workplace portugal
Is it legal to monitor an employee&#39;s computer usage without their knowledge, in Portugal?
<p>I've posted a question that had some legal repercussions in workplace.stackexchange.com, which is off-topic over there, so I'm asking the legal part of it here.</p>

<p>The situation is this. I'm a (inexperienced) system's administrator. I've been approached by my boss about his suspicions that an employee is playing video games at work. I've also been approached by the employee's coworker, who reported seeing weird flashes from his monitor, and that when someone gets close he switches to work related windows. That coworker was motivated to talk to me because he's overburden with work while his co-worker is lagging behind.</p>

<p>One day, after hours, his boss was snooping around on the employee's pc and asked me for help. We found Diablo 3 installed in the pc, and browser history containing some dating websites. Following these findings, the boss asked me to monitor his computer to get concrete data on those activities.</p>

<p>I can do that from a technical perspective, but I worry that doing so without his knowledge might be legally problematic, especially with the dating sites involved, it's possible I may come across very sensitive information.</p>

<p>There's a good recent decision by the European Court of Human Rights (<a href="http://hudoc.echr.coe.int/eng?i=001-159906#%7B%22itemid%22:[%22001-159906%22]%7D" rel="nofollow">BĂRBULESCU v. ROMANIA</a>). This case, although not entirelly related to your question,  sheds some light over it.
In summary decided in favor of the employer with regard to the possibility of monitoring private messages from the employee.</p>

<p>The reason I say this case might be of good help is because the only Judge who voted against the ECHR decision was the portuguese Judge Pinto de Albuquerque. In his oppinion against he follows the directives defined by the portuguese authority responsible for Data Protection.
He states that: "Internet surveillance in the workplace is not at the employer’s discretionary power (...) Even where there exist suspicions of cyberslacking, diversion of the employer’s IT resources for personal purposes, damage to the employer’s IT systems, involvement in illicit activities or disclosure of the employer’s trade secrets, the employer’s right to interfere with the employee’s communications is not unrestricted."</p>

<p>The portuguese authority (CNPD) states that the employer  must ensure that all employees are informed of which boundaries apply to the use of Internet for private purposes and that some forms of control might be implemented. It also states that any control should not be made in a individualized way, but rather taking into account all internet accesses within the company.</p>

<p>However, it also states that if for "cost or productivity reasons, the employee individualized control shall be done, first, through the counting of the average time spent, regardless of the sites visited." In the case, of excessive use, the employer should issue a warning to the employee.
Finalizing "The control over the daily access time and websites consulted by each worker should only be done in <strong>exceptional circumstances</strong>, in particular where, in the context of his warning, the employee doubts the company's indications and want to check the performance of such access." See thje actual Deliberation <a href="https://www.cnpd.pt/bin/orientacoes/Delib_controlo_comunic.pdf" rel="nofollow">here</a>.</p>

<p>Please see and/or contact <a href="https://www.cnpd.pt/" rel="nofollow">CNPD</a> for more details </p>
