An employer in France may use or check an employee's professional email account during a prolonged absence or after they leave, in order to keep business activity running, according to the Commission nationale de l'informatique et des libertés (CNIL), the country's data protection authority.
The employer must follow certain conditions, which should be set out in the company's IT charter and made known to staff in advance, the CNIL said. Employees must be informed of how their mailbox may be consulted and used while they are absent, a step intended to prevent later disputes.
Courts generally treat any message sent or received from a computer provided by the employer as professional in nature by default, meaning the employer can consult it, the CNIL noted. Even so, employees retain a right to privacy at work, and an employer cannot freely read personal emails even if personal use of company tools was banned.
How to protect personal messages
To be protected, personal messages in a work inbox must be labeled "personnel" or "privé" in the subject line, or stored in a folder with that name, the CNIL said. Employers must then respect the confidentiality of correspondence and not read them.
That protection ends if a judicial investigation is underway, such as an accusation of theft of company secrets, or if the employer has obtained a judge's authorization to access the messages, including through a court bailiff. The CNIL also said employers cannot be automatically copied on all messages employees write or receive, calling that excessive.
When an employee leaves
If an employee is on holiday and the employer needs information on their computer that cannot be obtained another way, the employer may request the employee's login details and passwords as a last resort, the CNIL said.
When an employee leaves permanently, the IT charter must set out how the account will be closed. The employer must notify the employee of the closure date so they can empty their mailbox, after which the employer must delete the email address. Employees who believe their employer is breaching GDPR rules can file a complaint with the CNIL or contact labor inspection services.
