Employers Have Turned Computers and Phones into Surveillance Tools: Where Is the Line Between Control and Employee Privacy

With the spread of remote and hybrid work, more and more Ukrainian companies are using specialized software to control the fulfillment of labor duties.

This includes time tracking systems, automatic screenshots, recording keyboard and mouse activity, auditing corporate devices, logging open programs, geolocation of work devices, and more.

At the same time, such tools often raise questions about the limits of permissible control, the employee’s right to privacy, and the possibility of using the obtained information in labor disputes.

Legal grounds for employee monitoring

The basis of legal relations between employer and employee remains the Labor Code of Ukraine.

The employer has the right to organize the production process, control the performance of labor duties by employees, ensure labor discipline, and check the proper use of company property. However, exercising these powers does not mean an unlimited right to interfere in the employee’s private life.

Since digital monitoring involves processing personal data, the employer must comply with the requirements of the Law of Ukraine "On Personal Data Protection," particularly regarding lawful purpose, proportionality of processing, and informing the employee about the collection of their data. Additionally, Article 32 of the Constitution of Ukraine and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms guarantee the right to respect for private life. It is on the basis of Article 8 of the Convention that the ECHR has developed key criteria for assessing the legality of employee monitoring.

What monitoring methods employers use

The most common control tools today are time tracking programs that record the start and end of work, duration of activity, software usage, and completion of specific tasks.

Employers also use automatic screenshot systems that allow checking whether the employee uses the work computer to perform official duties.

In the corporate environment, auditing work laptops is common, which allows checking installed software, compliance with information security requirements, presence of malicious software, or unauthorized copying of corporate files.

The legal assessment of such measures primarily depends on their purpose. If control is exercised to ensure information security, protect trade secrets, properly organize work, or monitor the performance of official duties, it may be recognized as lawful. At the same time, even a lawful purpose does not justify excessive or covert surveillance.

Is it necessary to inform the employee about monitoring

The issue of prior notification of the employee is of particular importance.

The employee must be informed about the fact of monitoring, its scope, categories of data collected, purposes of such collection, and the procedure for using the obtained information.

In practice, such provisions are advisable to be fixed in internal labor regulations, corporate IT resource usage policies, information security regulations, or directly in the employment contract or an additional agreement.

Employers should be especially cautious when using programs that continuously record the screen, covertly record keystrokes (keyloggers), conduct constant video surveillance, or have hidden access to webcams or microphones. Such tools may create disproportionate interference with private life even when used on corporate equipment.

Supreme Court approach

An important role in disputes regarding employee monitoring is played by the ruling of the Grand Chamber of the Supreme Court dated June 17, 2026, in case No. 553/3599/15-c, adopted after the ECHR decision in the case "Guiwan v. Ukraine." The dispute arose due to the employer collecting information about the employee’s use of a corporate mobile phone and other data that could relate to his private life.

The Supreme Court emphasized that courts considering such disputes cannot limit themselves to checking whether the collected information is personal data. They are obliged to assess whether the interference with the employee’s private life was lawful, necessary, and proportionate according to Article 8 of the Convention and ECHR practice, in particular to determine whether the employer had a legitimate aim, whether the employee was properly informed about the monitoring, and whether there were less intrusive means to achieve that aim. Because lower courts did not carry out such an assessment, the Grand Chamber annulled their decisions and sent the case for a new hearing.

At the same time, the issue of employee monitoring is closely related to the use of digital evidence in court. For example, in case No. 751/4083/24, the Supreme Court effectively confirmed the possibility of using electronic correspondence and other digital materials as evidence in labor disputes.

This indicates that information obtained in a digital environment may have evidentiary value, but the court in each case evaluates not only its content but also the method of obtaining, relevance, admissibility, and reliability.

ECHR practice: where is the line between control and privacy

The practice of the European Court of Human Rights has developed a number of criteria for assessing the legality of employee monitoring.

In the case Bărbulescu v. Romania, the Grand Chamber of the ECHR noted that the mere fact of an employer using monitoring tools does not contradict the Convention for the Protection of Human Rights and Fundamental Freedoms. At the same time, national courts must assess whether the employee was notified in advance about the possibility of such control, what its scope was, whether less intrusive means existed to achieve the employer’s goal, and whether the interference was proportionate to the intended aim.

In another case, Copland v. the United Kingdom, the ECHR emphasized that even the use of telephone, email, and Internet at the workplace may fall within the sphere of private life and correspondence.

Therefore, monitoring such communications constitutes interference with rights guaranteed by Article 8 of the Convention and must be based on a proper legal basis and comply with the Convention’s requirements. The Court applied similar approaches in cases concerning video surveillance of employees, assessing the balance between the employer’s interests and the individual’s right to respect for private life.

What risks arise for the employer

In practice, the greatest legal risks arise when the employer uses covert software, does not inform employees about monitoring, or collects significantly more information than objectively necessary to control work performance.

Equally problematic is the situation when employees use a corporate laptop also for personal purposes, and the system automatically collects private photos, correspondence, or other personal data. In such cases, the court will primarily assess the proportionality of the interference and the presence of a lawful purpose.

Features of control during remote work

Special attention should be paid to remote work. Working from home does not mean that the employer gains the right to control the employee’s residence or personal computer.

If the employee uses their own device, the possibility of installing corporate monitoring software must be clearly regulated by agreement between the parties, and the scope of such control should be limited to the needs of performing the labor function.

Practically, it is advisable for employers to build a monitoring system based on principles of transparency, data minimization, and proportionality. The clearer the rules for using corporate equipment, the list of monitoring programs, data retention periods, and the circle of persons who have access to such data are defined, the lower the risk of labor disputes and claims regarding violation of the right to privacy.

Thus, Ukrainian legislation does not prohibit the employer from using software to control the performance of labor duties by employees. At the same time, such control must be exercised exclusively for a legitimate purpose, be necessary and proportionate, comply with personal data protection laws, and not violate the employee’s right to respect for private life.

Subscribe to our Telegram channel t.me/sudua and to Google News SUD.UA, as well as to our VIBER and WhatsApp, Facebook page and Instagram to stay informed about the most important events.