May we use AI to track employees' productivity or behaviour?

Sources

1. [1] AP DPIA list (Stcrt. 2019, 64418), list, point 11 (Monitoring of employees) (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). Large-scale processing or systematic monitoring of employees' activities is on the list of mandatory DPIAs. Original Dutch text:

   11. Controle werknemers Grootschalige verwerking van persoonsgegevens en-of stelselmatig monitoring van activiteiten van werknemers (bijvoorbeeld controle van e-mail en internetgebruik, GPS-systemen in (vracht)auto’s van werknemers of cameratoezicht ten behoeve van diefstal- en fraudebestrijding).

   Source, retrieved on 2 October 2026.
2. [2] GDPR Art. 88(1) and (2) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Member States may lay down, by law or collective agreement, more specific rules for the processing of employee data, with suitable measures including for transparency and monitoring systems at the work place.

   Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment,

   Source, retrieved on 2 October 2026.
3. [3] GDPR Art. 88(2) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Such rules include suitable and specific measures, in particular as regards transparency and monitoring systems at the work place.

   Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

   Source, retrieved on 2 October 2026.
4. [4] WOR Art. 27(1), introductory wording (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). For every proposed decision to adopt, amend or withdraw the schemes in Article 27(1), the employer needs the consent of the works council. Original Dutch text:

   De ondernemer behoeft de instemming van de ondernemingsraad voor elk door hem voorgenomen besluit tot vaststelling, wijziging of intrekking van:

   Source, retrieved on 2 October 2026.
5. [5] WOR Art. 27(1)(l) (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). The employer needs the works council's consent for a scheme on facilities aimed at or suitable for observing or monitoring the attendance, behaviour or performance of personnel. Original Dutch text:

   l. een regeling inzake voorzieningen die gericht zijn op of geschikt zijn voor waarneming van of controle op aanwezigheid, gedrag of prestaties van de in de onderneming werkzame personen;

   Source, retrieved on 2 October 2026.
6. [6] AI Act Art. 5(1)(f) (AI Act, Regulation (EU) 2024/1689). Placing on the market, putting into service or using AI to infer the emotions of a natural person in the workplace is prohibited, unless the system is intended for medical or safety reasons.

   the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

   Source, retrieved on 2 October 2026.
7. [7] AI Act, Annex III, point 4(b) (AI Act, Regulation (EU) 2024/1689). AI for decisions on terms of employment, promotion or termination, for task allocation based on behaviour or characteristics, and for monitoring and evaluating performance and behaviour is listed in Annex III.

   AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.

   Source, retrieved on 2 October 2026.
8. [8] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.

   Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and

   Source, retrieved on 2 October 2026.