We use cookies to customise content for your subscription and for analytics.
If you continue to browse the International Law Office website, we will assume you are happy to receive all of our cookies. For further information please read our Cookie Policy.

New Legislation on Employers' Access to Employee Emails - International Law Office

International Law Office

Employment & Benefits - Norway

New Legislation on Employers' Access to Employee Emails

April 22 2009

Employers' Rights
Gaining Access
Termination of Employment


On March 1 2009 new regulations on employers' access to employee emails came into force. Such access was previously regulated by general legal provisions in the Personal Data Act. The new regulations are part of the Regulations on the Processing of Personal Data, which are permitted by the Personal Data Act, and provide more detail than previous legislation. However, the regulations comply to a certain extent with what was previously considered applicable under non-statutory law and the practice of the Data Inspectorate.

The regulations apply to, among other things, the accessing of employee emails. The scope of the regulations includes employer access to:

  • work-related emails;
  • employees' personal areas on a work computer network; and
  • other electronic equipment.

The condition for such access is that the employer owns the equipment and the employee has received the equipment or gained access to it for work purposes.

The regulations do not apply to accessing equipment which the employee owns, even if this is partly used in relation to work at the undertaking. As a main rule, the employer cannot legally access such privately owned equipment.

Further, the regulations do not apply when accessing information stored in common areas or in email inboxes which are communal within the undertaking. The employer has access to such information without having to meet any particular terms.

Employers' Rights

The conditions for employers' rights to access, search and read employee emails are set out in Section 9.2 of the regulations. The provision states several grounds for the right to access; it is sufficient to meet only one of these conditions. The provision does not differentiate between content that is to be considered private and enterprise-related.

Access must always be based on justifiable grounds. If the information in question may be provided without accessing an employee's emails, there are no justifiable grounds for access. There is a difference between access in specific cases where the conditions are complied with and continuous surveillance of employees' email correspondence. Such continuous surveillance is not allowed.

Access may be permitted in the following situations:

  • It is necessary to ensure the everyday management of the business. This will typically apply when the employee is absent and there is reason to believe that there are enterprise-related emails that the employer needs with regard to the management of the business. The timeframe will be relevant in such cases and therefore access may be justified even when the employee's absence is brief.
  • It is necessary to ensure other justifiable interests of the business (ie, what is generally considered to be legitimate considerations of a business). For instance, access may be substantiated by the need to ensure the reputation of the enterprise.
  • There is justified suspicion that an employee has used email in a way that represents a gross violation of his or her employment obligations, such as the use of email to commit legal offences (eg, downloading or forwarding child pornography or illegal file sharing).
  • There is justified suspicion that the employee has used email in a way that justifies dismissal or summary dismissal. In the notes to the regulation, stated examples of this are a suspicion of email being used to harass other employees and email being used to send spam or messages which have a potentially harmful effect.

The employer and employee may not agree that the employer will have the right to access the employee's emails in situations other than those set out in Section 9.2, if such an agreement is disadvantageous to the employee. That which is considered disadvantageous to the employee depends on an assessment. However, an agreement that strengthens the employer's right to access will in most cases be disadvantageous to the employee. Whether the employee is prevented from giving his or her employer the right to access (eg, when unexpected illness occurs) is not specifically regulated. However, this will most likely be accepted.

Gaining Access

Where possible, the employee must be notified and have the opportunity to give a statement prior to the accessing of his or her emails. The notice must state the conditions regulating access that have been complied with and the employee's rights according to Section 9.2 of the regulations.

Where possible, the employee must have the opportunity to be present when the employer accesses his or her emails. The employee has the right to be assisted by an employee representative or other representative. However, the employee may waive these rights.

If the employer accesses the emails without giving notice (eg, if the timeframe does not allow this or it is not possible to reach the employee), the employee must be notified afterwards. Such written notice must state:

  • how the conditions regulating access were considered to have been complied with;
  • the employee's rights according to Section 9.2 of the regulations;
  • the kinds of procedure used to access the emails;
  • which emails or other documents were opened; and
  • the result of the review.

Termination of Employment

Where the employment is terminated, the email inbox should be terminated within a reasonable timeframe according to Section 9.4 of the regulations. However, the employer may demand that the employee organize and file his or her enterprise-related emails before the inbox is deleted. Access to the emails before deletion is limited by the regulations as described above.

For further information on this topic please contact Ingeborg Moen Borgerud or Mari Myhre Marthinsen at Arntzen de Besche Advokatfirma AS by telephone (+47 23 89 40 00) or by fax (+47 23 89 40 01) or by email (ingeborg.borgerud@arntzendebesche.no or mari.marthinsen@arntzendebesche.no).

Comment or question for author

ILO provides online commentaries as specialist Legal Newsletters. Written in collaboration with over 500 of the world's leading experts and covering more than 100 jurisdictions, it delivers individually requested information via email to an influential global audience of law firm partners and international corporate counsel. Please click here to register for the service.

The materials contained on this website are for general information purposes only and are subject to the disclaimer.

ILO is a premium online legal update service for major companies and law firms worldwide. In-house corporate counsel and other users of legal services, as well as law firm partners, qualify for a free subscription. Register at www.iloinfo.com.