In this blog we discuss the difference between business email and private use of your business email in the context of the GDPR. We then discuss a recent ruling on this, followed by the conclusion we draw from it, with advice for you as an employer.

Recent case on inspecting business email

On 28 December 2021, the Court of Appeal ruled on a case in which an employee signed a settlement agreement to terminate employment as of 1 September 2017. On 8 or 9 June 2017, the employer inspected the employee’s business mailbox (without consent). This revealed that the employee had sent a number of company data to her personal email address. The employer confronted the employee with this and had the employee sign a statement acknowledging that she had sent this company data to her personal email address. The employee also stated that this information had not been shared with third parties and had been permanently deleted from her personal mailbox.

The employee then claimed before the court that the settlement agreement should be annulled or declared void, and sought continued payment of wages (partly based on an award of damages for breach of privacy, partly because of the inspection of the employee’s personal data, and partly to reimburse process-serving costs and legal costs).

The settlement agreement remains in force and no wage claims can be derived from it. Regarding the breach of privacy, the court ruled that: “an employer may only monitor its employee’s emails if:

• it is or can be known to the employee that his emails may be monitored by the employer (for example via staff regulations or under the employment contract);
• there is a legitimate purpose, and;
• the proportionality requirement is met.”

It is not in dispute that even where it is not or cannot be known to the employee that his emails may be monitored, monitoring of those messages by the employer can be deemed permissible. However, there must then be circumstances such that there is no doubt whatsoever that a legitimate purpose is served and that the proportionality requirement is met.”

GDPR on inspecting an employee’s mailbox

Business email

In principle, the employer has, based on the lawful processing grounds under the GDPR, a fair amount of room to monitor. The employer may, as soon as it is necessary in the specific case, inspect the employee’s mailbox. This can be seen as necessary if the employee is absent and it cannot wait until the employee is back, when a customer refers to a specific email, or when there is suspicion of fraud. In these cases, according to the Dutch Data Protection Authority (AP), there is a legitimate interest for the employer to inspect the mailbox. A balancing of interests must then take place: is it proportionate for the mailbox to be read by the employer in this case? This will generally, reasonably, work out in the employer’s favour.

Private use of business email

Private mail on the business account, on the other hand, may almost never be read by the employer. The employee’s privacy rights almost always outweigh this. Under the GDPR, it makes no difference whether or not there are staff regulations. In most cases it is simply not permitted under the GDPR to inspect an employee’s private emails.

Privacy statement

The GDPR also provides that all data subjects (so also customers and freelancers) have the right to transparent information about the processing of their data. An employer must therefore, as controller, explain in a “privacy statement” what happens to the personal data of all data subjects regarding business email, and why. This is the knowability requirement referred to by the Court of Appeal in the ruling above. However, this does not mean that an employer is also obliged to have such an (email) policy for employees.

Employment law on inspecting an employee’s mailbox

Opposite the right to privacy stands the employer’s business and entrepreneurial interest. Case law shows that the court quite often does allow evidence obtained through a breach of the employee’s privacy, for example for a dismissal. This appears to give more weight to the employer’s freedom where this can demonstrate unlawful or culpable conduct. To compensate for the breach of the employee’s privacy, the employer often does have to pay a higher compensation.

For the above, it is however important that:

• The employer makes known in advance that it may possibly monitor the (private) use of electronic communication tools, such as email and internet.
• This must indicate in good time what kind of monitoring the employer carries out.
• The employer must have legitimate, proportionate interests and a reason for monitoring the employee’s email use.

Problematic use of business email for private purposes

As described above, a business email may often be read by the employer and private emails almost never. What now if the business email is also used for private purposes? An employer is then much less readily entitled to view this, in principle business, mailbox. In the event of unexpected long-term absence, it can be very useful for you as an employer to be able to look into your employee’s mailbox, to continue this employee’s work. When this mailbox is also used for private purposes, that makes it more difficult.

Checklist for legitimate monitoring

It is important to properly comply with the GDPR within your organisation, because it is increasingly invoked by employees. In addition, the risk of “a data breach” or “being hacked” is always lurking if the employee routes all sorts of private email traffic through your server. To prevent careless handling of the employee’s personal data, it is advisable to ask yourself the following:

• As an employer, have you sufficiently brought the rules regarding email and internet use to attention?
• As an employer, have you informed the employee in advance that the employer may monitor emails? For example by means of a specific internet protocol/email policy for private use of digital tools within your organisation. You can introduce that at any time and you do not need your employee’s signature for it. Of course, you must be able to demonstrate that you made it known. It is wise to circulate it by email or have it signed for receipt and keep this in the personnel file.
• Has the Works Council consented, if one exists?
• As an employer, have you first tried another, less intrusive way to achieve the same purpose? Think, for example, of a conversation.
• Is there a legitimate interest for the monitoring? For example, suspicion of visiting prohibited websites or underperformance due to excessive internet use.
• Does the infringement of the employee’s privacy outweigh your interest as employer?

Do you have questions about the GDPR and employment-law compliance of your company, for example how such an internet protocol/email policy and the reference to it should be substantively designed? The Legal Company can help you with this quickly and easily.

The corporate lawyers of The Legal Company specialise in privacy law. For support or advice, you can contact us by emailing info@thelegalcompany.nl, calling 020-3450152 or filling in our contact form. We will call or email you back within 24 hours.

Would you like to stay informed on this topic and on all other relevant developments for businesses regarding employment law, contract law, corporate law and privacy law, and receive legal tips & tricks from our corporate lawyers? Sign up here for The Legal Alert!

Nothing changes as constantly as laws and regulations. Please note that our blogs may no longer reflect current laws and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or wish to obtain legal assistance, please contact us.