TSJ PV - 1713/2026

Summary

A Spanish court ruled that unauthorized recordings made by Microsoft Teams after a meeting concluded were inadmissible as evidence in a labor dispute. The court found that the employee had a reasonable expectation of privacy and was not informed or consented to the continued recording. Consequently, the employer's access and use of these recordings violated the employee's rights, leading to the termination of the employment contract with significant compensation awarded to the employee.

Full text

Help TSJ PV - 1713/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 09:27, 23 June 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators128 edits Tag: submission [1.0] Latest revision as of 09:27, 1 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators128 editsTag: Visual edit Line 83: Line 83: The participants were unaware that they were still being recorded. During the conversations, they discussed, among other matters, possible strategies connected to substantial changes in working conditions and compensation. The recordings were automatically stored in the company’s Teams environment.The participants were unaware that they were still being recorded. During the conversations, they discussed, among other matters, possible strategies connected to substantial changes in working conditions and compensation. The recordings were automatically stored in the company’s Teams environment. Months later, the new management accessed the recordings. On January 2025, the controller held a meeting with the data subject and referred to extracts of the recordings, stating that their content had affected the trust placed in her. The data subject questioned the legality of the recordings.Months later, the new management accessed the recordings. In January 2025, the controller held a meeting with the data subject and referred to extracts of the recordings, stating that their content had affected the trust placed in her. The data subject questioned the legality of the recordings. The data subject then brought proceedings seeking the termination of her employment contract with compensation. She argued that the controller had accessed and used private conversations obtained without her knowledge or consent, thereby infringing her rights to privacy, secrecy of communications and personal data protection.The data subject brought a labour claim seeking judicial termination of her employment contract for serious breach by the controller. She argued that the controller had accessed and used private conversations obtained without her knowledge or consent, thereby infringing her rights to privacy, secrecy of communications and personal data protection. The Social Court of Bilbao dismissed the claim. It considered the recordings admissible as evidence and imposed a €4,500 penalty on the data subject for bad faith and procedural recklessness. The data subject appealed before the Court.The Social Court No. 9 of Bilbao dismissed the claim. It considered the recordings admissible as evidence, rejected the alleged violation of fundamental rights and imposed a €4,500 penalty on the data subject for bad faith and procedural recklessness. The data subject appealed before the Court. === Holding ====== Holding === The Court partially upheld the appeal.The Court partially upheld the appeal. The Court held that the recordings were unlawful evidence. The data subject had not been informed that Teams continued recording after the meetings had ended, had not consented to it and had not caused the technical error. The mistake of another participant could not remove the data subject’s reasonable expectation of privacy.The Court departed from the first instance court’s reasoning on the key issue of admissibility. The first instance court had held that the recordings were admissible because they had been generated after another participant failed to deactivate Teams. By contrast, the Court held that this mistake could not remove the data subject’s reasonable expectation of privacy. The Court found that this expectation was decisive. The conversations took place after the professional meetings had ended and the participants believed that they were speaking privately. The controller had not shown any prior policy or information allowing it to access and use such recordings for employment purposes.The Court found that the data subject had not been informed that Teams continued recording after the meetings had ended, had not consented to it and had not caused the technical error. The conversations took place after the professional meetings had ended and the participants believed that they were speaking privately. The controller had not shown any prior policy or information allowing it to access and use such recordings for employment purposes. The Court held that the controller infringed the data subject’s rights to privacy and secrecy of communications under Articles 18.1 and 18.3 of the Spanish Constitution, read together with Article 18.4 of the Spanish Constitution, Article 8 ECHR and Articles 7 and 8 of the Charter. It also relied on Articles 87, 88 and 89 LOPDGDD and the Workers’ Statute rules on digital rights at work, which require prior information, proportionality and respect for workers’ privacy.The Court therefore held that the controller infringed the data subject’s rights to privacy and secrecy of communications under [https://www.derechoshumanos.net/constitucion/articulo18CE.htm Articles 18.1] and [https://www.derechoshumanos.net/constitucion/articulo18CE.htm 18.3 of the Spanish Constitutio]n, read together with [https://www.derechoshumanos.net/constitucion/articulo18CE.htm Article 18.4 of the Spanish Constitution], [https://fra.europa.eu/de/law-reference/european-convention-human-rights-article-8-0 Article 8 ECHR] and Articles 7 and 8 of the Charter. It also relied on Articles [https://www.iberley.es/legislacion/articulo-87-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 87], [https://www.iberley.es/legislacion/articulo-88-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 88] and [https://www.iberley.es/legislacion/articulo-89-ley-organica-proteccion-datos-personales-garantia-derechos-digitales-lopdgdd 89 LOPDGDD] and the Workers’ Statute rules on digital rights at work, which require prior information, proportionality and respect for workers’ privacy. The Court stressed that the decisive issue was the controller’s later access to and use of the recordings in the employment relationship. Since the evidence had been obtained and used in breach of fundamental rights, it had to be excluded.The Court clarified that the relevant breach was not merely the accidental creation of the recordings, but the controller’s subsequent access to and use of them in the employment relationship. The recordings could not be used as evidence against the data subject because they had been obtained and used in breach of fundamental rights. However, this did not prevent the Court from assessing the controller’s own conduct, namely that it had accessed the recordings and relied on them in the meeting with the data subject. The Court revoked the first instance judgment, declared the employment relationship terminated and ordered the controller to pay €328,491.62 as statutory compensation. It also awarded €7,501 for the violation of fundamental rights. No administrative fine or GDPR corrective measure was imposed.On that basis, the Court found a serious breach by the controller and granted the data subject’s request to terminate the employment contract for cause under [https://www.iberley.es/legislacion/articulo-50-estatuto-trabajadores Article 50.1(c) of the Spanish Workers’ Statute]. It ordered the controller to pay €328,491.62 as statutory compensation for the termination of the employment relationship. The Court also awarded €7,501 as compensation for moral damages caused by the violation of the data subject’s fundamental rights. It did not award the €100,000 requested by the data subject, considering that the initial recording was accidental and that the controller had not installed a deliberate surveillance system. No administrative fine or GDPR corrective measure was imposed, as this was a labour court case rather than a DPA enforcement procedure. == Comment ==== Comment ==

Entities