Monitorowanie poczty elektronicznej przez Twojego pracodawcę: kiedy może odczytać Twoją pocztę?

Yes, your employer can read your work email in the Netherlands, but only within narrow limits and never simply because the company owns the mailbox. Reading content always needs its own justification: a legitimate interest under the GDPR, a search that is necessary and proportionate, a written policy you knew about in advance and, where there is a works council, its prior consent to the monitoring arrangement.

Business email is a company system, so your employer sets the rules for its use. Below we explain when reading your email is lawful, where the limits lie and what you can do if your employer went too far.

Czy mój pracodawca może czytać moje e-maile?

Tak, z konkretnego powodu biznesowego i tylko w zakresie, w jakim ten powód sięga. Obowiązują jednocześnie dwa zestawy przepisów: holenderskie prawo pracy i RODO.

Zgodnie z artykułem 7:660 holenderskiego kodeksu cywilnego (Kodeks cywilny, BW) your employer may give instructions about the use of company equipment and check whether you follow them. Under the General Data Protection Regulation (GDPR, in Dutch AVG), the content of your mailbox and its traffic data are your personal data, so every inspection needs a legal basis. The Dutch Data Protection Authority (Holenderski organ ochrony danych, AP) supervises that second layer.

Technical access is not permission. A system administrator can nearly always open a mailbox or restore a deleted message, but whether your employer may look is decided by the GDPR and the duty to act as a good employer (dobry werkgeverschap, Article 7:611 BW). The heavier the intrusion, the stronger the reason must be: automated spam and malware filtering is easy to justify, a manager reading months of a colleague’s correspondence is not.

Na jakiej podstawie prawnej pracodawca może Cię monitorować?

Almost always on legitimate interest under Article 6(1)(f) GDPR, not on your consent. Consent under Article 6(1)(a) GDPR is rarely freely given in an employment relationship.

Legitimate interest demands three things, assessed and recorded before the mailbox is opened: a real and present interest, processing that is necessary to serve it, and a balance with your rights that comes out in the employer’s favour. Interests that hold up are concrete: a security incident, a suspected leak of trade secrets, suspected fraud or a duty to investigate imposed by a regulator. A general wish to see how hard people work does not.

The principles of Article 5 GDPR apply in full. Material found while investigating a data leak cannot be reused as a performance file, searches must be limited to what is necessary, and a mailbox export must be deleted once the investigation and any procedure are closed. For systematic and extensive monitoring, a data protection impact assessment (DPIA) is required under Article 35 GDPR. A clause in your contract agreeing to monitoring shows you were informed, but does not replace the balancing test or the works council’s consent. Our overview of ochrona poczty elektronicznej i danych zgodnie z RODO explains how these obligations fit together.

W jaki sposób konieczność i proporcjonalność ograniczają zakres poszukiwań?

Konieczność pyta, czy cel można osiągnąć bez czytania skrzynki pocztowej. Proporcjonalność pyta, czy skala ingerencji jest zgodna z problemem.

The least intrusive route comes first (subsidiarity). In a suspected data leak, that means metadata before content: sender, recipient, timestamp and attachments are often enough to confirm or dispel a suspicion. If a manager needs one file from the mailbox of a colleague on sick leave, the colleague can forward it or an administrator can run a narrow search; a mailbox during sick leave is likely to contain medical data, a special category under Article 9 GDPR.

A proportionate search is limited in people, search terms and time: the team concerned, terms tied to the leaked material and a window of weeks around the incident. It is carried out by someone without a personal stake, such as the privacy officer or an external specialist, and everything is logged.

Czy prywatne wiadomości w skrzynce firmowej są chronione?

Yes. Article 8 of the European Convention on Human Rights (ECHR) protects private life and correspondence at the workplace too, and Dutch courts apply it directly.

In Bărbulescu v. Romania (5 September 2017) the Grand Chamber of the European Court of Human Rights set out the factors to weigh: whether the employee was told in advance, how far the monitoring went, whether there were legitimate reasons, whether a less intrusive method was available, the consequences for the employee and the safeguards offered. When your employer comes across a message that is obviously private, or reveals health, religion, union membership or political views, it must stop reading and leave it out of the file.

Keep personal correspondence out of your work account, and move anything personal that does arrive into a clearly named folder. Messaging apps on your own device shift the balance further; see our article on whether Twój pracodawca może czytać Twoje wiadomości WhatsApp.

Dlaczego rada zakładowa musi wyrazić zgodę pierwsza?

Because Dutch law gives the works council (ondernemingsraad) a right of consent over monitoring arrangements. Introducing, changing or withdrawing an email or internet monitoring arrangement needs its prior consent.

Article 27(1)(k) of the Works Councils Act (Wet op de ondernemingsraden, WOR) covers the processing and protection of personal data of staff, and Article 27(1)(l) covers facilities suitable for checking attendance, conduct or performance. Email logging, internet filtering, camera surveillance and productivity software fall under one or both. Without consent, the works council can invoke the nullity of the decision in writing within one month (Article 27(5) WOR), and ask the subdistrict court (sąd rejonowy) to order compliance.

What needs consent is the arrangement, not each individual investigation within it. A works council is compulsory where at least 50 people work (Article 2 WOR); in smaller organisations the GDPR requirements still apply in full.

