Control of e-mail accounts in the workplace. Data protection related aspects

Currently, there is no specific regulation in Argentina concerning electronic communications in the workplace that could limit the employer’s powers in that regard.

On the other hand, data protection is broadly regulated in Argentina as, specifically, is the employees’ personal information in the possession of their employers.

We shall try in the following paragraphs to give a general overview of the powers of the employer to control information moving into and out of the company, as well as the scope of the use that the employer can make of such information.

E-mail monitoring by the employer

Argentine Labor Law is based on the principle of “good faith” that must be observed by both parties throughout the employment term. Therefore, it can be considered that the observance of a sensible corporate policy regarding electronic communications falls within the scope of an employee’s duty of good faith, which would also protect the employer’s image.

In that context, the employer has the authority to direct and organize its business and any employee should observe the employer’s instructions regarding the work to be carried out. A corporate policy on electronic communications in the workplace could be considered as part of those instructions and is current practice worldwide, including in Argentina.

Employees should be warned that misuse of communication tools could lead to disciplinary measures or even dismissal with cause in the case of continued misuse. In this connection, Argentine labor law enables the employer to apply sanctions, provided they are proportionate to the breach.

However, the Argentine Constitution grants special protection to correspondence and private papers, considering them inviolable, and the Argentine Civil Code entitles the individual whose privacy rights have been arbitrarily breached to request the cessation of such acts and to seek compensation. If labor e-mails were considered to be covered by such protection, then unilateral employer monitoring could be challenged.

The apparent conflict between the right of the employer to direct the business and the privacy of private correspondence granted by the Argentine Constitution, gives rise to different opinions and interpretations.

Currently there is no legal instrument in Argentina regulating the use of e-mails, either in personal or labor affairs. Particularly, from a labor point of view, the lack of legal framework prevents a clear definition of the legal nature of the e-mail account provided by the employer specifically for business purposes.

There are currently two views:

i)             Some authors and courts are of the opinion that messages received or sent from a labor e-mail are equivalent to personal mail or e-mail as regards the constitutional protection of correspondence and, therefore, that such messages would not be subject to control by the employer.

ii)            According to other opinions, the labor e-mail is a work tool and, thus, the employer is authorized to monitor its use, under its powers of control established by Argentine labor law.

Both positions have been included in some bills of law analyzed by the Argentine Congress, though neither has yet been passed.

However, legal authors tend to agree with the second alternative and treat labor e-mails as work tools.

Furthermore, case law has also considered it a work tool although, for other reasons, often technical, has been reluctant to accept dismissals with e-mail-related cause. Only an isolated case, not from a labor court but from the criminal court, considered that the constitutional privacy protection prevailed.

The nature of the labor e-mail as a personal account or a work tool is essential for the determination of the powers of control of the employer and the validity in court of evidence obtained by a unilateral control of an employee’s labor e-mail by the employer.

If the labor e-mail was considered as personal mail of the employee, the employer could not control the content thereof unless a court authorization was previously obtained. In this scenario, the evidence that the employer might obtain by monitoring the labor e-mail – on the basis of which the employer might demonstrate some breach by its employee– could prove inadmissible in a court if the judge considered that such evidence had been obtained in an illegitimate manner.

On the other hand, if the labor e-mail was considered as a “work tool”, such scenario would cause the labor e-mail to fall within the labor legal framework and its use would be subject to the pertinent direction and powers of control of the employer.

There are reasonable arguments to support this last position, which has been also the rationale of most court cases in this matter.

Therefore, the employer would be authorized to have control over the use of such a device provided to its employees, once having duly notified its employees of such powers, due to the control it has under its power of direction. It could thereby use such information as evidence of the employee’s breach.

From a practical point of view, in our experience the chances of success in the event of a claim for such unilateral e-mail control would be higher if there were a specific policy, duly notified to the workers, which expressly indicated:

(i)           how to use e-mail accounts provided by the Company,

(ii)           that the Company was entitled to regularly check and monitor such e-mail accounts,

(iii)          that the existence of a password is security-related but that it should under no circumstances create any expectation of privacy, and

(iv)          that any breach of the Company’s policies could lead to the applicable sanctions.

However, the final decision regarding the nature of the e-mail and the employer’s power of control will be made by a judge, who could consider the e-mail either as a work tool or as private mail.

If a judge considered in the future that the e-mail and information contained in the employee’s computer was personal mail, the employer would need the authorization of the employee or a judge to perform any monitoring. Otherwise, the officers involved in such monitoring could be held criminally responsible.

Data protection in Argentina

Unlike the situation concerning labor communications in the workplace, which are not regulated, the handling of personal information is strictly protected in Argentina.

No personal information may be delivered to third parties without the authorization of the owner of such information.

From the point of view of labor relations, employees are the owners of their information and, consequently, the employer may not dispose of any personal information without the employee’s prior written consent.

In addition, employers have a duty of confidentiality regarding all their employees’ personal data, even after the termination of employment, except under court or administrative order or for medical reasons.

Finally, the transference of personal data is subject to specific requirements and such transference to other countries with lower levels of security is prohibited unless the employee so consents.

In every transfer of personal data the employee has to be informed of the purpose of the transfer and the identity of the transferee.

By way of summary, data protection is subject to the following guidelines in Argentina:

i)            Restricted use of employees’ personal data

ii)            Prohibition on disclosure without the prior written consent of the employee

iii)            A confidentiality obligation on the employer

iv)           Specific requirements for data transfer and a prohibition on transfer to lower level of data protection countries, except with the prior written consent of the employee

v)            A duty to inform the employee of the purpose of the transfer and the identity of the transferee

Therefore, if any investigation might include e-mail control and the discovery of any relevant information, it would be of extreme importance to analyze carefully and in detail the case and the steps to follow (for instance, if for the purposes of the investigation the employer intended to send information to its headquarters outside Argentina) in order to avoid any potential future challenges based on the violation of data protection regulations.

Conclusion

As may be observed from the preceding paragraphs, there do exist channels to pursue an investigation and discover information that could be very helpful for the employer to deal with specific situations in the workplace.

However, it is also important to take precautionary measures to legally access that information and, furthermore, to make proper use of any findings.