Workplace surveillance
Professional messaging: Can my employer keep my e-mail account after I leave the company?
No, even if the APDP may allow the employer a period of time to make arrangements after the employee's departure in order to ensure the continuity of business.
In accordance with Article 4 of Law No. 1.565 of December 3, 2024, personal data subjected to processing may only be kept in a form that allows for the identification of the data subjects for a period not exceeding what is necessary to achieve the purposes for which they are processed.
Also, the APDP requests that all information related to the administration of an electronic messaging service (identity, management of contacts, electronic identification data) be kept for a maximum of 3 months after the user's definitive departure.
In this regard, the APDP emphasizes that when the user leaves the company permanently, his or her personal email box must be immediately "blocked", meaning it should no longer be able to receive or send emails, except for an automatic message that will be sent to everyone who has emailed the relevant address.
This automatic message is intended to inform the sender of the email that the person no longer works within the entity, and that emails should henceforth be sent to a specific address. This may be implemented for a maximum of 3 months, depending on the functions and level of responsibility of the former employee.
At the end of this maximum three-month period, the email address of the former employee will be deactivated (deleted).
However, the employer must allow the employee to retrieve any private emails that may be in their professional email inbox.
To learn more:
- Factsheet Focus on professional messaging at work
Professional messaging: Can my employer read all my emails?
No, provided that it is possible to distinguish between professional messages, which the employer has the right to read, and personal messages.
Indeed, if professional messaging is an essential tool and often necessary for employees to carry out their work tasks, the employer must also respect the rights and freedoms of those employees.
Thus, the employer must inform employees in advance – for example, in an IT charter – whether a limited and reasonable use of professional messaging for private purposes is tolerated. When this is the case, respecting the secrecy of private correspondence being an inviolable principle, the employer cannot access the content of private messages sent or received by its employees through professional messaging, unless the concerned employees are present and expressly agree, or with the authorization of a judge.
However, for messages to be considered personal, employees should identify them as such, for example:
- by specifying in the subject line of the message keywords like «private», « [PRV] », or even «personal»;
- by including in the subject line of the message a mention that clearly suggests that the said message is private, such as «vacation in Japan»;
- by storing messages in a folder named «personal » or «private».
To learn more:
- Factsheet Focus on professional messaging at work
Cameras in the workplace: Can my employer install a camera above the cash register?
Yes, provided that the cash register is filmed more than the employee.
The APDP considers indeed that, given the intrusive nature of video surveillance systems, the implementation of such systems is only permissible within the framework of the following security imperatives:
- to ensure the safety of individuals;
- to ensure the safety of property;
- to allow for access control;
- to allow for the gathering of evidence in case of an offense.
A store manager can therefore install cameras to prevent theft and assaults. However, he must also ensure that the rights and freedoms of the data subjects are protected.
To this end, the installed video surveillance devices must not be used to monitor the work or working time of his or her employees, nor lead to continuous surveillance.
Consequently, no camera should film employees at their workstation, except under specific circumstances that are duly justified. Thus, if a camera can film the employee handling money, it must necessarily be oriented so as to film the cash register rather than the employee in question.
To learn more:
- Factsheet Installation of cameras in the workplace
- Factsheet Location of CCTV cameras: what is allowed and what is prohibited
Geolocation: Can I ask my employer to deactivate the geolocation system on my company vehicle outside working hours?
Yes: deactivation is even mandatory
The APDP considers that the use of a geolocation system should not result in constant and inappropriate monitoring of the employee.
Therefore, regarding professional vehicles that can be used by employees for private purposes, the employer should not collect information related to an employee's location outside of their working hours. In this respect, it requires that employees must be able to deactivate the geolocation feature of the vehicles at the end of their working hours.
Indeed, considering the intrusive nature of these systems processing geolocation data of vehicles and the information that may be associated with them, the APDP believes that the implementation of such devices is only acceptable within the context of the following functionalities:
- the safety or security of the employee himself or herself or of the goods or vehicles for which he or she is responsible (drivers of delivery vehicles, lone workers, transport of cash and valuables, etc.);
- a better allocation of resources for services to be provided in various locations (emergency interventions, breakdown fleets, etc.);
- the monitoring and invoicing of a transportation service for people or goods or a service directly related to the use of the vehicle (school transportation, roadside cleaning, etc.);
- the monitoring of working time, when this monitoring cannot be done by other means.
To learn more: