Can my employer read my email or track what I do?

The baseline comes from the European Court of Human Rights: Bărbulescu v Romania (2017) — employees keep a reasonable expectation of privacy at work, and monitoring is only lawful with prior clear notice, a legitimate aim, and proportionality (could a lighter measure work?). Consent is largely worthless here: the GDPR treats employee “consent” as rarely free, so employers must lean on legitimate interest — and pass that balancing test. Usually lawful: automated security scanning (spam filters, malware), aggregate capacity stats, targeted investigation on concrete suspicion of serious wrongdoing — narrow, documented, ideally witnessed. Usually unlawful: reading mails marked private, blanket keystroke or screenshot logging, webcam attention tracking, covert monitoring absent grave suspicion, permanent GPS on personal time, and “productivity scores” from full-content surveillance. Several DPAs have fined precisely these — including six- and seven-figure fines against retail chains and call centres. Works councils in many countries (Germany, Austria, the Netherlands and more) must approve monitoring policies before they start — no approval, no monitoring. Your moves: ask in writing for the monitoring policy (Art. 13 duty), file an Art. 15 access request for monitoring data held on you, mark private things private, and escalate to your union, works council or DPA. Home office: same rules — your living room does not lower your protection, it raises it.