Can the employer fully access employee data according to EU law?

Question

The computers at the company I work for recently show the message below during log on.

This computer system is the property of Company. It is for authorised use only. All activities conducted on and information accessed, processed, stored or sent using this system may be examined. By using this system, all users aknowledge notice of, and agree to comply with, the Company IT Acceptable Use standard. Unauthorised or improver use of this system may result in disciplinary action. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. Log off immediately if you do not agree to the condictions stated in this warning.

Is the statement legal according to European regulations?

Besides, it is my work computer, it is not that I have an option not to log on.

---

Related question for Norway

Answer 1

The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities).

According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be:

• for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"),
• proportionate ("it was the only possible way available"), and
• communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy).

In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).

Answer 2

No. That is not presented correctly. Generally, the employer must store and process the data that it actually needs for something in the employer-employee relationship. They are not generally allowed to store private information.

That content must be presented to all uses in writing and they must sign for taking notice of it. Also, they must be offered the option not to consent.

To make this 100% legal, the employer must formulate something like:

• Employees are not allowed to use the computers for private purposes.
• Limited exception to the above use: if you want to use it in limited manner for private matter (like checking private e-mail, etc) then you must agree to being monitored as specified (like it's specified in your text) and sign a consent.

Then the user must sign the consent which should contain among others:

"I am giving you this consent for the Limited Exception under IT&C Policy, which is for the personal use of the internet to the extent of access to the internet websites and internet search subject to the IT&C Policy and giving this consent for [CompanyNameHere] to process, record and store the data relating to such personal use under Limited Exception." "I hereby give my consent:" followed by Name, Date, Signature.

Answer 3

As an employee everything you do on a company property, including laptop can be observed and monitored.

There is a thin line here although, because the company can get caught up in monitoring too much, like seeing your personal passwords, PII or some confidential data like your e-medical records. If the company gets caught storing this kind of information they will be in deep trouble legally, so they usually try to avoid this by obfuscating in logs sensitive data like passwords, PII, Health as much as possible.

Overall their statement is correct and you should try to avoid using your work laptop for personal stuff and the other way around. We live in 21st century, just use your smartphone to look at your personal stuff.