A stricter regime for profiling07 June 2016
French Court Limits the Scope of Employee Data Protection
But in Bruno B, an accounting firm fired Mr. B after the firm discovered files created on his work computer and addressed to government regulators in which he disparaged the firm for alleged tax and related fraud as well as working conditions. Mr. B then sued the firm seeking damages for unjustified dismissal, arguing that the firm violated his rights under the EU privacy laws because the documents were his personal data. On appeal, the French court held for the accounting firm, finding that because Mr. B failed to mark the documents as “private,” his former employer was justified in assuming that the documents were work-related and, as such, it could open them.
Thus, after Bruno B our view was that in France “there is arguably no right to privacy to an employee’s computer-stored data unless the employee takes affirmative steps to designate the information as personal.” In its new holding on the topic, released 11 July 2013, the French high court took that exact position. See Monsieur X v. Young & Rubicam France, Cour de Cassation [Cass.], soc., 19 June 2013, No. 12-12138.
Monsieur X stemmed from the dismissal of a Young & Rubicam employee for serious misconduct relating to unfair competition. The employer’s termination decision came after a search of the employee’s workplace hard drive revealed numerous email and messages that had been sent to the employer’s competitors.
Unlike Bruno B, here the employee did not even create the communications on his workplace computer, but on his personal computer. He then sent them through his personal email account to his work computer. The French high court was not swayed by the birthplace of these documents, however, and held that, unless documents stored on a work computer are clearly labeled “private,” regardless of origin, the information is presumed to be professional in nature and is available for the employer to search, even in the employee’s absence.
Thus, the Monsieur X case signals France’s continued departure from the unyielding protection of individual privacy rights found in Nikon, and signals a continuing shift toward a more pro-business (or at least, balanced) stance on data-privacy issues. As a bellwether for the rest of Europe, the Monsieur X decision may indicate the start of a trend toward limiting the sacrosanct privacy rights afforded in the workplace, at least unless those rights are prospectively preserved by the employee.
The Regulation aims to strengthen the rights of individuals. It does so by retaining rights that already exist under the Data Protection Directive and introducing the new rights of data...06 June 2016
Grounds for processing03 June 2016