Communications monitoring means the collection, recording and storage of your personal information related to your communications via the telephone, e-mail as well as internet usage.
The monitoring activities may include, but are not limited to:
- the systematic registration and reading of e-mail messages
- the caching of web pages viewed, including the date, time and duration of the visit
- the recording of and listening to telephone conversations
- data analysis in order to draw certain conclusions, registration in specific databases or files and storing for a certain period of time
Purpose of monitoring
Employers are, in principle, allowed to design and apply a communications monitoring policy, as it may serve a legitimate aim. Such legitimate aim could be, for example, the protection of an employer’s business secrets from being unlawfully disclosed to a competing company or the protection of an employer’s property against the excessive use of its facilities for employees’ personal purposes or even thefts.
Informed monitoring
Remember that an employer is obliged to inform you about the monitoring policy and you are also entitled to access the personal data about you collected during the monitoring process. In exceptional cases, however, the disclosure of such information and obtaining your consent may not be mandatory, as your knowledge of being monitored may complicate the achievement of the legitimate aim.
example If an employer suspects that somebody is disclosing data of a confidential nature, such as commercial secrets, to another company or stealing a company’s inventory, covert monitoring for a limited period of the employees suspected might be the most appropriate means to achieve this aim.
The fact that your employer bears the costs for the services or owns the devices does not mean that he/she has full control over your privacy. Employers are, however, allowed to provide internal regulations and policies as to employees’ use of communication devices and the internet at the workplace, by for instance, using blocking techniques for certain websites.
What human rights violation may there be?
The monitoring carried out by your employer at your workplace is an interference with your right to private life. But, only unlawful monitoring may lead to a violation of your right to private life. Remember that both of the following are protected:
- your communications and the use of the internet directly related to the fulfillment of job responsibilities
- your activities which are intended for private purposes, unless you have agreed to the policy not to use the work computer and phone for private communications and web searching
Has the monitoring of communications been conducted lawfully?
To evaluate whether the monitoring of communications has been conducted lawfully and whether your privacy has been sufficiently respected, see the questions below. If, in your situation, your answer to one of these questions is negative, your privacy may have been violated. In such a case, you have the right to complain. Read more about how to complain.
Communications monitoring should have a basis in law. Namely, it can be carried out only in situations stipulated by the General Data Protection Regulation and the Labour Act.
example Your employer has developed internal regulations in accordance with the Labour Law, that telephone conversations with the company’s clients are recorded and analyzed in order to improve the quality of services.
If the monitoring of communications does not correspond to the situations allowed by law, the action taken is not legal and your right to private life may have been violated. There is no need to examine the other questions.
The monitoring of communications at the workplace has to be aimed at the protection of other legitimate interests. Such legitimate interests can, for example, be:
- an employer’s interest in ensuring the safe and productive fulfillment of his/her employees’ job responsibilities
- an employer’s right to protect his/her property against the excessive use of facilities for employees’ personal purposes or even thefts
- the protection of employees’ health
The monitoring of communications at the workplace should be necessary and suitable for the achievement of a legitimate aim. The information gathered has to be important and relevant to achieve the aim of monitoring.
To find out whether the monitoring of communications has been necessary, you should ask the following questions:
a) Has the scope of monitoring been too extensive? Namely, has additional data, not necessary for the protection of other legitimate interests, been gathered?
An employer should only collect and process such data that directly relates to the issues the employer aims to clarify. The data should not be of an extensive scope. Thus, for example, if the company’s policy is to record employees’ telephone conversations with clients in order to ensure quality of the company’s services, the recording of your private conversations without your knowledge would be an excessive action that does not correspond to the initial purpose.
b) Has the gathered data been further processed for purposes that were not initially determined?
If your data has been processed for different purposes than initially determined, your consent should have been sought.
c) Has the data been kept longer than necessary?
The data should only be retained for a very limited period of time, unless it is used for a specific legitimate aim, such as the investigation of an incident. The data shall be deleted after the determined period of time has passed and/or the information is no longer necessary for the initial purpose.
d) Were there any other alternative and less restrictive means available for how to obtain the needed information?
Such a means could, for instance, be a request that the employees submit the relevant information directly themselves.
A fair balance between two competing interests – your right to private life and the legitimate interests of the state or other persons – must be found. There have to be sufficient arguments why the interests of others outweighed your rights and the other way around in the particular case.
The courts would ask the following questions within the balancing process:
a) For how long was the monitoring carried out? Was it carried out systematically?
If the monitoring was carried out systematically, for a relatively long period of time, your right to private life has been limited to a greater extent. The monitoring should be stopped immediately if it is no longer necessary for the achievement of the legitimate aim.
b) Who has access to the employee’s data? Was the data disclosed to other persons?
Your collected data should be made accessible only to those people at the workplace whose job responsibility is related to the monitoring of communications and/or employees’ data processing. This data may be used in disciplinary or other proceedings. However, the content of the communications should not be a decisive element in the findings and should not reveal the identity of the persons and the particular circumstances that you have communicated.