E-Mail and internet at work primarily serve the company\u2019s business purposes. However, in many cases, employers allow or tolerate private use of company e-mailing or internet systems. This may result in severe restrictions for the company\u2019s access to data stored in such systems. Companies are well advised to implement clear rules on (private) use in order to prevent undesired consequences.<\/p>\n
The German Federal states\u2019 data protection authorities\u2019 assembly, the so-called D\u00fcsseldorf circle, has recently addressed unsolved problems regarding private use of company e-mailing and internet systems in a guidance note. The guidance note summarises the current state of discussion (see item 2.) and provides a number of recommendations and sample internal regulations on e-mail and internet-use in companies (see item 3.2. E-Mail and Internet-Use
\nAs a matter of principle, company e-mail and internet-systems serve company purposes and may be used for private purposes with permission only, but requirements for such permission are rather low. Where an employer tolerates such use for a certain period this may be considered a permission. The consequences may be severe.
\nFollowing the data protection authorities\u2019 opinion, the employer becomes telecommunication service providers upon such permission, is bound to ensure the secrecy of telecommunication and my access telecommunication contents under very restricted circumstances only. In particular, where this is strictly required for ensuring the systems\u2019 security.
\nSuch restricted access to telecommunication contents turn into a real problem for any company, where e-mails need to be retained for bookkeeping or taxation purposes, employees are absent without sufficient notice or telecommunication contents turn relevant in an employment related dispute. In the context of internet-usage, respective restrictions tend to be less severe and in particular affect monitoring (miss)use of corporate internet systems.<\/p>\n
Clear internal regulations on permitted use of corporate e-mail and internet are for the above reasons essential, both for employers and employees. From a data protection perspective, prohibiting any private use of corporate IT- and communication systems would be the measure of choice. Where such prohibition is effectively enforced, the employer would in principle ensure unrestricted access to its corporate data. This way is, however, rather rarely chosen.
\nAn alternative measure providing for employees\u2019 access to corporate e-mailing and internet-systems while providing for access of the employer also, is described in the data protection authorities\u2019 guidance note. This way includes a limited permission to using corporate internet systems while preventing private use of the corporate e-mailing-system. This would enable employees to use web-mailer for private purposes while the employer would not be restricted in regard to accessing the corporate e-mailing-system and reasonably monitoring.
\nAs an alternative or additional measure, the employer may implement logging or monitoring of using corporate e-mail or internet-systems in respective internal regulations (e.g. an e-mail and internet policy) or a works council agreement.
\nSuch general regulation may be implemented in connection with an individual request for consent to respective measures as a condition for the permission of private use. The employer shall in this context ensure that employees may express or reject their consent free of disciplinary consequences whatsoever. He may, however, make consent the condition for using corporate e-mailing and\/or internet-systems.
\nImplementing such internal regulations triggers codetermination rights of the works council for implementing technical systems of any kind that may be used for monitoring employees\u2019 behaviour at work. Where a works council is in place, a works council agreement would typically be the regulation of choice.<\/p>\n
Private e-mail and internet use are not regulated in an appropriate manner in many companies. Such companies should carefully assess their internal regulatory framework. In this context, the worst solution is no internal regulation. In order to tailoring the fitting approach for each company, the data protection authorities\u2019 guidance note provides valuable advice.<\/p>\n","protected":false},"excerpt":{"rendered":"
E-Mail and internet at work primarily serve the company\u2019s business purposes. However, in many cases, employers allow or tolerate private use of company e-mailing or internet systems. This may result in severe restrictions for the company\u2019s access to data stored in such systems. Companies are well advised to implement clear rules on (private) use in […]<\/p>\n","protected":false},"author":4,"featured_media":849,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[32,35],"tags":[],"class_list":["post-851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-employee-data-protection","category-telemedia"],"yoast_head":"\n