Can the employer monitor, access, review the employee’s electronic communications?
In general, employers have to make sure that no 24/7 monitoring will occur. Monitoring of the employees requires an overall balance of interest between the privacy rights of the employee and the business needs of the employer. If the employer has prohibited the private use, the content of an employee’s electronic communications can be subject to monitoring activities by the employer, unless such communications are obviously private. If the private use is allowed or tolerated, the employer may be qualified as a provider of telecommunication systems, such being subject to stricter laws, including criminal prosecution for accessing or ordering third parties to access employees’ communications beyond what is necessary for security reasons. As long as this question has not been answered by a German court, we recommend not to monitor the use of employee’s electronic communications.
To be able to control the usage, the private use of Internet and e-mail should be made subject to the consent of the employee. The key principle already applying under the new GDPR/BDSG: processing of personal data is prohibited unless expressly permitted by law, a works agreement or a collective bargaining agreement. Furthermore, it is still possible for an employee to give his/her consent to the specific data processing.
In particular, the consent has to be separate from other terms, and the employer has to inform the employee about the purpose of the data processing, as well as the right to revoke the consent with future effect, and must be done in text (written) form.
Employee’s Use of Social Media to Disparage the Employer or Divulge Confidential Information
The employee is not entitled to disparage the employer towards any third person or in social media. Furthermore, the employee is obliged to settle any disputes, with the employer internally, before leaking out internal information, especially to media.