Article 20.3 of the Spanish Workers’ Statute (Estatuto de los Trabajadores) allows an employer to adopt whatever monitoring and control measures it considers appropriate to check that employees meet their obligations, and articles 87 to 91 of Spain’s Data Protection Act set the conditions for doing so through computers, email, cameras and GPS. Employers who dismiss tend to rely on the first, and employees who receive the letter tend to believe the second forbids any monitoring at all. Both apply at once, and monitoring is lawful when it meets the conditions of the data protection rules, while evidence gathered by skipping them can be excluded at trial even if it shows exactly what happened.
I am Luis Jurado Cano, registered with the A Coruña Bar Association under number 6317, at Perseus & RC Abogados, and I handle these cases myself, in English if you prefer. I have been a data protection officer since 2019 and a speaker on digital investigation at CyberCamp 2015 (INCIBE) and SECAdmin. I act for employees and advise employers, never both sides of the same dispute. Our wider employment work is on the employment law page.
Work computers, email and phones
Your employer may access the computer, work email account or phone it provides, but only to check that you are doing your job and to protect the equipment, and only after setting rules of use, with input from the workers’ representatives, and telling staff about them. If personal use is allowed, the rules must say exactly what is permitted and how your privacy is protected. Without such rules you keep a reasonable expectation of privacy. Your personal phone is outside all this, because the law refers to devices the employer provides.
A message you posted in a WhatsApp group that a colleague then showed the employer is a different matter. Anyone in a conversation can produce it, so the question becomes whether the screenshot is genuine and complete. If you dispute it, the party relying on it has to prove it with the phone itself, an expert or a notarial record, as I explain in why electronic evidence decides cases.
Cameras at work and GPS in the vehicle
Cameras may be used to monitor work if the employer tells employees and their representatives beforehand, expressly, clearly and concisely. If a camera catches an employee in the act of wrongdoing, a visible CCTV sign is enough. Cameras and sound recording are never allowed in changing rooms, toilets, canteens or rest areas. For tracking a company car or phone, the employer must first tell you, expressly, clearly and unambiguously, that the system exists and how it works. Footage is deleted within a month at most, so an employer relying on a clip has to set it aside in time.
Challenging the evidence at the hearing
Spanish employment courts do not admit evidence obtained in breach of fundamental rights. The objection is raised at the hearing itself, when the evidence is put forward. Unlawful evidence does not on its own make the dismissal null, and the Spanish Supreme Court has ruled along those lines. The evidence is set aside and the dismissal is judged on what remains, so it may end up unfair, or fair if the facts are proved another way. What each outcome means is explained in unfair, null or fair dismissal. You have twenty working days to challenge a dismissal, and filing for conciliation stops that clock, as set out on the dismissals page.
Disconnection and scoring algorithms
Outside working hours, rest periods, leave and holidays you are entitled not to answer work emails or messages, and your employer must have an internal policy on this. If a program scores your performance and you are dismissed on that basis, the letter must still set out specific facts, and a drop in performance only justifies dismissal if it is continuous and deliberate. The works council is entitled to know the parameters and rules of algorithms that affect working conditions and continued employment. The same issues arise in recruitment, as I explain in rejected by an algorithm.
Working in Galicia from abroad
If the rules on computer use or the camera notice were only given to you in Spanish or Galician and you could not read them, tell me, because the law requires that information to be clear and whether it reached you in a form you could understand is worth examining. If your right to live and work in Spain is tied to your job, look at both together before signing anything, and read losing your Spanish work permit.
Employees who take data or divert money
An employee who sends the client database to a personal email before joining a competitor, gets into systems without permission or diverts payments faces both employment and criminal consequences. The conduct can justify a disciplinary dismissal for breach of good faith, and it may amount to disclosure of trade secrets, punishable by two to four years in prison for someone bound to confidentiality, misuse of personal data, unauthorised access to a computer system, misappropriation or computer fraud. Secure the evidence first, before anyone is alerted, because unlawfully obtained evidence also fails in the criminal courts. If personal data has left the company, it must notify the Spanish Data Protection Agency without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to pose a risk to the people concerned. If you are the employee accused, call me before you answer anything, because what you say can end up in criminal proceedings. The criminal side is covered under cybercrime and criminal law.
Where we are
Rúa Torreiro 13, 3.º C, 15001 A Coruña, Spain. Phone +34 677 841 007. If you live elsewhere, we can meet by video call, in English, with the dismissal letter and the messages or footage to hand.
Frequently asked questions
Can my employer read my work email or check the laptop it gave me?
Yes, but only to check that you are doing your job and to protect the equipment, and only if it first set rules of use, with input from the workers' representatives, and told you about them. If personal use was allowed, the rules had to say exactly what was permitted and with what safeguards. Without those rules the access is much harder to defend and the evidence may be excluded. Keep any document or email in which the company explained how you could use its equipment.
I was dismissed over WhatsApp screenshots a colleague passed on. Do they count as evidence?
Anyone who was in the conversation can produce it, so the real question is whether the screenshots are genuine and complete. If you deny they are authentic at the hearing, the employer has to prove it with the phone, an expert or a notarial record. Keep your own phone with the whole conversation and delete nothing, because context often changes what a message means.
A camera nobody told us about recorded me. Is my dismissal null?
Not necessarily. If the employer gave no notice and there was not even a CCTV sign, the footage may be excluded, but the dismissal is then judged on the remaining evidence and may be found unfair, or fair if the facts are proved another way. We prepare the objection to the footage and, at the same time, what each witness can say.
The rules on computer use and cameras were only given to me in Spanish. Do they still apply to me?
The law requires that information to be given beforehand and clearly, and whether a document you could not understand met that standard is well worth examining. Keep what you were given, note the language it was in and whether anyone explained it to you. It can weaken the employer's evidence, although it does not undo everything else in the case.
I am the employer and I suspect an employee is taking client data. What do I do first?
Secure the evidence before you speak to the employee, with a forensic copy of the computer and mailbox made within your company's rules of use. If personal data is involved, consider notifying the Spanish Data Protection Agency, which must be done without undue delay and, where feasible, within 72 hours. And do not let time pass, because a very serious disciplinary offence becomes time-barred sixty days after the company learns of it.