Can my employer “spy on me” through the company domain account?

In Italy considerable debate and controversy has been aroused by employees’ privacy, use of a company domain account for personal reasons by an employee, and safeguards adopted to prevent “spying”.

The Guarantor of Privacy (Protection Commissioner) has clarified that public and private employers cannot control their employees’ email and navigation of the Internet, except in some specific cases. Article 15 of the Italian Constitution declares that “The freedom and confidentiality of correspondence and all forms of communication are inviolable.” Electronic mail is now included among the forms of correspondence safeguarded by this article.

The issue of overseeing employees’ emails, company domain account and, in general, use of the Internet is a hot topic. In the light of the latest points made by the Commissioner, the employer must provide employees with clear, detailed instructions about internal policies, in complete conformity with the norms on Employment Law, in regard to the use of the company email account, and indications about any controls that might be operated on each employee’s account. This must be done through information systems such as setting up true “individualized” communication systems, ad hoc or general communications, specifying company policy.

While it is true that the account is provided by the company and linked to the company activities, it is also true that the account is personal and solely identifies that employee. For this reason, limits are imposed on the employer to avoid any attempt to adopt a true “distance control of the employee’s activities” that would also violate art. 4 of the Worker’s Statute.

With the recent provision 53/2018 the Commissioner clarified that the employer cannot conserve for the entire duration of the employment term, and even beyond, an employee’s correspondence using company email accounts.

The Commissioner also underlined that at the moment of cessation of the employment, all references to the email account of the ex-employee must be removed and the employer cannot continue to maintain the account, even temporarily, because this would not be in keeping with the “principles of lawfulness, necessity and proportionality of operation”. Therefore, the accounts of former employees must be deactivated in order to guarantee the necessary safeguards also in regard to third parties.

The employer’s discretional right to verify the correct fulfillment of employees’ work tasks and correct use of work tools must, in any case, safeguard the freedom and dignity of the worker.

If you wish to contact one of our lawyers, who is expert on Labour Law, please fill out the form below.