In a 91-page opinion the National Labour Court recently laid down a clear set of rules regarding an employer's right to monitor its employees' email messages and other employee uses of workplace IT systems.⁽¹⁾ The rules impose severe restrictions on employers' rights, subsequently calling for employers to consider modification and reform of their employee privacy policies.

Facts

The case before the court raised the question of whether an employer may access an employee's email messages and submit them as evidence in the course of court proceedings brought by the employee against the employer. Typically, the employer will wish to present evidence which has been obtained from the employee's email account in an effort to dismiss the employee's claim for unlawful termination. However, the 'fruit of the poisonous tree' doctrine (which refers to the method of obtaining evidence under the Privacy Protection Law) prohibits the submission of any evidence which has been obtained through the invasion of privacy.

Chief Judge Nili Arad delivered the National Labour Court's opinion on two appeals from district labour courts that had previously reached inconsistent decisions related to employers' rights in the above-mentioned respect.

Decision

Email account monitoring
In its decision the court clearly laid out the following principles in regard to email account monitoring:

• In light of the employer's proprietary interest in the workplace and its managerial prerogative, it should set a balanced policy for employee use of corporate IT and email systems. The employer must bring the policy to the attention of its employees, incorporate the policy into their personal employment contracts and obtain their written consent.
• A clear line should be drawn between an email account allocated by the employer to an employee and an employee's private email account, such as a webmail account (eg, Gmail or Yahoo! Mail).
• An employer may allocate accounts to employees and designate them for work-related purposes only (professional purpose accounts), for work-related and personal purposes (dual purpose accounts) or for personal purpose only (personal purpose account).
• An employer may monitor the traffic data and contents of professional purpose accounts only if it makes its employees aware of the email monitoring policy. However, if an employee uses the mailbox for personal email exchange, even if in violation of the corporate policy, the employer may access the personal messages in that account only subject to the employee's explicit, informative and freely given consent, and only if the contents of such personal messages are unlawful or abusive to the company.
• The employer may monitor and access personal messages in dual purpose and personal accounts, subject to the following terms:
  • Unusual circumstances must justify access to the messages;
  • The employer must have first used less invasive tools to reveal the monitored employee's misconduct;
  • The employee must have given explicit, informative and freely given consent to the corporate policy and specifically to the monitoring of, or access to, his or her personal (not work-related) messages; and
  • The employee must have provided specific consent for each event of access by the employer to the contents of the personal messages in a dual purpose account, or specific consent for any surveillance activity by the employer which includes access to a personal account and to personal contents in such account.
• An employer may not monitor or access an employee's private email account even if the employee uses the workplace IT system to access the account and the employee has consented to such access. An employee's private account may be accessed only subject to an appropriate court order, which is rarely granted by the courts.

Based on the above principles, and in regard to the specific cases at hand, the court granted the employees' motions to suppress the evidence due to the employers having obtained the evidence through unlawful means (ie, through invasion of the employees' privacy).

Additional resources monitoring

In its decision the court addressed additional resources used by employees at work, such as the Internet, fax machines and other computer software, and laid out general guidelines for their monitoring by employers. Thus, for example, it was stated that employers are required to define clearly in their policies which uses are acceptable, which uses are not acceptable and in which circumstances the resources are monitored. In addition, the court laid out further guidelines for the use of various monitoring methods, such as cameras.

Comment

In light of the above decision, employers should make all necessary adjustments to comply with the court's requirements. Specific attention should be given to existing corporate policies, employment contracts and the obtaining of adequate consent in order to harmonise corporate information security systems within the new pro-privacy workplace environment which the courts have now created.

For further information on this topic please contact Haim Ravia or Dan Or-Hof at Pearl Cohen Zedek Latzer by telephone (+972 9 972 8000), fax (+972 9 972 8001) or email (haimr@pczlaw.com or dano@pczlaw.com).

Endnotes

(1) Tali Isakov Inbar v The Commissioner for Women Labour, Labour Appeal 0/08, delivered on February 8 2011.