Co musi zawierać zgodna z prawem polityka monitorowania?

A clear, written explanation of what is monitored, why and how, given to you before any monitoring starts. A general clause that “the employer may monitor communications” is not enough.

• the purposes of monitoring, described concretely;
• what is processed and by which means, including whether content can be read or only traffic data;
• who may authorise an inspection, who carries it out, and how the four-eyes principle applies;
• how long monitoring data and investigation results are kept;
• whether private use of company systems is allowed, and within what limits;
• employees’ rights, including access to their data and the right to complain to the AP.

An employer that promised keyword searches and then exports a full mailbox breaches its own published rules. Our note on zrozumienie obowiązków pracodawcy i pracownika i nasze szersze spostrzeżenia na temat obowiązków prawnych holenderskich pracodawców explain how these documents interact with the employment relationship.

Jak daleko może posunąć się pracodawca, podejrzewając niewłaściwe postępowanie?

Only as far as the documented suspicion reaches. A written decision at the start records the suspicion, the facts behind it, the purpose and why lighter means are not enough; widening the search because the first round found nothing is a fishing expedition.

Covert monitoring is only defensible where informing you would frustrate the investigation, for example because evidence would be destroyed, and must be temporary, narrow and disclosed afterwards. You have the right to be heard on the findings before conclusions are drawn.

Unlawfully obtained email evidence is usually still admitted in Dutch civil proceedings, because the interest of establishing the truth generally prevails. But the breach is not costless: it supports a claim for damages, a complaint to the AP, and a claim for fair compensation (sprawiedliwe odszkodowanie) in a dismissal case. In a summary dismissal (ontslag op staande voet) the employer must show an urgent cause under Article 7:678 BW and act without delay, which an investigation dragging on for months undermines. Our guide on jak poradzić sobie z prawnym zwolnieniem pracownika sets out that sequence.

Does the same apply to logging, chat, remote work and former employees?

Yes. Internet logs, VPN records, chat platforms such as Teams or Slack, access passes, mobile device management and productivity dashboards all need a specified purpose, necessity, proportionality, transparency and, where applicable, works council consent.

Continuous tools such as keystroke logging, interval screenshots and a webcam requirement for the whole working day are extremely difficult to justify; a Dutch court has held that requiring an employee to keep a camera on all day was an unacceptable intrusion into private life. Working from home raises the threshold, because the home is the core of the private sphere under Article 8 ECHR.

After you leave, your employer may not keep reading your mailbox. The account should be deactivated promptly, with an automatic reply naming a colleague, any forwarding limited to an announced period, and personal messages you flag handed over or deleted. You keep your right of access and can ask for erasure of data no longer needed (Article 17 GDPR).

Co powinieneś sprawdzić jako pracownik?

If you think your employer read your email unlawfully, start with a written access request and keep a factual record. Act quickly if a dismissal is involved.

• Whether a written monitoring policy existed and was given to you before the monitoring.
• Whether the works council consented to the arrangement.
• Which data your employer processed, via an access request under Article 15 GDPR, which must be answered within one month.
• Whether private messages or medical data were read.
• Whether you were heard before conclusions were drawn.
• The deadlines if a dismissal follows, such as two months to challenge a summary dismissal.

Na co powinieneś zwrócić uwagę jako pracodawca?

Document your reasoning before you open a mailbox. An employer that cannot reconstruct its investigation is in a weak position before the AP or a court.

• A recorded legitimate interest and balancing test under Article 6(1)(f) GDPR.
• A written, communicated monitoring policy and, where required, a DPIA.
• Prior works council consent under Article 27(1)(k) and (l) WOR.
• A search limited in people, terms and time, run by an independent person and logged.
• A procedure for private messages and special categories of data found during a search.
• Retention and deletion of investigation data once the matter is closed.

What can we do for you with email monitoring at work?

Nasza prawnicy pracy advise employees and employers on monitoring, privacy and the dismissal disputes that follow.

• We draft your access request under Article 15 GDPR and assess the employer’s answer.
• We assess whether an investigation behind a warning, suspension or dismissal was lawful.
• We claim damages or fair compensation, or defend against such a claim, before the subdistrict court.
• We draft a complaint to the Autoriteit Persoonsgegevens.
• For employers, we draft the monitoring policy and the request for works council consent.
• We set up the investigation protocol: scope, search terms, independent investigator and logging.

Podsumowanie

• Your employer may read your work email only for a concrete, recorded business interest, and only as far as that interest reaches (Article 6(1)(f) GDPR).
• Przeszukiwanie musi być konieczne i proporcjonalne: metadane przed treścią, ograniczone pod względem osób, terminów wyszukiwania i czasu, przeprowadzane niezależnie i rejestrowane.
• You must know the monitoring policy in advance, and where there is a works council, it must have consented to the arrangement (Article 27 WOR).
• Wiadomo, że prywatne wiadomości i szczególne kategorie danych nie są uwzględniane w pliku, nawet podczas zgodnego z prawem przeszukania.
• If you suspect the monitoring went too far, start with an access request under Article 15 GDPR and act quickly if a dismissal is involved.

PYTANIA I ODPOWIEDZI