The employer is entitled to retrieve messages received in or sent from an employee’s personal work e-mail only if the specific requirements listed in the Act on Data Protection in Working Life are fulfilled.
Firstly, the employee must be given the opportunity to prepare for his/her absence with the following measures:
- the employee may set an autoresponse for the duration of his/her absence: e-mail senders will receive a notification about the length of the employee’s absence and contact details of the person managing the absent employee’s duties,
- the employee may redirect e-mails to another recipient or to himself/herself at another e-mail address, or
- another person may be authorised to receive e-mails in the employee’s absence and evaluate whether they contain anything that the employer needs to know.
If the employer offers the employee the means described above but the employee does not use them for whatever reason, the employer is entitled to investigate whether the absent employee’s e-mail messages contain information that the employer needs to know, such as information essential for completing work-related negotiations or for customer service.
Personal messages must not be opened
The employer has the right to retrieve a message from an employee’s personal work e-mail if and only if all of the following criteria are fulfilled:
- the employee manages tasks independently on behalf of the employer and the employer does not operate a system with which the matters attended to by the employee and the processing stages involved are recorded or are otherwise ascertained,
- it is evident, on account of the employee’s tasks and matters pending, that messages belonging to the employer have been sent or received,
- the employee is temporarily prevented from performing his/her duties, and messages belonging to the employer cannot be obtained for his use despite the fact that the employer has seen to his obligations regarding message redirecting facilities, and
- the employee’s consent cannot be obtained within a reasonable time and the investigation of the matter cannot be delayed.
It is also required that an unsuccessful attempt has been made to contact the sender or recipient of such a message.
The employer may first only look at the sender or recipient of an e-mail message and the subject line. The employer may not open the message itself unless it is evident that it belongs to the employer.
A written report must be issued of e-mail retrieval
The employer may only retrieve and open e-mail messages with the assistance of the person with the authority of IT system administrator. The content of an opened message must not be used any more widely than is absolutely necessary. All persons participating in such retrieval of messages are bound by confidentiality regarding any information that they may have become privy to in handling another employee’s e-mail.
The absent employee must be given a written report on the retrieval of e-mails, detailing why e-mails have been retrieved, when and by whom.
When an employee’s e-mails are retrieved, the employee must without delay be given a report signed by the persons performing the retrieval and detailing:
- which messages were opened,
- why the messages were opened,
- when the messages were opened,
- who opened the messages, and
- who has been informed of the content of the messages.