DPO DPO Israel
Open as Markdown

Employee Privacy Policy — Monitoring, BYOD, CCTV

Employees are not regular data subjects. The employer-employee relationship has built-in power imbalance, and the Labor Court ruled time and again that consent in an employment relationship is suspect. Here is the practical guide to an employee privacy policy that withstands audits and employee claims — under Amendment 13 and 15 years of Labor Court precedent.

Why a separate employee privacy policy

Employees are not regular data subjects. The employer-employee relationship has built-in power imbalance — an employee cannot really refuse data processing without risking their job. The Israeli Labor Court ruled, time and again, that consent in an employment relationship is suspect, and that the employer must justify every data collection on independent legal basis — not consent alone. Therefore the website privacy policy is not enough. The organization needs a separate employee privacy policy, that addresses the specifics of the employment relationship: what is collected pre-hire, what is collected during employment, what is the scope of monitoring, what is BYOD, what happens at end of employment. This is a document every employee must sign at hire, and every change requires explicit re-signature.

Pre-hire data — what is allowed and what is not

In the recruitment process the employer is allowed to collect data that is genuinely relevant to the job — and only that. Allowed: education, professional experience, recommendations (with candidate consent), basic background check for sensitive positions, fitness questionnaire if the job justifies it (driver, security worker). Not allowed: questions about marital status, pregnancy plans, religion, sexual orientation, political views, criminal record (except in specific cases authorized by law). Allowed in a limited way: psychometric tests if relevant to the job; reference checks with candidate consent. Pre-hire data must be deleted within a defined period for candidates not hired (we recommend up to 12 months unless candidate consented to retention).

Active employee file — required and prohibited fields

The active employee file is divided into three categories. Required: full name, ID number, contact details, salary and payslips, attendance reports, professional training, performance evaluations. Allowed under conditions: medical data (only with documented consent and only when necessary for the job — accessibility accommodations, occupational health), biometric data for time-clock (only with explicit consent + alternative — see below), family details (only what is necessary for tax / National Insurance / pension purposes). Prohibited: religion, political views, sexual orientation, drug-use history (unless authorized by law), private medical issues unrelated to ability to perform the job. Map every employee data flow as part of data mapping.

Monitoring computer, email, internet activity

Workplace email and computer monitoring is one of the most sensitive areas. The Labor Court ruled — case Issakov 2011 and later rulings — that monitoring is allowed only when: (a) there is a clear, written, and signed monitoring policy in advance; (b) the employee was specifically notified of monitoring; (c) the monitoring is proportionate to the legitimate purpose; (d) less intrusive alternatives were considered; (e) there is a clear distinction between work email and personal email — and the employer cannot read personal email even if used at the workplace. Practically: a written policy + employee signature + monitoring tool that flags emails as "personal" and excludes them = compliance. Random monitoring without policy = labor lawsuit waiting to happen.

Workplace CCTV — Labor Court requirements

Workplace CCTV is allowed under strict conditions established by the Authority and Labor Court: (1) Legitimate purpose — physical security, theft protection, occupational safety — and not employee monitoring; (2) Clear signage at every workplace entrance and at every monitored location; (3) Proportionate location — common areas yes, private rooms no, bathrooms and changing rooms absolutely never; (4) Limited retention period — usually 30 days, except for an active investigated incident; (5) Limited access — only those who need to view; (6) Audio — additional layer that requires separate justification; (7) Notice in employment contract or employee privacy policy. Many organizations install cameras without complying — and pay heavily when an incident reaches court.

BYOD — personal device for work

Use of a personal device for work (Bring Your Own Device) is a difficult intersection between employer right to protect data and employee right to privacy. Key rules: (1) Written BYOD policy with employee signature; (2) Clear distinction between organizational data and personal data on the device; (3) MDM (Mobile Device Management) that monitors only the organizational layer — and cannot read personal WhatsApp, photos, browsing; (4) Remote wipe only of the organizational layer on resignation or device loss — not full device wipe; (5) Explicit consent to the policy. A common scenario: an employee left the organization, the employer wiped the entire device including personal photos and family contacts = labor lawsuit + significant compensation.

Biometric attendance clock — strict conditions

A biometric time-clock (fingerprint, facial recognition, palm) requires special conditions, as the data is highly sensitive and unchangeable. Authority and Labor Court require: (1) Explicit written consent from every employee, separate from the employment contract; (2) A clear non-biometric alternative — magnetic card or login code — without negative consequence; (3) Storage of biometric template only, not the original image, and on a local secure server; (4) Limited retention — only as long as the employment relationship + a brief reasonable period afterward; (5) Documented risk survey showing the biometric is genuinely needed (not just convenience). Many organizations rolled out a biometric clock as the default without alternative = labor lawsuit and Authority sanction.

