Service providers within the meaning of the Telecommunications Act (TKG) must comply with the secrecy of telecommunications. As a telecommunications provider, an employer will not be able to monitor personal e-mail or Internet usage, or only to a very limited extent, in order to respect the employees’ privacy. Access to the e-mail account would only be permitted with their explicit permission. The judges of the Erfurt Regional Court rejected this position with their decision on April 28, 2021. In exceptional cases, employers are permitted to view their employees personal e-mail without permission. This would not give rise to claims for damages or claims for injunctive relief on the part of the employees pursuant to Sections 44 and 88 of the Telecommunications Act.
Suspicion of criminal offenses permits access
The employee’s absence or the suspicion of criminal offenses are regarded as particular exceptions, for example. The requirements are as follows: The employee must comply with the principle of proportionality and the legitimate interests of the affected party must not outweigh this. The principle of data minimization pursuant to Section 5 of the General Data Protection Regulation (GDPR) plays an important role. Only the data necessary to resolve the suspicion of a violation is to be examined. The employee’s legitimate interests are given greater weight due to the permission to use the e-mail account for personal purposes.
Indicative effect of the CJEU decision regarding Gmail?
Other courts also reached the same decision as the Erfurt Regional Court, namely that employers are not service providers as per the Telecommunications Act (TKG) by permitting the private use of company e-mail accounts. However, a Supreme Court ruling remains still open. One possible indication is the decision of the European Court of Justice (CJE) from June 19, 2019 that does not classify Gmail as an electronic telecommunications service in the sense of the Telecommunications Act (TKG).
In contrast, the data protection authorities assume that the secrecy of telecommunications applies on page 8 of their orientation guidelines regarding e-mail and Internet in the workplace. The new telecommunications and Telemedia Data Protection Act (TTDSG) which the German Bundestag passed into law in May also fails to provide legal certainty.
Erfurt Regional Court, decision from 4/28/2021 (Ref.: 1 HK O 43/20)
European Court of Justice, decision from 6/19/2019 (Ref.: C 193 / 18)
What is recommended for companies? Until the law has been clarified, employers should prohibit the personal use of company e-mail accounts. Otherwise, the affected parties must permit their employer to access the e-mail account. Access without permission gives rise to a risk of labor court disputes or fines from the data protection authorities.
