TSJ PV - 1713/2026

Summary

A Spanish court ruled that an employer unlawfully processed accidental Teams recordings of private employee conversations and awarded €335,491.62 in damages (€328,491.62 statutory compensation plus €7,501 for moral damages). The court found the employer violated the employee's fundamental rights to privacy and secrecy of communications by accessing and using the recordings months later in a disciplinary meeting, despite the employee never consenting to or being informed of the recording. The decision emphasizes that employers must obtain prior informed consent and demonstrate legitimate business policies before accessing employee communications, even when recordings are created accidentally.

Full text

Help TSJ PV - 1713/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 09:27, 23 June 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators129 edits Tag: submission [1.0] Latest revision as of 13:50, 1 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators129 editsTag: Visual edit (One intermediate revision by the same user not shown)Line 72: Line 72: }}}} A court held that an employer unlawfully used accidental Teams recordings of private conversations and awarded the employee €335.000 in damages for violation of fundamental rights.A court held that an employer unlawfully processed the accidental recording of a private conversation by a video conference tool. The court held that due to this violation the data subject could terminate their employment relation with cause. == English Summary ==== English Summary == Line 83: Line 83: The participants were unaware that they were still being recorded. During the conversations, they discussed, among other matters, possible strategies connected to substantial changes in working conditions and compensation. The recordings were automatically stored in the company’s Teams environment.The participants were unaware that they were still being recorded. During the conversations, they discussed, among other matters, possible strategies connected to substantial changes in working conditions and compensation. The recordings were automatically stored in the company’s Teams environment. Months later, the new management accessed the recordings. On January 2025, the controller held a meeting with the data subject and referred to extracts of the recordings, stating that their content had affected the trust placed in her. The data subject questioned the legality of the recordings.Months later, the new management accessed the recordings. In January 2025, the controller held a meeting with the data subject and referred to extracts of the recordings, stating that their content had affected the trust placed in her. The data subject questioned the legality of the recordings. The data subject then brought proceedings seeking the termination of her employment contract with compensation. She argued that the controller had accessed and used private conversations obtained without her knowledge or consent, thereby infringing her rights to privacy, secrecy of communications and personal data protection.The data subject brought a labour claim seeking judicial termination of her employment contract for serious breach by the controller. She argued that the controller had accessed and used private conversations obtained without her knowledge or consent, thereby infringing her rights to privacy, secrecy of communications and personal data protection. The Social Court of Bilbao dismissed the claim. It considered the recordings admissible as evidence and imposed a €4,500 penalty on the data subject for bad faith and procedural recklessness. The data subject appealed before the Court.The Social Court No. 9 of Bilbao dismissed the claim. It considered the recordings admissible as evidence, rejected the alleged violation of fundamental rights and imposed a €4,500 penalty on the data subject for bad faith and procedural recklessness. The data subject appealed before the Court. === Holding ====== Holding === The Court partially upheld the appeal.The Court partially upheld the appeal. The Court held that the recordings were unlawful evidence. The data subject had not been informed that Teams continued recording after the meetings had ended, had not consented to it and had not caused the technical error. The mistake of another participant could not remove the data subject’s reasonable expectation of privacy.The Court departed from the first instance court’s reasoning on the key issue of admissibility. The first instance court had held that the recordings were admissible because they had been generated after another participant failed to deactivate Teams. By contrast, the Court held that this mistake could not remove the data subject’s reasonable expectation of privacy. The Court found that this expectation was decisive. The conversations took place after the professional meetings had ended and the participants believed that they were speaking privately. The controller had not shown any prior policy or information allowing it to access and use such recordings for employment purposes.The Court found that the data subject had not been informed that Teams continued recording after the meetings had ended, had not consented to it and had not caused the technical error. The conversations took place after the professional meetings had ended and the participants believed that they were speaking privately. The controller had not shown any prior policy or information allowing it to access and use such recordings for employment purposes. The Court held that the controller infringed the data subject’s rights to privacy and secrecy of communications under Articles 18.1 and 18.3 of the Spanish Constitution, read together with Article 18.4 of the Spanish Constitution, Article 8 ECHR and Articles 7 and 8 of the Charter. It also relied on Articles 87, 88 and 89 LOPDGDD and the Workers’ Statute rules on digital rights at work, which require prior information, proportionality and respect for workers’ privacy.The Court therefore held that the controller infringed the data subject’s rights to privacy and secrecy of communications under [https://www.derechoshumanos.net/constitucion/articulo18CE.htm Articles 18.1] and [https://www.derechoshumanos.net/constitucion/articulo18CE.htm 18.3 of the Spanish Constitutio]n, read together with [https://www.derechoshumanos.net/constitucion/articulo18CE.htm Article 18.4 of the Spanish Constitution], [https://fra.europa.eu/de/law-reference/european-convention-human-rights-article-8-0 Article 8 ECHR] and Articles 7 and 8 of the Charter. It also relied on Articles [https://www.iberley.es/legislacion/articulo-87-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 87], [https://www.iberley.es/legislacion/articulo-88-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 88] and [https://www.iberley.es/legislacion/articulo-89-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 89 LOPDGDD] and the Workers’ Statute rules on digital rights at work, which require prior information, proportionality and respect for workers’ privacy. The Court stressed that the decisive issue was the controller’s later access to and use of the recordings in the employment relationship. Since the evidence had been obtained and used in breach of fundamental rights, it had to be excluded.The Court clarified that the relevant breach was not merely the accidental creation of the recordings, but the controller’s subsequent access to and use of them in the employment relationship. The recordings could not be used as evidence against the data subject because they had been obtained and used in breach of fundamental rights. However, this did not prevent the Court from assessing the controller’s own conduct, namely that it had accessed the recordings and relied on them in the meeting with the data subject. The Court revoked the first instance judgment, declared the employment relationship terminated and ordered the controller to pay €328,491.62 as statutory compensation. It also awarded €7,501 for the violation of fundamental rights. No administrative fine or GDPR corrective measure was imposed.On that basis, the Court found a serious breach by the controller and granted the data subject’s request to terminate the employment contract for cause under [https://www.iberley.es/legislacion/articulo-50-estatuto-trabajadores Article 50.1(c) of the Spanish Workers’ Statute]. It ordered the controller to pay €328,491.62 as statutory compe

Entities