Privacy & Information Security Law Blog

On March 20, 2013, the French Data Protection Authority (“CNIL”) issued (in French) guidance on keylogger software (the “Guidance”). Keylogger software enables an employer to monitor all the activities that take place on an employee’s computer (such as every key typed on the computer’s keyboard and every screen viewed by the employee), without the employee’s knowledge.

In France, employees are permitted to use their employer’s computers or other IT resources for limited private purposes. The data recorded via keylogger software could possibly include private emails sent or received by an employee, private bank card numbers or passwords.

According to the Guidance, the use of keylogger software leads to a constant and permanent monitoring of employees’ professional and private activities. Because of this, the CNIL stated that the use of keylogger software on an employees’ office computer is prohibited in the absence of a strong business justification (such as preventing the disclosure of trade secrets). The CNIL also discussed in the Guidance that it has served formal notice on a company to cease the processing of data via keylogger software.