A stricter regime for profiling07 June 2016
Analysis of Recent Developments in German Law Concerning Employer E-Mail Monitoring
Tim Wybitul, who is Of Counsel at Hogan Lovells in Frankfurt, has provided an analysis of recent German cases concerning employers monitoring and examining employee e-mail.
Most German data protection authorities are of the opinion that it may constitute a criminal offence if an employer reviews employee emails (provided that the employer has not prohibited personal use of the corporate email systems). This very restrictive view can be quite a challenge in e-discovery and internal investigations. Two German courts recently ruled that employers may access their employees' business email accounts, if they observe the privacy rights of these employees.
In German, many employers permit the personal use by employees of their corporate email accounts. It is unclear, however, whether – and to what extent – these employers may control employee email communication. This is an important issue for companies because, under Sec. 206 Para. 1 of the German Criminal Code [StGB], the persons involved can be prosecuted for violating secrecy of telecommunications laws.
So far, employers that permit such personal use of corporate email accounts have been regarded, in prevailing legal literature and by many German supervisory authorities, as telecommunications service providers pursuant to Sec. 3 No. 6 Telecommunications Act [TKG]. Taking this view, employers are banned by Sec. 88 Telecommunications Act from inspecting corporate email accounts that employees may also use for personal purposes.
However, the Labor Courts of Appeals [Landesarbeitsgerichte – LAGs] of Lower Saxony and of Berlin-Brandenburg recently ruled that employers permitting the personal use of corporate email accounts are not subject to the restrictions of the Telecommunications Act.
In this article, we provide an overview of the current legal situation and describe the practical consequences of the new case law. It describes legal exposure resulting from email reviews and suggests how to avoid liability. Moreover, the article gives concrete advice on how to deal with the present legal situation.
A full copy of the English translation of the article is available here.
The Regulation aims to strengthen the rights of individuals. It does so by retaining rights that already exist under the Data Protection Directive and introducing the new rights of data...06 June 2016
Grounds for processing03 June 2016