Constitutional Court rules on employers' review of employees' corporate emails

Constitutional Court's recent decision
Facts
Applicant's claims
Constitutional Court's assessment
Comment

Whether employers can review employees' corporate email accounts and rely on any findings collected during such an inspection in a potential termination is a controversial issue in terms of personal data protection and privacy. The Constitutional Court has rendered two recent decisions on the right to privacy and the privacy of communication with regard to corporate email accounts. Both decisions elaborate in particular on employees' information rights.

Constitutional Court's recent decision

On 17 October 2020 the Constitutional Court ruled in an application filed by an employee of a law firm that the applicant's rights to protection of personal data and privacy of communication had been violated on the grounds that the employer had:

• inspected the content of the applicant's corporate email account without his knowledge; and
• terminated his employment contract based on the outcome of the inspection.(1)

Facts

Several employees in the applicant's team had submitted complaints to office management claiming that:

• the applicant was rude to other team members;
• the team manager had lost their objectivity towards the applicant; and
• the working environment was no longer peaceful.

Following the complaints, the employer started to review the applicant's corporate emails. During the inspection, it was detected that some emails in the applicant's account had been deleted. The employer examined the team manager's email account. Based on the correspondence obtained during this examination, the applicant's employment contract was terminated for just cause.

Subsequently, the applicant filed a reinstatement lawsuit. The first-instance court concluded that the applicant had insulted other employees in his corporate emails, which were known to be accessible by the employer. In this context, the court decided that:

• the employee's acts towards other employees constituted a just cause for termination; and
• the termination was appropriate.

The applicant appealed the decision arguing that relying on the emails in question as grounds for termination violated his right to privacy and freedom of communication and yet the first-instance court allowed them to be used as evidence. Having reviewed the case, the Ninth Civil Chamber of the Court of Cassation upheld the decision.

Applicant's claims

In the application made before the Constitutional Court, the applicant claimed that his right to protection of personal data and freedom of communication had been violated because:

• the employer had examined personal correspondence in his corporate email account without his consent;
• there were no written or verbal rules at the workplace indicating that employees' emails could be reviewed;
• the employer conducted the inspection to look for a reason to terminate the applicant's employment contract;
• the employer reviewed thousands of pieces of correspondence in the team manager's corporate email account. Among these, the employer relied on personal emails that had been written in the belief that the employer would not read them, which had been unknown to the employer until the inspection;
• in the reinstatement lawsuit, the correspondence in question was admitted as evidence; and
• the first-instance court had failed to provide reasoning to meet his objections and evidence.

Constitutional Court's assessment

The Constitutional Court determined that the employer had not explicitly informed its employees regarding the fact that communication in corporate email accounts could be monitored and reviewed. Therefore, the court stated that, although the applicant's employment contract had been terminated based on the inspection of his emails, the employer had failed to prove that it had informed employees as per privacy law rules regarding:

• the legal grounds for processing personal data;
• the purpose of processing the data;
• the scope of the data to be processed;
• the data retention period;
• data subjects' rights;
• the results of the data processing; and
• the potential beneficiaries of the data.

The Constitutional Court further stated that the employer had failed to explain whether there had been a necessity to access the applicant's emails. The decision underlined that the employer could not explain why it had been necessary to examine the applicant's emails while there were other tools which served the same purpose, such as:

• analysing the parties' complaints and defences;
• hearing witnesses;
• examining workplace records; and
• inspecting the processes and outcomes of projects.

The Constitutional Court's assessment of the employer's decision to review the applicant's emails indicates that the employer's method of choice should also be discussed in terms of the principle of proportionality.

On the other hand, the court ruled that:

• the employer had examined correspondence with third parties in addition to correspondence between the team manager and the applicant; and
• the inspection had not been limited to the allegations in question.

Therefore, the employer had not confined itself to examining the emails or accessed them with uncertain scope.

Accordingly, the Constitutional Court ruled that the employer had violated the right to the protection of personal data and freedom of communication. In this respect, the court sent the file to the first-instance court for retrial, decided on moral compensation in favour of the applicant and rejected other compensation-related claims.

Comment

In a previous decision of 24 March 2016,(2) the Constitutional Court found no violation of the right to privacy and privacy of communication, on the grounds that the employer had examined the employees' corporate email accounts and had relied on the obtained correspondence as evidence in the reinstatement lawsuit by making prior notifications and warnings to the employees as necessary.

In a 5 October 2017 decision(3) regarding an incident where an employer had examined correspondence on an instant messaging account created to carry out job-related communications, the Grand Chamber of the European Court of Human Rights underlined that whether the employee had been priorly informed of the examination in question should be evaluated. In light of the above, the court ruled that the right to privacy under Article 8 of the European Convention of Human Rights had been violated.

On the other hand, Court of Cassation precedents(4) indicate that the Supreme Court takes the view that employers can always monitor their own computers and email addresses and any emails sent thereto.

In the recent decision, the Constitutional Court stated that employers which employ a large number of employees and provide legal services under a corporate structure can monitor communications to ensure the efficient execution of work. In this regard, granting employer access to corporate email accounts to check to their content and workflow has been deemed to have a legitimate interest in terms of workplace management and the court deemed such method convenient to achieve the intended purpose. However, the court lodged a violation decision on the grounds that the employees had not been priorly informed and provided with a privacy notice in terms of data processing activities that may be undertaken by the employer and the inspection had not been limited to the scope of the allegations; thus, the inspection's scope was found to have been disproportionate.

The decision implies that employers should act in accordance with the terms and conditions of information in order to inspect their employees' emails and rely on the findings in a potential termination. The general principles section of the above decision stressed that employers should adopt an appropriate method to tell employees about the processing of personal data and the inspection of their communications. In addition, the decision indicates that, in line with the information obligation to be fulfilled by data controllers towards data subjects as per the Law on the Protection of Personal Data, the Constitutional Court will seek the following points in privacy notices to be served on employees in order for the employer to review employees' email correspondences and rely on the findings obtained in a potential termination:

• the legal grounds and aims of processing personal data and inspection of communications;
• the scope of data processing and inspection;
• the data retention period;
• the data subjects' rights;
• the results of the processing and monitoring of data;
• the potential beneficiaries of the data to be collected; and
• the limitations set out by employers regarding the use of communication tools.

The principles set out by the Constitutional Court in its 17 October 2020 decision must be strictly taken into account by all businesses, as inspecting corporate email accounts by breaching these principles and using them against employees may result in serious administrative penalties as per the Law on the Protection of Personal Data, along with criminal liability in terms of the violation of privacy of communication under Article 132 or violation of privacy under Article 134 of the Criminal Code.

For further information on this topic please contact Pelin Baysal, Beril Yayla Sapan or Kardelen Özden at Gün & Partners by telephone (+90 212 354 00 00) or email (pelin.baysal@gun.av.tr, beril.yayla@gun.av.tr or kardelen.ozden@gun.av.tr). The Gün & Partners website can be accessed at www.gun.av.tr.

Endnotes

(1) Application 2016/13010, dated 14 September 2020, published in the Official Gazette (31274).

(2) Application 2013/4825.

(3) Bărbulescu v Romania, Application 61496/08, 5 September 2017.

(4) Decision of the Ninth Civil Chamber of the Court of Cassation, dated 13 December 2010 (2009/447 E, 2010/37516 K). See also in parallel, the decision of the 22nd Civil Chamber of the Court of Cassation dated 3 May 2016 (E 2016/6321, K 2016/13143).