Questions and Answers on Teleworking
France · Guideline · CNIL (National Commission for Computing and Civil Liberties)
Our summary
The CNIL provides guidance addressing common questions about teleworking arrangements, covering data protection, employee monitoring, and privacy rights. It sets out principles for employers implementing remote work, including restrictions on constant surveillance, requirements for prior notification of monitoring systems, and rules for video conference camera use. The guidance applies to both private and public sector organizations in France and emphasizes balancing employer oversight with employee rights.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
6 sections
Introduction and definition of telework
2 sections
This document presents frequently asked questions on telework and reiterates key principles from employment law and the GDPR. Telework is defined as work performed remotely from an employer's premises using information and communication technologies, and is regulated by national agreements and labor codes in France, as well as by specific public sector legislation.
No permanent surveillance tools
Employers may monitor staff activity but cannot subject them to constant surveillance except in exceptional, justified circumstances. Prohibited practices include continuous video or audio monitoring, constant screen sharing, keylogger software, and requiring frequent manual check-in actions. These methods are considered excessively intrusive and disproportionate.
Adapting management methods for telework
Telework requires adapting management and evaluation methods, such as through objective-based controls with reasonable, quantifiable, regularly monitored targets or regular employee activity reports. When employees use personal devices (BYOD), data security and confidentiality must match company equipment levels and the employer remains responsible for data security even on devices they do not control; employers may freely access data on work equipment but not personal devices. Video conferencing camera activation must be carefully evaluated under GDPR; where background blur or similar features are available, employers may require cameras during video meetings, but without such technical solutions employers cannot systematically require camera activation, which should normally be optional since audio participation is usually sufficient, though employers may require camera use in specific cases such as HR interviews, client meetings or introductions of new staff, preferably with prior notice.
For further information
Reference texts
1 section
Ceci peut également vous intéresser
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 5 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data governance and quality, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 1 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 7 are shown.
No permanent surveillance tools 2 controls
- ProhibitionApplies to: DeployerDrafted by the Index
Employers must not subject workers to continuous video or audio monitoring, constant screen sharing, keylogger software, or frequent mandatory check-in actions.
- Applies to: DeployerDrafted by the Index
Employers may monitor staff activity only when exceptional and justified circumstances warrant it.
Adapt management and evaluation methods 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Employers should review supervision and performance assessment methods to suit telework arrangements.
Adapt management and evaluation methods - ObligationApplies to: DeployerDrafted by the Index
Employers should monitor performance through objective-based targets with measurable and verifiable goals reviewed at regular intervals.
Adapt management and evaluation methods - ObligationApplies to: DeployerDrafted by the Index
Employers should request regular activity reports from employees.
Adapt management and evaluation methods - ObligationApplies to: DeployerDrafted by the Index
Employers must ensure that data security standards are equal whether staff use company or personal devices.
Adapt management and evaluation methods - ProhibitionApplies to: DeployerDrafted by the Index
Employers must not access data on personal devices unless staff authorize it.
Adapt management and evaluation methods
Change history
No changes recorded since we began monitoring this policy.