MD008Access to the content of communications

The opening and reading of the content of a communication, for a stated purpose and on a named person. It is an event, done at a moment and answerable for itself, and it is separate from holding a copy of the store the message sits in.

Pillar: MD | Monitoring and detection
Sources cited: 10
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD008/CoEMandatory	Council of Europe	Bărbulescu v. RomaniaEuropean Court of Human Rights, Grand Chamber · read 11 Aug 2026	That private life and correspondence reach into the workplace, and the six criteria against which any monitoring measure is weighed.	Correspondence keeps its protection even where private use of a work device breaks the rules, so the six criteria apply to opening it and not only to logging it.
MD008/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Opening is done with the system administrator and a second person present, and the report states which message was opened, why, when, by whom, and to whom its content was given.
MD008/ITMandatory	Italy	Sentenza n. 24204/2025Corte di Cassazione, Labour Section · read 11 Aug 2026	That personal correspondence keeps its protection on company systems, and that what is taken from it cannot be relied on in proceedings.	What is taken from personal correspondence on a company system cannot be relied on afterwards, so opening it forecloses the use of what it yields.
MD008/NOMandatory	Norway	Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around.	Where it is possible the worker is told first, given the chance to comment, and allowed to be present with a representative of their choosing. Where it was not possible, they are told in writing once the access is done.
MD008/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Content may be looked at only to check that work obligations are being met and that the device is sound, and no further.
MD008/GBMandatory	United Kingdom	Investigatory Powers Act 2016, sections 3 and 46Parliament of the United Kingdom · read 30 Aug 2026Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	That intercepting a communication in transmission without lawful authority is a criminal offence, and that a person with a right to control a private system is outside it.	Intercepting a communication in the course of its transmission without lawful authority is a criminal offence. A person with a right to control the operation or use of a private system, or who has that person’s express or implied consent, is outside the offence, so an employer reading on its own system does not commit it by that route. What the offence does is put the question of authority before the question of proportionality. As to that authority, opening the content in transmission is what these regulations authorize, and they authorize it only for a purpose in the closed list and only where the interception is effected solely to monitor or record communications relevant to the activities carried on.
Recommended	European Unionwhere written	Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	That consent is rarely a valid ground in employment, and how legitimate interests are weighed against privacy across nine scenarios of workplace monitoring.	The balance has to be struck before the content is opened, and it is struck differently for technology used outside the workplace than inside it.
Recommended	Hungarywhere written	A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That consent is a basis for workplace processing only exceptionally, that the employer’s legitimate interest with a documented balancing test is the basis for checks, that gradual checking and the employee’s presence are the safeguards, that cameras are not operated for the primary observation of employees and are barred from changing rooms, washrooms, and break rooms, with recordings kept three working days as a rule and hidden cameras prohibited, that the e-mail account is checked under an internal policy, in steps from address and subject to content, and that the content of private e-mails is not inspected even after notice.	The content of private e-mails in the company account is not inspected by the employer even after prior notice of checks, the rights of the employee and of the third parties who sent or received them standing in the way.
Recommended	Portugalwhere written	Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That the employer defines rules of use and forms of control in an internal regulation, heard by the comissão de trabalhadores and sent to the ACT, after assessing the impact; that the worker is informed before processing of the conditions of private use, the forms of control, the data, the retention period, the tolerance admitted, and the consequences; that control data are kept at most six months save during disciplinary or judicial proceedings; that email addressed to the worker is never opened automatically, even to investigate a disciplinary infraction; that control is not permanent or systematic but pontual, directed to areas of risk, and random; that access to a mailbox is the last resort, in the presence of the worker and preferably of a representative, limited to recipients, subject, date, and time; and that access to the monitoring systems is logged with user, timestamp, operation, sequential id, and hash, signed, analysed under a policy with periodic reports, and the logs kept one year.	Whatever the rules of use, the employer never opens automatically email addressed to the worker, and the messages keep their personal nature even where a disciplinary infraction is being investigated; access to a mailbox is the last resort, in the presence of the worker, and limited to recipients, subject, date, and time, the worker able to point out private messages that are then not consulted.