Employee monitoring in Poland: 7 questions on GPS, email and IT logs

Cameras are only the most visible form of employee monitoring. Employers in Poland also track company cars by GPS, keep e-mail and internet logs, record helpline calls, deploy productivity software for remote work and, increasingly, use warehouse scanners and AI tools that measure performance. Most of these fall under art. 22³ of the Polish Labour Code, and all of them under the GDPR, but they are usually introduced by a fleet or IT provider rather than by HR, and the paperwork is written for cameras only. In our practice this is the recurring problem: the monitoring is already running while the work regulations still mention CCTV alone.

This news explains what Polish law requires for non-camera monitoring, what regulators in Poland and the EU have penalised, and what to check before you switch a tool on. It is intended for board members, HR, fleet and IT managers and compliance teams of companies employing staff in Poland. For cameras, see our earlier news on workplace CCTV in Poland.

GPS, email, and IT logs: what are the rules for employee monitoring?

Art. 22³ of the Labour Code allows the employer to monitor the employee’s business e-mail where this is necessary to ensure an organisation of work that enables full use of working time and the proper use of the work tools made available to the employee. Under art. 22³ § 4 the same rules apply accordingly to any other form of monitoring, provided it serves those two purposes.

In the commentaries and in UODO’s guidance this covers GPS in company vehicles, logs of websites visited, telephone billing and text messages from company phones, recording of helpline calls, automated time and attendance systems and productivity software, to the extent they serve those two purposes.

A tool that serves other purposes (for example call recording for service quality or evidential purposes) has no basis in art. 22³ and is governed by the general rules of the GDPR alone. The catalogue of purposes is narrower than for cameras: protecting company secrets, which justifies CCTV under art. 22², is not listed in art. 22³, and commentators treat this as a gap the employer has to bridge by defining in its internal rules what proper use of work tools means.

Two limits are absolute. Monitoring may not breach the secrecy of correspondence or other personal rights of the employee, so private mailboxes are off limits and clearly private messages sent from a business account should not be read. The introduction procedure is the same as for cameras: purposes, scope and method set out in the collective agreement, work regulations or a notice; employees informed at least two weeks before the monitoring starts; every new employee informed in writing before being admitted to work; and the monitored tools marked (art. 22² § 9 applied accordingly), which in practice for a company car means a notice visible from the driver’s seat and for a mailbox or laptop can be a message at log-in.

The Supreme Administrative Court, upholding the Warsaw Provincial Administrative Court (II SA/Wa 453/12), had already required lawfulness, a legitimate purpose, proportionality, transparency and compliance with data protection rules before the 2018 amendment (judgment of 13 February 2014, I OSK 2436/12); the Labour Code turned that case law into a procedure.

GDPR applies in parallel: a documented legitimate interest assessment (art. 6(1)(f) GDPR), an information notice covering each form of monitoring (art. 13 GDPR), an entry in the record of processing activities, authorisations for the people who read logs or location data, a data processing agreement with the fleet, telecoms or software provider, and a data protection impact assessment (DPIA) where the monitoring is systematic, which is the default for GPS fleets and productivity software; the list of operations requiring a DPIA published by the President of UODO (M.P. 2019, item 666) expressly names systems monitoring employees’ working time and the flow of information in their tools, and the processing of employees’ location data.

The most common mistakes employers make when monitoring employees

When we review monitoring at manufacturing, logistics and service companies in Poland, the same issues appear regardless of the tool. The fleet provider installs GPS trackers that record location, mileage, fuel and driving style around the clock, the cars may be used privately, and no private mode exists; the employee’s whereabouts on a Sunday then become employer data. The work regulations describe cameras only, so the two-week notice for GPS or e-mail monitoring is never given, and the notice in the car is missing.

A departed employee’s named mailbox stays active for months, is forwarded to a manager and is used to write to customers; merely keeping a named address after employment ends, even deactivated, is what the Warsaw administrative court has held unlawful. E-mail and browsing logs are kept indefinitely for security and then pulled out for a performance review, a change of purpose that neither the GDPR purpose limitation principle nor the purpose set out in the work regulations allows. Remote-work software takes screenshots and measures keyboard activity, although the remote work rules agreed under art. 67²⁰ of the Labour Code say nothing about it.

Employees sign a consent form instead of receiving the statutory notice; consent does not replace the statutory procedure for introducing monitoring and, in employment, is generally not freely given, so it is not a valid basis. Fingerprint readers are used to clock in and out, although UODO (and GIODO before it) has consistently treated this as prohibited even with consent, and since May 2019 art. 22¹b § 2 of the Labour Code allows biometric data only for access control to specially protected premises or information, never for time recording. The Supreme Administrative Court took the same view (judgment of 1 December 2009, I OSK 249/09), holding the use of biometric data for time recording disproportionate to its purpose.

Employee monitoring: what has been challenged in Poland and penalised in the EU?

The Polish decisions published so far are deletion orders rather than fines, and they concern location data as well as mailboxes. In a final judgment of 21 February 2024 (II SA/Wa 1007/23) the Provincial Administrative Court in Warsaw dismissed a company’s complaint against a UODO order requiring it to delete the named e-mail address of a former employee. The employer may keep the correspondence archive and protect business continuity through an automatic reply pointing to a new contact address; a named address, even deactivated, cannot be kept indefinitely because this breaches the principles of lawfulness, data minimisation and storage limitation. UODO’s 2018 guide for employers adds that a business mailbox may be monitored, a private one never, and that for a GPS-tracked car used privately the employer should obtain the employee’s consent to process the data from such private use and provide for it in the car use rules; in practice the safer solution, and the one required by regulators elsewhere in the EU, is to switch tracking off outside working hours (a private mode).

