Employers criticise proposed legislation to restrict access to employees’ emails

In the autumn of 2006, the Norwegian Ministry of Government Administration and Reform issued a proposal regarding employers’ access to employees’ emails for consultation among the relevant social partners. The proposed legislation would strengthen employees’ right to privacy by denying the employer access to employees’ emails, except under special circumstances. The deadline for responses was set for January 2007. The responses received show that both employers and public prosecutors have strong objections to the proposal.

In October 2006, a new proposal (in Norwegian) for legislation on employers’ access to employees’ emails was issued by the Norwegian Ministry of Government Administration and Reform (Fornyings- og administrasjonsdepartementet, FAD), for consultation among the relevant actors in Norwegian working life. A new proposal was drawn up following criticism of the existing regulations from many bodies, including the Data Inspectorate (Datatilsynet). The recent government initiative signals an alternative approach towards the protection of privacy in this field. The regulation, which is in principle accepted by the government, may be adopted and come into force by the autumn of 2007.

Protection of email privacy

The issue of email privacy was discussed in connection with the 2005 revision of the Act relating to workers’ protection and the working environment (Arbeidsmiljøloven, AML) (NO0403102F), originally adopted in 1977. The committee reviewing this legislation unanimously concluded that while there was no need to regulate the monitoring of business-related emails, private emails received at the workplace ought to be protected to some extent. This proposal, however, met with criticisms from the Data Inspectorate. As a result of its criticism, as well as the increasing number of cases where existing provisions have been breached (NO0510102F), a proposal for new regulations was put forward.

New proposals for email protection

In accordance with the new proposal, the employer should, as a rule, have no access to the employee’s email inbox, ‘unless an exception is explicitly stated in the provision’. No distinction is made in the proposal between private emails and business-related emails, unlike the earlier 2004 proposal; rather, all emails should be subject to equal treatment. Exceptions to this rule can be made if the employer is absent without notice, or if the employee is absent with notice, but has not acted in accordance with a written order given by the management on how to deal with incoming emails, such as in relation to the forwarding of emails. Other exceptions to this rule may also be made with regard to suspicion of criminal activities or disloyalty, such as downloading illegal files or undertaking activities that are in direct competition with the employer, or that may pose a threat to internal system security.

Mixed reactions to proposal

All bodies that were consulted on this matter agree on the need for privacy protection in relation to email. However, opinions vary as to how this should be done. Trade unions and Datatilsynet support the proposal. Conversely, the employer organisations, as well as the public prosecutors, have expressed strong concerns about the proposed regulations.

According to the employer organisations, the proposal does not take into account the fact that the equipment – that is, the computer itself, as well as the software and network access – is provided by the employer, and if the employee wants a personal email address, then this should be arranged by the employee themselves. They argue that email is used for transmitting all sorts of documents such as letters, complaints and orders, and that privacy protection cannot have the effect that the employer is prevented from accessing such information. The employers contend that the exemptions made in this respect are inadequate. Moreover, they argue that other situations might arise whereby the employer has strong interests in accessing an employee’s emails, but where the situation is not covered by the exemptions stated in the new provisions. For example, an employee might be present at the workplace, but for some reason may deny the employer access to necessary information. The use of automatic forwarding when the employee is absent might also lead to a growth in the amount of spam email, and may also result in problems with regard to professional secrecy. The employers also believe that an exception to the main rule prohibiting employers access to employees’ emails is also needed, should such an agreement be reached with the employee.

In addition, the public prosecutors fear that the proposed regulations will make it more difficult to collect evidence from crimes related to electronic activity, that is, computer-related crime and financial fraud.

Kristin Alsos, Fafo Institute for Labour and Social Research