Alessandro AleddaInsider RiskInformation Protection

 Contact me

INTRA/MD/MD006Electronic mail and collaboration monitoring

The recording of what passes through the organization’s messaging and collaboration platforms.

Pillar
MD  |  Monitoring and detection
Sources cited
20
Added
30 AUGUST 2026
Updated
5 OCTOBER 2026
ControlJurisdictionSourceWhat it establishesPrerequisite or recommendation
MD006/EUMandatoryEuropean UnionRegulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.A ground under article 6 has to be identified before anything is collected through the recording of the messaging platform, and whatever more specific rule the member state has made under article 88 applies on top of it. Consent is rarely that ground in an employment relationship, since it has to be freely given and the imbalance there makes that doubtful.
MD006/CoEMandatoryCouncil of EuropeBărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.Private life and correspondence extend into the workplace, including where a worker’s private use of a work device breaks the employer’s rules, and a monitoring measure is to be assessed against six criteria, prior notification and the availability of a less intrusive method among them. The case was decided on that monitoring itself: the employer read the content of a worker’s messaging account.
MD006/ATMandatoryAustriaArbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.The works council’s consent is the condition of the recording of the messaging platform having legal effect, and the threshold is whether it touches human dignity.
MD006/FIMandatoryFinlandLaki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.Retrieval of messages belonging to the employer is open only after the employer has arranged the absence alternatives in section 18, and only on the four conditions in section 19, with a signed report of the retrieval given to the employee.
MD006/FRMandatoryFranceCode du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.The committee has to be informed and consulted before the decision to record the platform, and the worker informed that what passes through it is kept.
MD006/DEMandatoryGermanyBetriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.The works council has to agree before introducing the recording of the messaging platform, and again on the manner in which it is used.
MD006/HUMandatoryHungaryNAIH/2019/51/11, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026That storing a former employee’s private correspondence in archived mailboxes breached storage limitation, that searching those archives for documents without proper information and without a basis breached fairness and purpose limitation, that the absence of technical and organizational measures and of information on the use and archiving of employees’ mailboxes breached accountability, and that the fine was 500,000 HUF.The company e-mail account is checked under an internal policy, on the employer’s legitimate interest after a balancing test, in steps: first the address and the subject, then the traffic data that narrow the search, and content only where the private character can be excluded; the employee is present as a rule; the notice states the purposes, who checks, the steps, and the remedies. Searching archived mailboxes for documents without proper information and without a basis breaches fairness and purpose limitation, and the want of measures and information on the use and archiving of mailboxes breaches accountability; the fine was 500,000 HUF.
MD006/ITMandatoryItalyLegge 20 maggio 1970, n. 300, article 4Parliament of Italy · read 11 Aug 2026That an instrument from which remote monitoring may follow is permitted only for stated purposes, and only after a union agreement or an authorization.An agreement with the union representatives, or failing that an authorization from the labor inspectorate, is required before installing the recording of the messaging platform.
MD006/NLMandatoryNetherlandsWet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.The works council has to consent before any arrangement governing the recording of the messaging platform is adopted, amended, or withdrawn.
MD006/NOMandatoryNorwayForskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around.The mailbox provided for the work is reached only where it is necessary for daily operations or another legitimate interest, or on reasonable suspicion of a gross breach of the duties of the employment or of grounds for dismissal. The same holds for what was deleted from it and survives on a backup.
MD006/PLMandatoryPolandKodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026That monitoring of a worker’s official electronic mail is open only where it is indispensable to an organisation of work permitting full use of working time and to the proper use of the work tools provided, that it may not violate the secrecy of correspondence, and that the same provisions, and with them the procedure of article 22(2), reach every other form of monitoring used for those purposes.Monitoring of a worker’s official electronic mail is open to the employer only where it is indispensable to an organisation of work permitting full use of working time and to the proper use of the work tools provided. Those two purposes are the whole list, and neither of them is the protection of information. The monitoring may not violate the secrecy of correspondence or the worker’s other personal rights.
MD006/PTMandatoryPortugalCódigo do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound.The worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, email included; the employer may set rules of use of the means of communication. Control of email is not permanent or systematic; it is pontual, directed to the areas and activities of greater risk, and as a rule random; virus detection does not by itself justify reading received mail; filtering by file type is done with the workers’ knowledge; workers keep personal messages in identified personal folders.
MD006/ROMandatoryRomaniaLegea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.Monitoring by means of electronic communications at the workplace rests on the five conditions of article 5: justified prevailing interest, prior complete and explicit information, consultation of the union or representatives, prior failure of less intrusive means, and retention within 30 days.
MD006/ESMandatorySpainLey Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.Criteria for use, drawn up with the participation of the workers’ representatives, and express prior information to the workers, are required before putting the recording of the messaging platform into operation.
MD006/GBMandatoryUnited KingdomInvestigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026The closed list of purposes for which an employer may intercept communications on its own system, and the four conditions on doing it, of which one is telling everyone who may use the system.Recording what passes through the employer’s own messaging system is interception in the course of transmission. It is authorized on the express consent of the system controller, for a purpose in the closed list, and on four conditions, of which the third is that the system controller has made all reasonable efforts to inform every person who may use the system that communications transmitted by it may be intercepted.