The increase of mobile devices in the workforce has led to some interesting privacy questions. If an employee is allowed to use a work laptop, iPad, smartphone etc also for private purposes, is the employer entitled to monitor such use or even intercept, read or copy private information? And if so, under which circumstances?
Up until recently, German Employment Courts have consistently ruled in favour of the employee. The employer’s access and control of an employee’s work mobile device was deemed to be prohibited and the privacy of the employee considered paramount. This now seems to have changed with a couple of recent decisions by lower Employment Courts which applied a more balanced approach between the legitimate business interests of the employer and the privacy interests of the employee. In one case, the Court explicitly confirmed the employer’s right to access the employee’s computer files during a fraud investigation, which ultimately proved that the employee had sold employer’s property on Ebay.
New Zealand case law is not that clear, but it is safe to say that without any clear privacy policies around private information on work devices, accessing private information by the employer will more likely than not be illegal and in breach of the Privacy Act. In a recent case the Office of the Privacy Commissioner held that an employer using key-stroke software to get access to an employee’s private email account was in breach of Privacy Principle 1, 3 and 4.
More importantly, though, in the case the employer’s policies set out that activities on work computers would and could be monitored and accessed. However, the policy did not explain that this might include information from and for private email. The OPC left it open, though, whether exceptional circumstances could justifty accessing an employee’s private email even in the absence of a clear policy.
Still, even if an employer has good reason to believe that exceptional circumstance exist, I would advise against accessing private information such as private email, bank accounts or credit card transactions. If suspicions have reached such a level that it is considered necessary to check out that kind of information, the matter is probably better dealt with by suspending the employee and getting the police involved. The last thing the employer wants in such case is a botched process, rendering all the obtained evidence invalid and making a sucessful reinstatement claim likely.