The Frankfurt Laptop and the Friday Deadline

Governing law is the location of the employee and the data, not the location of the parent company. A US handbook clause does not displace German employee data protection or co-determination.

Issues:

• Works council co-determination. Technical monitoring systems in Germany generally require works council agreement; proceeding without it exposes the evidence and the company to challenge.
• Lawful basis and proportionality. Processing employee data generally requires a documented legal basis, a defined purpose, and necessity. Covert monitoring is a last resort tied to a concrete suspicion, usually of a criminal offence.
• Timing and fairness. The employee is on medical leave; contact and timing decisions belong with HR and counsel, not the examiner.
• Cross-border transfer. Imaging on-site in Frankfurt is a local act; shipping the image or mailbox to Texas is a transfer of personal data and needs its own analysis.

Escalate to: local counsel, the data protection officer, HR, and through them the works council - before acquisition. Record the advice received and the date. If you are told to proceed without it, get that instruction in writing and note your objection.

Assume it will be there and design for it rather than hoping otherwise.

• Scope the acquisition to the allegation. Source code exfiltration is the target; you still need a full image for integrity, but the review should be governed by a written search protocol naming the keywords, paths, repository names, and cloud-sync artefacts you will look for.
• Minimisation at the review stage. Restrict the review team, keep an activity log, and avoid opening personal photographs or personal mail unless it falls within the protocol.
• Filtering before disclosure. Use a clean-team or independent-examiner arrangement so that personal material is excluded before anything is handed to the company's investigators, the opponent, or a prosecutor. Document what was excluded and on what basis.
• Incidental findings. If the review turns up evidence of an unrelated offence, do not act on it yourself; escalate to counsel, who decides whether and how it may be used.
• Retention. Keep the image only as long as the purpose and any hold require, and document deletion when it happens. 'We kept everything forever because it was easier' is itself a compliance problem.

Acknowledge promptly, preserve, but do not ship.

• Reply on the record within the deadline, confirming receipt, confirming that relevant data has been preserved against deletion, and naming a contact. Silence looks like obstruction; a shipment looks like an unlawful transfer.
• Explain the mechanism. A German prosecutor can compel production locally through German procedural law; informal voluntary disclosure of a copy held by a US parent raises data-protection and transfer problems and may not be a lawful route at all. Where the requesting authority is outside the EU, mutual legal assistance or the applicable e-evidence regime is the channel.
• Do not delete or 'tidy' anything in the meantime - preservation is the one thing you can do unilaterally and safely.
• Route the request through counsel and let them decide what, if anything, is produced and in what form. Your role is to be able to state precisely what exists and where, and to have preserved it, not to decide the disclosure question.
• Log everything: who asked, when, what exactly was requested, what you did and did not do, and on whose instruction.