In a judgment of 20 March 2025 (III OSK 1340/22) the Supreme Administrative Court set aside the first-instance judgment and dismissed the employer’s complaint, leaving in force UODO’s order to delete a former employee’s location data collected without the monitoring rules being set out in the work regulations. A field employee had been dismissed on the basis of location data obtained from the log-ins of his business phone, although the purposes, scope and method of the monitoring were not set out in the work regulations or in any other document.

The court held that data obtained in disregard of the Labour Code and the GDPR cannot be kept in reserve for pending litigation with the employee: art. 17(3)(e) GDPR does not protect unlawfully collected data, and an employer that wants to exercise its supervisory rights must first meet its own statutory obligations.

The European Court of Human Rights confirmed in Florindo de Almeida Vasconcelos Gramaxo v Portugal (13 December 2022, no. 26968/16) that GPS in a company car interferes with private life but can be lawful and proportionate where the employee knew about it and the data used was limited to what was strictly necessary for the employer’s purpose, in that case the mileage driven, to control expenses (the device recorded full location data, but the domestic courts limited their use to mileage). Earlier, in Bărbulescu v Romania (Grand Chamber, 5 September 2017), the Court found a violation where an employee’s messages were read without prior notice of the nature and extent of the monitoring.

Elsewhere in the EU the fines are substantial. The Italian authority (Garante), in decision no. 755 of 18 December 2025 (published in January 2026), fined a company EUR 120,000 for telematics devices in company cars that recorded times, mileage, fuel consumption and driving style during both business and private trips and assigned drivers a monthly score, and in decision no. 382 of 28 May 2026 found unlawful a public health authority’s system that recorded vehicle position every 60 seconds with real-time viewing, despite a trade union agreement, for breach of data minimisation, proportionality and data protection by design and for lack of a DPIA (the fine was only EUR 6,000 given the authority’s cooperation and its switch to 15-minute sampling without live viewing).

In April 2025 the same authority fined the Lombardy Region EUR 50,000 (decision no. 243/2025) for keeping e-mail metadata of staff (sender, recipient, subject, time) for 90 days and internet browsing logs for a year, without a trade union agreement: general and preventive collection without a DPIA, far beyond the 21 days the Garante regards as the ceiling for technical metadata, amounts to indirect remote monitoring of employees.

In France, CNIL fined a real estate company EUR 40,000 on 19 December 2024 (decision SAN-2024-021) for excessive remote-work surveillance using Time Doctor software (periodic screenshots and counting of supposed inactivity) and continuous filming of staff, and in the Amazon France Logistique case CNIL’s EUR 32 million fine (December 2023), which concerned, apart from cameras, handheld scanners measuring warehouse workers’ speed and idle time, was cut to EUR 15 million by the Conseil d’État on 23 December 2025: the court accepted that the indicators themselves could rest on legitimate interest, but upheld the finding that keeping productivity data for 31 days was excessive, alongside the CCTV information and security breaches.

Is employee monitoring legal? 7 questions for employers

• Is the tool necessary for working time organisation or proper use of work tools, and could a less intrusive setting (aggregate reports, mileage only, blocked sites instead of logged sites) achieve the same?
• Are purposes, scope and method for each form of monitoring set out in the work regulations or a notice, delivered two weeks before the start, with a written notice for new hires and a marking in the car or at log-in?
• Does a private mode exist for cars used privately, and is tracking limited to working hours?
• Are e-mail and internet logs limited to traffic data with a defined retention period, and is content read only on concrete suspicion under a documented procedure?
• Is there a policy for mailboxes of absent and departing employees (auto-reply, no forwarding, deletion date)?
• Do the remote work rules cover any monitoring software?
• Do you have a legitimate interest assessment, a DPIA, GDPR notices, a register entry, authorisations and a processing agreement with the provider?

AI, monitoring, and platform work: what changes are coming to the law?

Two EU instruments widen this topic. Since 2 February 2025 the AI Act prohibits AI systems that infer employees’ emotions in the workplace (save for medical or safety reasons). AI used to monitor and evaluate workers is a high-risk system under Annex III(4) of the AI Act; the obligations for such systems, originally applicable from 2 August 2026, were deferred to 2 December 2027 by Regulation (EU) 2026/1744 of July 2026. Directive (EU) 2024/2831 on platform work must be transposed by 2 December 2026; the Polish draft act on work performed through digital labour platforms (UC160) was sent for consultation on 6 August 2026, with adoption by the Council of Ministers planned for the fourth quarter of 2026, and covers automated monitoring systems, not only automated decisions, for digital labour platforms.

Illegal monitoring of employees: penalties and claims

The President of UODO may order the monitoring stopped and impose a fine of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (art. 83(5) GDPR). Data obtained in breach of art. 22³ may be challenged as evidence before the labour court and, according to the Supreme Administrative Court (III OSK 1340/22), must be deleted even while litigation is pending; employees may also claim compensation for infringement of personal rights (art. 11¹ of the Labour Code and art. 23, 24 and 448 of the Civil Code in conjunction with art. 300 of the Labour Code). In practice the trigger is usually a dismissed driver or sales representative who discovers that GPS or e-mail data were used against them without the statutory notice.

Legal employee monitoring: check the system before implementation

If your company tracks vehicles, monitors mailboxes or IT activity or uses productivity software in Poland, we can review the set-up against the Labour Code and GDPR and prepare the missing documents: the notice or amendment to the work regulations, GDPR notices, legitimate interest assessment, DPIA, mailbox policy and processing agreements with providers. We regularly support UK and US companies entering the Polish market with HR compliance and local requirements on employee monitoring. Contact us before the tool goes live or to verify a system already in use.