No one may restrict the rights of persons or individual and collective freedoms unless the restriction is justified by the nature of the task to be performed and proportionate to the aim pursued. Every monitoring device, rule or practice (video, geolocation, IT logging, call recording, time clocks, productivity indicators) must therefore be justified by the task and proportionate to its purpose; the courts derive from this article the employee's right to respect for private life at the workplace and during working time. The CNIL reads it as the first of three cumulative conditions for any activity-control device.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.