German guidance on employee monitoring a reminder to carefully craft Acceptable Use Policies
Earlier this year, German data protection authorities issued guidance (in German) for companies regarding monitoring employees’ work email account and Internet usage. The guidance establishes a framework based on the German Federal Data Protection Act (“FDPA”) and whether the employer allows employees to use their work email and Internet services for personal use. Where personal use is prohibited, the data protection recognize a greater scope for monitoring. The guidance also recognizes that employers may randomly check employees’ Internet use to ensure it is being used only for business purposes. Further, employers may access an employees’ sent and received emails during a long absence if required for business purposes.
However, if employees are permitted to use work email and Internet services for personal use, the German Telecommunications Act and the Telemedia Act will apply in addition to the FDPA, and accordingly, the guidance warns that employers are more restricted in monitoring. In particular, there are strict secrecy provisions to protect the privacy of Internet browsing and email communications under the Telecommunications Act. Accordingly, the guidance explains that employers could be barred from accessing employee emails even if the employer suspects the employee of illegal activity that is harming the employer. The guidance further explains that a violation of the strict secrecy provisions under the Telecommunications Act could be subject to prosecution under the German Criminal Code.
Restrictions on employee monitoring can vary significantly based on local law, and can significantly complicate global compliance or even information security initiatives. The effects of company choices on permissible use of IT resources can bring significant consequences. The 2016 German DPA guidance represents another reminder that such decisions should be taken carefully, and furthermore that companies should consider how their policies are in fact implemented. For example, where a policy prohibits personal use, but personal use was common, tolerated and perhaps implicitly accepted, there may well be greater restrictions on monitoring.
The German guidance recommends that employers only allow personal use of the Internet, and prohibit personal use of the company’s email system. Implementing recommendation would enable employees to access their personal email accounts over the Internet, instead of conducting personal communications over the employer email system, and provide greater certainty to companies monitoring of official email accounts where necessary.
In light of the German guidance, and evolving standards in other jurisdictions, companies with a global footprint may wish to examine their acceptable use policies and enforcement practices to ensure a tailored and considered approach that protects monitoring initiatives that may be necessary for critical company objectives.
