# Standards and Regulatory References — Workplace Email Privacy

## Primary Legislation

### ECHR Article 8 — Right to Respect for Private Life and Correspondence
- Art. 8(1): Right to respect for private life, family life, home, and correspondence.
- Art. 8(2): Interference only where in accordance with law, legitimate aim, necessary in democratic society.

### EU Charter of Fundamental Rights Article 7
- Right to respect for private and family life, home, and communications.

### GDPR Articles 5, 6, 13, 14, 35
- Art. 5(1)(c): Data minimisation — monitoring data must be adequate, relevant, and limited.
- Art. 6(1)(f): Legitimate interest — primary lawful basis for email monitoring.
- Art. 13/14: Transparency — employees must be informed of monitoring.
- Art. 35: DPIA required for systematic employee monitoring.

## ECHR Case Law

### Barbulescu v Romania (Grand Chamber, Application No. 61496/08, 5 September 2017)
Six-factor proportionality test:
1. Prior notification of monitoring
2. Extent of monitoring and degree of intrusion
3. Legitimate reasons for monitoring
4. Less intrusive alternatives
5. Consequences for the employee
6. Adequate safeguards

### Libert v France (Application No. 588/13, 22 February 2018)
- Files clearly marked "personal" on work computer protected from employer access.
- Employer may not open personal files without employee present unless serious risk.

### Köpke v Germany (Application No. 420/07, 5 October 2010)
- Covert video surveillance of employee suspected of theft justified in narrow circumstances.
- Requirements: concrete suspicion, limited time/scope, no less intrusive alternative.

### Niemietz v Germany (Application No. 13710/88, 16 December 1992)
- "Private life" encompasses professional activities and workplace interactions.
- "Correspondence" includes electronic communications from work.

### Copland v United Kingdom (Application No. 62617/00, 3 April 2007)
- Monitoring of employee telephone, email, and internet usage without legal basis violated Art. 8.

## National Guidance

### CNIL (France)
- SAN-2020-012: EUR 75,000 fine for systematic internet browsing monitoring without transparency.
- Guidance on employee monitoring emphasises proportionality and metadata preference.

### Garante (Italy)
- Provvedimento 303/2016: Real-time email monitoring prohibited without adequate transparency.
- Workers' Statute Art. 4 requires trade union agreement for monitoring equipment.

### BfDI (Germany)
- Federal Labour Court BAG 2-AZR-681/16 (2017): Keystroke logger evidence inadmissible — disproportionate.
- BDSG Section 26: Employment data processing necessity test.
- Section 87(1)(6) BetrVG: Works council co-determination for technical monitoring.

### AEPD (Spain)
- PS/00050/2020: EUR 40,000 fine for reading employee personal emails without notice.
- Art. 87 LOPDGDD: Right to digital privacy at work.

### ICO (United Kingdom)
- Employment Practices Data Protection Code, Part 3: Monitoring at Work.
- Emphasis on proportionality, prior notification, less intrusive alternatives.