The Company Laptop: A Tool That the Employer Cannot Access?

2 December, 2024
–
Privacitat
–
Lucas Charnet


In the workplace, digital tools provided by employers—such as laptops, mobile phones, or tablets—are essential for carrying out professional tasks. However, these tools raise a critical question: to what extent can the employer monitor their use without violating the employee’s right to privacy?

In this article, we analyze the legal framework and limitations governing an employer’s access to company-provided devices, examining how the employee’s expectation of privacy is managed, the principles of proportionality and legitimacy in monitoring, and the responsibilities both parties assume in this context.

The Employee’s Expectation of Privacy: Is It Legitimate?

When a company provides digital tools, employees may develop a false expectation of privacy regarding their use. However, the legal reality is different: as these devices are company property, the employer has the right to monitor their use, provided certain conditions are met.

Article 20 bis of the Spanish Workers’ Statute, which regulates digital rights in the workplace, states that employers must ensure that monitoring measures respect the dignity of employees and their fundamental rights, including the right to privacy and the confidentiality of communications. This means that employees can expect a limited degree of privacy when using these tools, contingent on prior information provided by the employer.

If the employee has not been informed that the device is subject to monitoring, their expectation of privacy may be considered reasonable. Therefore, clear and prior communication from the employer is an indispensable requirement to exclude such an expectation.

The Employer’s Right to Monitor: How and When Can It Be Exercised?

As the owner of the digital devices, the employer has the right to monitor their use, but this right is not absolute. Monitoring must adhere to the following principles:

1. Proportionality: Monitoring must be appropriate to the objectives pursued. For instance, it is not legitimate to continuously monitor a device or access all stored information without justification.
2. Suitability: Monitoring must be linked to legitimate objectives, such as preventing misuse of resources, protecting company confidential information, or ensuring compliance with work obligations.
3. Necessity: Monitoring measures should not be implemented if less intrusive alternatives are available.

The jurisprudence of the European Court of Human Rights (ECHR) has highlighted in cases such as Barbulescu v. Romania that monitoring measures must balance the employer’s interests with the employee’s fundamental rights. This includes ensuring that monitoring actions are transparent and justified.

The Duty to Inform the Employee in Advance

For monitoring of digital tools to be lawful, the employer must clearly and proactively inform the employee about the conditions of use and monitoring of the devices. This obligation is established in Article 20 bis of the Spanish Workers’ Statute, as well as in data protection regulations (GDPR and the Spanish LOPDGDD).

The information must include:

That the device is company property and must be used exclusively for professional purposes.

That it is subject to monitoring measures to ensure appropriate use.

The scope of monitoring (e.g., whether email, internet access, or software downloads are tracked).

Applicable internal policies, such as codes of conduct or regulations governing the use of digital tools.

Failure to provide this information could invalidate any monitoring actions, as it would constitute a violation of the employee’s right to privacy.

The Line Between Employer Monitoring and Employee Privacy

While the employer has the right to monitor, it must always respect the employee’s fundamental rights, such as the right to privacy and the confidentiality of communications. This boundary becomes especially relevant when employees use company tools for personal purposes—a practice that, while not recommended, can happen.

Article 18 of the Spanish Workers’ Statute protects the inviolability of the employee’s person and personal belongings, including data stored on company devices if it contains private information. This means that:

The employer cannot access personal communications or files stored on the device without the employee’s explicit consent.

If personal use of the device is detected, monitoring must focus solely on aspects related to professional use.

It is therefore crucial for employers to establish clear policies that exclude employees’ expectation of privacy regarding these devices. This can be achieved by specifying in internal regulations that the devices are strictly for professional use and that any personal use will be the employee’s responsibility.

The Employee’s Responsibility Toward the Employer

Employees also bear significant responsibility when using the digital tools provided to them. In addition to complying with internal regulations, they must ensure that they:

Avoid activities that could compromise the device’s security or the company’s information, such as installing unauthorized software.

Refrain from personal use, which could not only expose private data but also create legal risks for the company.

Failure to fulfill these responsibilities could result in disciplinary measures, ranging from warnings to dismissal, depending on the severity of the breach.

Practical Advice for Employers and Employees

For Employers:

1. Establish clear policies: Draft a digital conduct code detailing permissible use of tools and applicable monitoring measures.
2. Communicate transparently: Ensure all employees receive and sign a notification outlining the conditions of use.
3. Implement proportionate monitoring measures: Limit monitoring to legitimate purposes and avoid intrusive actions.

For Employees:

1. Respect internal policies: Use the tools exclusively for work-related purposes and avoid personal activities.
2. Seek clarification in case of doubt: If it is unclear how devices are monitored, request clarification from the employer.
3. Avoid storing personal data: This reduces risks in case the device is monitored.

Conclusion

The company’s access to the digital tools it provides to its employees is a legitimate right but is subject to clear limitations to ensure respect for the employee’s privacy. The key to managing this relationship is transparency: providing clear and prior information about the conditions of use and monitoring.

At MES Advocats, we offer specialized advice to help companies and employees understand their rights and responsibilities in this area. If you need assistance drafting internal policies, notifications, or resolving conflicts related to workplace privacy, do not hesitate to contact us through this link. We are here to help you find balanced and compliant solutions.

###


drets digitalseines digitalsPrivacitatProtección de datos

---