitoring targeted, transparent, and time bound is the most portable defense.

7. Dos and don’ts for screening and searches

8. Practical take-aways for Legal, HR, and Compliance

Build a structured monitoring and searches playbook. Define clear investigative pathways that begin with business repositories and escalate only where necessary. Embed the principles of necessity and proportionality at every stage, and include practical templates for purpose statements, legal basis memoranda, balancing tests, and (where applicable) crime detection documentation.

Clarify private use policies and codify guardrails. Decide whether private use of company communication systems is prohibited or permitted. Where private use is allowed, clearly define limits and monitoring parameters in IT policies and works agreements, recognizing both the heightened restrictions on accessing private content and the unresolved interplay between GDPR/BDSG and TDDDG/TKG.

Secure works council approvals early. Most systems capable of monitoring employee behavior or performance trigger co determination rights. Use works agreements to define purposes, data categories, access roles, retention periods, and reporting obligations, thereby reducing operational friction and legal risk. See Part VI for a detailed discussion of participation rights.

Avoid covert or continuous surveillance tools. Keyloggers, continuous screen capture, and blanket content reviews are generally impermissible and may only be considered as a last resort where there is a documented, concrete suspicion of criminal conduct. Wherever possible, rely on open, targeted, and time limited measures.

Plan CCTV selectively and lawfully. Limit cameras to clearly justified areas, ensure visible signage, short and defined retention periods, and documented purposes, and exclude all sensitive locations. Footage should only be reviewed when a legitimate trigger arises, bearing in mind that even lawfully captured data requires a fresh proportionality and purpose assessment before use.

Protect evidence integrity and admissibility. Maintain a clear chain of custody, restrict access on a need to know basis, and align retention strictly with the investigative purpose. Employers should anticipate that unlawfully obtained data may be excluded by labor courts, potentially undermining disciplinary or termination measures. See Part V of our Briefing Series for data processing requirements and exclusion of evidence risks.