Supervisions of corporate email

Since employers have the right (and obligation) to ensure the smooth operation of the company, they may also supervise the manner in which their employees perform their duties. Such supervision specifically includes business correspondence exchanged by the employee using a corporate email account.

This right of the employer results directly from the Polish Labour Code.  Pursuant to Article 223 § 1 of the Labour Code, if necessary in order to ensure work organisation in a way ensuring the full use of working time and the proper use of work tools provided to the employee, the employer may inspect the employee’s corporate email (email monitoring).

At the same time, Article 223 § 2 of the Labour Code introduces an explicit prohibition on breaching the secrecy of correspondence and employee’s other personal rights by establishing limits on the level at which the employer may inspect the employee’s corporate email correspondence.

This means that the employer must formally regulate access to the employee’s corporate email account – the employer must notify the employee in advance of using email monitoring. The minimum notice period that must be observed by the employer before introducing  email monitoring is 14 days (a newly retained employee must be informed, in writing, about the purpose, scope and manner of the monitoring before commencing work). The email monitoring policy must be included in the workplace regulations.

The relevant policy provisions included in the workplace regulations must specify the objective of email monitoring, with detailed reasons for an inspection. Additionally, the employer must specify the scope of monitoring, i.e. what data is to be collected. The scope of data must be in line with the monitoring objective. If it is sufficient to collect information on email senders and recipients, the time and date of sending and receiving emails, and on the subject of emails, then the content of the correspondence should not be reviewed. Nevertheless, employees must be notified of the detailed scope of data that is to be collected  using monitoring. The email monitoring policy must also specify the manner of using monitoring, i.e. the manner in which inspections of emails are to be conducted, as well as the rules of using the data collected from the inspection. Specifically, the employer must specify the circumstances and frequency of inspections.

In addition to these obligations concerning the introduction of the email monitoring policy, the employer must also comply with the requirements on employee personal data protection (specifically, the obligation to provide information under Article 13 of the GDPR).