MD008Access to the content of communications

The opening and reading of the content of a communication, for a stated purpose and on a named person. It is an event, done at a moment and answerable for itself, and it is separate from holding a copy of the store the message sits in.

Pillar: MD | Monitoring and detection
Sources cited: 8
Added: 30 AUGUST 2026
Updated: 1 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD008/CoEMandatory	Council of Europe	Bărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.	Correspondence keeps its protection even where private use of a work device breaks the rules, so the six criteria apply to opening it and not only to logging it.
MD008/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Opening is done with the system administrator and a second person present, and the report states which message was opened, why, when, by whom, and to whom its content was given.
MD008/ITMandatory	Italy	Sentenza n. 24204/2025Corte di Cassazione, Labour Section · read 11 Aug 2026	That personal correspondence keeps its protection on company systems, and that what is taken from it cannot be relied on in proceedings.	What is taken from personal correspondence on a company system cannot be relied on afterwards, so opening it forecloses the use of what it yields.
MD008/NOMandatory	Norway	Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around.	Where it is possible the worker is told first, given the chance to comment, and allowed to be present with a representative of their choosing. Where it was not possible, they are told in writing once the access is done.
MD008/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Content may be looked at only to check that work obligations are being met and that the device is sound, and no further.
MD008/GBMandatory	United Kingdom	Investigatory Powers Act 2016, sections 3 and 46Parliament of the United Kingdom · read 30 Aug 2026Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	That intercepting a communication in transmission without lawful authority is a criminal offence, and that a person with a right to control a private system is outside it.	Intercepting a communication in the course of its transmission without lawful authority is a criminal offence. A person with a right to control the operation or use of a private system, or who has that person’s express or implied consent, is outside the offence, so an employer reading on its own system does not commit it by that route. What the offence does is put the question of authority before the question of proportionality. As to that authority, opening the content in transmission is what these regulations authorize, and they authorize it only for a purpose in the closed list and only where the interception is effected solely to monitor or record communications relevant to the activities carried on.
Recommended	European Unionwhere written	Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	That consent is rarely a valid ground in employment, and how legitimate interests are weighed against privacy across nine scenarios of workplace monitoring.	The balance has to be struck before the content is opened, and it is struck differently for technology used outside the workplace than inside it.