Employment digital forensics in Barcelona
I prepare the digital evidence for a dismissal or an employment dispute so it reaches the trial intact, on time and obtained without breaching the employee's rights.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
Why does digital evidence decide so many dismissals?
Because almost every fact in a dismissal letter now leaves a digital trail: emails, copied files, logins, time records, messages or posts. If that trail is not properly preserved, the other side challenges it and the fact goes unproven.
In the Spanish labour courts, evidence is taken at the trial hearing itself. An expert report that arrives late, or that does not explain where each piece of data comes from, loses almost all its value.
Before dismissing: preserve without breaching rights
The rule is simple: evidence obtained in breach of fundamental rights is not admitted. Article 90.2 of the Spanish Labour Procedure Act (LRJS) says so, and it also covers anything derived from that evidence.
So before opening a computer or a mailbox, three things should be checked with the lawyer: whether rules on the use of equipment had been communicated to staff (article 87 of the Spanish Data Protection Act, LOPDGDD), whether the employee knew there could be monitoring, and whether the review is proportionate. The European Court of Human Rights set out those criteria in Bărbulescu v. Romania, and Spanish courts apply them.
My part is technical: keeping access to the minimum necessary, documenting it step by step and making it repeatable. Whether it was lawful is for the lawyer to assess and, ultimately, the judge.
What I analyse in an employment dispute
- Company computers and laptops: files copied to USB drives or personal cloud storage, deletions before the equipment was returned, installed software and an activity timeline.
- Company email, Teams or Slack on the company's server, with searches limited by dates and keywords, not blanket reviews.
- Time recording systems, VPN and access logs: when someone connected, from where and with which user.
- Social media: posts during sick leave, work for a competitor or disclosure of internal information, preserved with a SHA-256 hash and an RFC 3161 timestamp.
- WhatsApp messages between colleagues or with clients, from the device of whoever received them and with their consent.
Social media during sick leave
It is one of the most frequent cases: the company sees TikTok or Instagram videos that do not fit with medical leave, or an employee presenting the company's work as their own. A screenshot someone took with their phone is not enough.
What I do is preserve the original content reproducibly, document the account and the indications pointing to who runs it, and compare what was posted with the company's sites, dates or materials. If the comparison is not conclusive, the report says so. Whether the conduct justifies a dismissal is for the judge to decide, not the expert.
If you are the employee: reviewing the company's evidence
I also work for the other side. I review how the company obtained its evidence, whether the chain of custody has gaps, whether screenshots may have been edited, or whether the opposing report's conclusions go beyond what the data supports. A well-made rebuttal report can remove the basis for a fact in the dismissal letter.
What you receive and when
- A signed expert report, with the technical facts kept separate from the assessments that belong to the judge.
- An appendix with the hash table of every file and the chain of custody record, following UNE 71506, ISO/IEC 27037 and RFC 3227.
- A written deadline in the quote, planned to reach the trial date with time to spare.
- Testimony in court, quoted from day one.
Frequently asked questions
Common questions about this kind of report.
Can a company analyse an employee's laptop?
Yes, under certain conditions: the equipment must belong to the company, rules of use must have been communicated and the review must be proportionate. That is a legal assessment your lawyer should make first; I make sure access is minimal, documented and repeatable.
Is WhatsApp valid evidence in a Spanish employment trial?
Yes, it can be submitted, but if the other side challenges its authenticity it has to be proven. The expert report checks the conversation against the phone or its backup and leaves verifiable hashes.
Can someone be dismissed over a TikTok video posted while on sick leave?
It depends on the case, and the judge decides. What I can provide is proof that the video exists, when it was posted, from which account and with which indications of who runs it, preserved so its integrity cannot be disputed.
What if the company obtained the evidence unlawfully?
That evidence is not admitted at trial, and neither is anything derived from it (article 90.2 LRJS). That is why it matters so much to plan the preservation before touching anything.
How much time is there to prepare the report?
Only until the trial, and sometimes that is not much. For standard cases I deliver the report in seven days; if the trial is close, tell me when you ask for a quote and I will plan around that date.
Do you also work for employees?
Yes. I write rebuttal reports on the digital evidence submitted by companies and party reports for employees, with the same method and the same independence.
Related articles
To understand this kind of case better.
- Despido por redes sociales durante la bajaQué tiene que demostrar el informe cuando el despido se basa en TikTok o Instagram.
/blog/despido-redes-sociales-baja - Cómo certificar una conversación de WhatsAppCaptura, acta notarial o pericial: qué aporta cada uno y qué necesito de ti.
/blog/certificar-conversacion-whatsapp
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.