VPN Capture of a Departing Employee in Munich

The capture raises at least four issues. First, German employee monitoring generally requires a legal basis and proportionality; a U.S. litigation hold does not by itself satisfy GDPR or German works-council consultation. The works agreement makes prior consultation a condition, not a formality. Second, the collection swept in special-category health data and financial data, which require a narrow, documented justification and ordinarily should not be reviewed at all. Third, storing the capture in the U.S. may create a cross-border transfer problem that must be assessed before access. Fourth, full-packet capture of TLS traffic is broad; if the objective is contract exfiltration, metadata and targeted content are less intrusive. Before searching, I would obtain written direction from German counsel, engage the works council as required, document a DPIA-style necessity assessment, restrict access to a defined review team, and apply a keyword/date/recipient filter aimed at company contracts. I would preserve the full capture under legal hold but review only the narrow subset that is proportionate, and I would log every access.

I would not conduct a blanket content review. The review should be scoped to the investigation's actual question: whether company contract data was taken. Practical filters include date range around the resignation notice, recipient domains and addresses outside the company, filenames or document identifiers tied to customer contracts, and keywords from the contracts themselves. Personal webmail, banking, and health sessions should be excluded by filter and, where technically possible, redacted before review. A independent reviewer or outside counsel should conduct first-pass review so the forensic team does not see privileged or special-category material unnecessarily. Documentation should include the legal basis, the filter terms, who approved them, the review population, hit counts, inclusion/exclusion decisions, chain-of-custody records, and a decision log. I would also document why broader review was rejected as disproportionate, because that reasoning is what supports the process if HR or a court later challenges it.

I would expect to defend who authorized the capture and under what written authority, where the capture was taken, and why that point was chosen. I would explain the exact BPF filter, start and stop times, capture tool version, interface and storage location, and the clock source and offset. I would produce a hash of the capture file and access logs showing who handled it and when. I would also explain the scope decision: why the filter was limited to one host and port 443, what was not captured, and how personal and special-category data were segregated. If the capture was broader than necessary, I would not claim otherwise; I would explain the proportionality assessment and any later restrictions. Testimony should distinguish what the packet capture actually proves from what it does not, such as content inside TLS without endpoint or proxy inspection. This honesty is more defensible than asserting that a broad capture was routine.