By: Adv. Kobie Refaeli
On 8.2.2011, a comprehensive and instructive ruling* was rendered by the Israeli National Labor Court regarding employees’ usage of workplace computers, and their right to privacy in email correspondence. This ruling regulates the rights and obligations of both employers and employees regarding the use of workplace computers and email, and balances an employer’s right to manage his business with an employee’s right to privacy.
The Court recognizes an employer’s ownership rights in his workplace and his right to conduct his business as he sees fit – a right referred to as the “Managerial Prerogative”. This right also includes the right to determine the terms of use of the workplace computers, and the means to secure the computer network, to ensure that employees comply with the law and with company policy.
On the other hand, the Court acknowledges an employee’s right to privacy in the workplace and, in particular, with respect to the use of company computers and e-mail. The Court states that the employer’s ownership of workplace computers does not allow him to infringe upon an employee’s right of privacy other than in exceptional cases and subject to the law.
The Conditions for the Employer’s Monitoring
The Court requires the employer to set a clear policy regulating the usage of workplace computers. This policy should detail the following: the professional and personal usage of computers by employees, the ways in which the employer intends to monitor, and the technology he will use to perform the monitoring. In addition, the employer should detail the type of monitoring that may be performed on employee emails, and the circumstances that would justify monitoring and accessing an employee’s personal content.
The employer should integrate this policy within employment agreements and obtain the consent of each employee. Should the employer fail to do so, an employee will have heightened expectations for privacy in his workplace computer and email. The Court stated that such a heightened expectation of privacy would make the employer’s monitoring and accessing an employee’s emails forbidden.
In addition, the Court states a number of preconditions which must exist in order to monitor and access an employee’s email:
- The principle of legitimacy – Any monitoring should be performed for legitimate business purposes. Monitoring and access of personal emails may only be performed in extreme cases such as when not doing so could result in severe harm to the employer’s business or when an employee is suspected of criminal or other offensive conduct.
- The principle of proportionality – The employer must only monitor in a manner that is proportionate to the supposed risk that the employee presents; the employer should consider alternative, less invasive means of monitoring such as blocking certain uses of the computer instead of monitoring.
- The principle of intended purpose – The employer may only use the information gathered for the intended purpose for which it was collected.
- The principle of transparency – The employer must: provide details of the implementation of the workplace monitoring policy, allow the employee access to any information that is gathered regarding the employee’s computer usage, the duration for which this information will be kept, and ensure that this information remains confidential.
The Requirement of an Employee’s Consent–
In light of the imbalance of power in the employer-employee relationship, the Court requires several conditions that must be met in order to request an employee’s consent to access his workplace email: (1) an extreme case that justifies such an invasion; (2) the existence of a transparent monitoring policy in the workplace; and (3) an exhaustion of all less invasive alternatives. Only after these conditions are met, may the employer request for the employee’s consent. Any consent provided without the fulfillment of the above conditions will not be deemed proper consent.
The Court emphasizes that an employee must consent to both the monitoring policy in general, and for each and every access of the employee’s emails. The employee’s consent must be explicit (and preferably in writing), provided voluntarily and knowingly. This consent must also be provided in order for the employer to monitor email subject lines and details (without entering the content of each email), as this might reveal personal information regarding the employee and his habits.
Should all preliminary conditions be met and the employee refuses to provide consent to monitor or access his emails, then the employer can seek an appropriate court order.
The Rules that Apply to Different Email Accounts
The Court distinguishes between several types of email accounts and sets the rules that apply to each of them:
- Workplace Professional Account – This email account is designated for work purposes only. The Court allows the employer to prohibit any personal use of this email account. The employer may monitor the use of this email account, including accessing professional content, provided that the employer provides the employees with prior notification of his intention to do so. In such cases where an employee makes personal use of this email account, contrary to the employer’s policy, the employer is nevertheless prohibited from accessing the employee’s personal content without receiving explicit consent from the employee.
- Workplace Dual Purpose or Personal Accounts – These email accounts are provided by the employer and are either designated for dual professional/personal use or for personal use only. For an employer to monitor these accounts, the employee must provide his consent to the workplace monitoring policy. With regard to the dual purpose account, the employer must meet all of the above conditions and also receive the employee’s consent for monitoring and accessing personal content, whereas the employer does not require such consent for the professional content. With regard to the personal account, the employer must receive explicit consent for each case in which he intends to monitor or access this account.
- Private Personal Web-based Account – This account is owned solely by the employee. The employer is not allowed to monitor or access this account, even in such cases when the employee accesses the account on the employer’s computer. Monitoring this account is considered a serious violation of the employee’s privacy and may be done only with a court order. Even if the employee provides consent, courts will not acknowledge it unless the employer can prove that the consent was not coerced.
Conclusion – The Court’s ruling is the first comprehensive regulation of an employee’s privacy rights in the workplace and his right to make personal use of the employer’s computers. The Court instructs employers to publish a clear policy regulating the usage of workplace computers and to follow strict rules with regard to monitoring and accessing an employee’s email.
It is worth remembering that infringement of employee privacy is a civil tort under Israeli Law. In the case of breach of such privacy rights, the law allows for compensation in the amount of 50,000 NIS without proof of damages.
Adv. Kobie Refaeli
*Labor Appeal no. 90/08 Tali Isakov Inbar v. The State of Israel, the Commissioner for Women Labor Law (February 8, 2011)