Data protection law: Monitoring employees' business communications

The private use of business devices and communication tools is a hotly debated topic in many companies. Strict prohibitions are often issued, but rarely checked. Trouble usually only arises in such cases when the employer wants or needs to take a look at the communication. Ultimately, it is the individual case that decides. However, there is good news from Strasbourg: the European Court of Human Rights (ECtHR) has at least given its blessing in principle to the evaluation of business communication tools (ECJ, decision of 12.01.2016 - 61496/08).

At issue: A company in Romania had internal regulations prohibiting the private use of the company Internet connection and all communication tools available to employees for work purposes. In addition to the mailbox, these communication tools also included - the case took place in 2007 - a Yahoo Messenger. The later plaintiff was also supposed to use this messenger to communicate with the company's customers. The employee was informed of the ban on private use.

As part of a general review, the company analyzed the employee's Yahoo Messenger for a period of eight days. It was discovered that a considerable amount of private messages had also been exchanged. When confronted with this, the employee initially denied any private use. It was only when he was presented with a 45-page printout of the communication from the period in question that he could no longer help but admit to the private use.

The company then terminated the employment relationship due to the breaches of internal company guidelines. The employee took legal action against this in the Romanian courts. He argued that the information obtained could not be used because it had been obtained in violation of his privacy. The Romanian courts did not follow this argument.

The plaintiff has now taken the case to the ECtHR due to the violation of Art. 8 of the European Convention on Human Rights (ECHR) by the Romanian courts. There he sued the state of Romania because it - acting through the state courts - did not sufficiently protect the privacy of its citizens.

The ECtHR considered this accusation to be unjustified. It emphasized in the decision that a balance must be struck between the interests of the employee on the one hand and the employer on the other. If, as in this case, the private use of communication tools is expressly prohibited, the employer can generally assume that the tools are only used for business purposes. Furthermore, an employer has a legitimate interest in monitoring its employees' compliance with working hours. This applies in any case insofar as these monitoring measures are proportionate in terms of type and scope. In terms of proportionality, the court cited in particular the fact that the evaluation only related to Yahoo Messenger, but not to the email account at the same time. The Court also acknowledged that the specific content of the private communication had not played a role either in the reasons for the employer's dismissal or in the judgments of the Romanian courts. In this case, only the fact that the tool was used illegally for private purposes was of importance. As a result, the interference with privacy was reduced to a minimum, also with regard to the rights of the communication partners.

Irrespective of German peculiarities, the ruling may in future be an important argumentation aid for employers who want to randomly check their employees' communications for compliance with company regulations on private use in order to protect their legitimate interests. However, it must also be taken into account, in particular, that prohibitions on private use may lose their enforceability if they are not monitored and violations are not sanctioned. Then, according to the principles of employment law, a de facto company practice can establish itself despite a written prohibition, according to which private use is permitted after all.

More contributions

BGH zu Umfang der Kopie nach Art. 15 Abs. 3 DSGVO

Gerade das Thema Auskunftsanspruch und Herausgabe der Kopien aller bei dem Verantwortlichen vorhandenen personenbezogenen Daten ist für die Rechtsprechung seit einigen Jahren ein oft behandeltes Thema. Relevanz hat das Thema, weil jedes Unternehmen mit einem Auskunftsanspruch konfrontiert werden kann. Und

Read more "

Privacy

EuGH zu Haftung und Schadensersatz nach DSGVO nach Cyberangriff In einem wegweisenden Urteil (Urteil vom 14.12.2023, Az. C 340/21) hat der EuGH wichtige Fragen zur Auslegung der DSGVO, insbesondere zu den Art. 24 und 32 DSGVO, die die Verantwortlichkeit der

Read more "
Scroll up