End of employment — retention and deletion

On termination of employment relationship, not all data is deleted at once. Retention periods by data type: Payslips and tax data — 7 years (Income Tax Ordinance); Employment contract and performance evaluations — 7-15 years depending on contract type and litigation potential; Email and personal files — usually 30-90 days for handoff and continuity, then deletion; Workplace CCTV footage — 30 days from incident date if no active investigation; Biometric data — deletion as close to termination as possible. A written, documented deletion procedure is mandatory under the 2017 regulations. An old employee whose data is still in the organization 10 years after termination without legal basis = direct breach.

How we help

In our DPO as a Service retainer we draft a custom employee privacy policy, aligned with all monitoring and CCTV practices in the organization, with employee signature forms. For tech organizations and startups — see SaaS & startups sector page — we add specific clauses on BYOD, source code, intellectual property, and remote work. We also conduct annual employee training on the policy and on data subject rights — see the related security procedure template.

Frequent questions about employee privacy policy

Can I monitor employees without notifying them?
No. Categorically not. The Labor Court ruled in dozens of cases that covert monitoring without notice is a gross breach of employee privacy — and exposes the employer to lawsuits up to hundreds of thousands of shekels in damages. Even when monitoring is fully justified (preventing fraud, protecting trade secrets, occupational safety) — notice is mandatory. The standard procedure: written employee privacy policy + employee signature on receipt + reminder via legal email at the time of each material change. Covert monitoring is allowed only in very specific situations (active investigation of a specific incident, with internal legal counsel approval) and even then is risky.

What is the line between BYOD and full enterprise device?
The fundamental difference: in BYOD the device is the employee’s property, in enterprise device the device is the organization’s property. This has dramatic implications for privacy. On organizational device — wide monitoring is allowed (with notice), full wipe on departure is allowed, broad usage policy. On personal device — only monitoring of the organizational layer is allowed (corporate email, organizational apps), wipe is allowed only of the organizational layer, and any access to personal data is a violation. Most organizations choose a hybrid model: enterprise laptop + BYOD phone. Each requires a different policy.

Are workplace CCTV cameras allowed in open offices?
Allowed under conditions, but you need to be careful. Allowed at the entrance to the office, at the central reception, in the parking lot, in the warehouse. Not allowed facing a single specific employee’s desk (this is employee monitoring, not security), not in restrooms / bathrooms / changing rooms / breastfeeding rooms, not in conference rooms (private conversations). In an open office (open space) — a camera covering the general space is usually fine, with clear signage and 30-day retention. A camera with face recognition or behavior analytics — that is a significantly higher level requiring a separate DPIA and stronger justification.

Can I read an employee’s work email after they left?
A complex question with no clear yes/no answer. Generally: in the period immediately after departure (30-90 days) the employer is allowed to access the work email for purposes of work continuity — provided this was explicitly stated in the employee privacy policy and explicitly notified at departure. Personal emails the employee marked as private should not be read. After the handoff period, the email should be archived or deleted. Reading email years after departure without specific justification = privacy breach. The best practice: automatic out-of-office message saying "the employee has left the organization, contact X", and email forwarding for a defined period — not direct mailbox access.

Do I need to sign the employee privacy policy with every employee?
Yes. Mandatory. At hire, and at every material change in the policy. The signature must be on a separate, dedicated form — not buried in a 30-page employment contract. The Labor Court and the Privacy Authority are firm on this — consent that is not specific, knowing, and free is not valid consent. Best practice: separate page, separate signature, brief explanation in plain language above the signature, copy retained in the employee file, electronic copy in the HR system. Without an updated signature — the entire monitoring / CCTV / BYOD policy is suspect.

How is the employee privacy policy different from the website privacy policy?
Two completely different documents, that grew from different legal duties. The website privacy policy regulates the relationship with site visitors and customers — under Amendment 13 transparency duty. The employee privacy policy regulates the relationship with employees — under labor laws + Amendment 13 + Labor Court rulings. The employee policy is significantly stricter, because the power imbalance is bigger and the data is more sensitive. Cannot merge them. Cannot reuse them. Each one needs a separate process and separate signatures. Both must be aligned with the database definition document.

What is the most common Authority finding in employee privacy area?
Top of the chart: monitoring without an updated written policy. The organization installed monitoring tools (DLP, email monitoring, network monitoring) — but never updated the employee privacy policy and never specifically notified employees. Second: workplace CCTV without signage or with signage only at the entrance and not at every monitored location. Third: biometric clock without explicit consent and without alternative. Fourth: former employee data retention without legal basis — payslips from 2014 in the active system in 2026, without retention policy and without active deletion. All of these are findings we routinely fix in gap analysis.

Is the employee privacy policy included in DPO as a Service?
Yes. The DPO as a Service retainer includes drafting the employee privacy policy in Hebrew (and English for international organizations), aligning with current monitoring / CCTV / BYOD practices, drafting consent forms for biometric and special data processing, and annual employee training. We also walk you through the practical rollout — how to present the policy to employees, how to handle objections, how to update on organizational change. All of this is included in monthly retainer pricing, not a separate one-off project.

Need an employee privacy policy that survives a labor lawsuit?

30-minute call, draft within two weeks, signed final within a month — with employee signature forms.

DPO as a Service details