Monitoring Of Employees’ Email And WhatsApp Communications By The Employers

1. Introduction

As digital communication tools have become a fundamental part of professional life, striking a balance between monitoring of corporate email accounts, computers, and other communication tools assigned to employees by the employers and the protection of employees’ rights to privacy in their personal lives and freedom of communication has become a critical issue.

In particular, the employer’s monitoring of the content of communications conducted through an employee’s corporate email account should not be treated the same as the employer’s access to WhatsApp messages exchanged on the employee’s personal phone or personal account from a legal perspective. While the processing of an employee’s personal data may be involved in both cases, there are specific differences regarding the nature of the intervention, its legal basis, its proportionality, and the employee’s reasonable expectation of respect for their private life.

When the right to privacy, guaranteed under Article 20 of the Constitution, and the freedom of communication, regulated under Article 22, are evaluated together within the framework of the Personal Data Protection Law No. 6698 (“Law”) and Article 8 of the European Convention on Human Rights, it becomes evident that the employer’s authority to monitor employees’ communication tools is not unlimited. In this respect, the fundamental issue to be addressed is not whether an employer may monitor employees’ communications, but rather for what purpose, on what legal basis, to what extent, for how long, and by what method of prior notification to employees such monitoring may be carried out.

2. The Balance Between the Employer’s Authority to Monitor and Manage and the Employee’s Right to Privacy

Employers have legitimate interests in ensuring the orderly and efficient operation of the workplace, overseeing business processes, ensuring that tools assigned to employees are used for their intended purposes, and protecting trade secrets and information security. However, the existence of an employment relationship does not mean that the employee’s right to privacy is completely eliminated within the workplace. Even while at the workplace or using communication tools assigned by the employer, an employee can reasonably expect a certain degree of respect for their private life.

This issue was addressed in detail in the Constitutional Court’s decision dated January 12, 2021, with application number 2018/31036. The relevant decision establishes that monitoring of a corporate email account assigned to an employee by the employer is not definitely prohibited; however, such monitoring must be conducted within certain safeguards, taking into consideration its impact on the employee’s right to respect for private life, the right to the protection of personal data, and freedom of communication. The relevant decision addresses the following key points, among others:

“… the employer’s authority to monitor an employee’s communications must be examined within the context of the state’s positive obligations regarding the right to the protection of personal data and freedom of communication. First, in disputes arising from employers, who wish to take advantage of technological advancements, providing communication tools and equipment such as computers, internet, and email for employee use, there is a need to strike a balance between the employer’s interests and the employee’s fundamental rights and freedoms. In this context, it should not be forgotten that the relationship between the employer and the employee is shaped by an employment contract that establishes specific rights and obligations for both parties and is fundamentally based on a relationship of trust.

In this respect, it can be argued that, within the scope of the employer’s managerial authority and for reasons that may be considered legitimate and reasonable, such as ensuring the effective conduct of business and control over the flow of information, protecting against criminal and civil liability arising from the employee’s actions, measuring productivity, or addressing security concerns, the employer may, as a general rule, monitor the communication tools made available to the employee and impose restrictions on their use. However, it must not be forgotten that the employer’s managerial authority is limited to the conduct of business at the workplace and the maintenance of order and safety there. In this context, it must be emphasized that the employer’s authority and rights are not unlimited; the fundamental rights and freedoms granted to employees, specifically, the freedom of communication and the right to the protection of personal data, are protected even within the workplace. Furthermore, restrictive and mandatory workplace rules must not be of a nature that would undermine the essence of employees’ fundamental rights.

In light of all these explanations, and within the scope of the state’s positive obligations, the Constitutional Court must examine whether the lower courts, to the extent appropriate under the circumstances of the specific case, properly reviewed whether the third party whose actions infringed upon the right in question provided the safeguards listed below:

1. It must be examined whether there are legitimate grounds justifying the employer’s review of the communication tools and content made available to the employee.
2. In a democratic society, the monitoring of communications and the processing of personal data must be carried out transparently; as a necessary consequence of this, employees must be informed in advance by the employer regarding the process. Furthermore, the notice must include the restrictions on the use of communication tools established by the employer.
3. Any interference by the employer with the employee’s right to the protection of personal data and freedom of communication must be relevant to the intended purpose and suitable for achieving that purpose.
4. For an employer’s interference with an employee’s right to the protection of personal data and freedom of communication to be considered necessary, it must not be possible to achieve the same objective through a less intrusive measure; the interference must be indispensable to achieving the intended objective.
5. For an employer’s interference with an employee’s right to the protection of personal data and freedom of communication to be considered proportionate, the data processed or otherwise utilized through the monitoring of communications must be limited to the intended purpose; restrictions or interference that go beyond this purpose must not be permitted.
6. Furthermore, it is necessary to assess whether the conflicting interests and rights of the parties have been fairly balanced, considering the impact of the communication monitoring on the employee subject to the monitoring and the consequences for the employee.

It is understood that the employer, which has a large number of employees and provides financial services as a corporation, processes employees’ personal data and monitors the flow of communications by creating corporate email accounts for them, with the aim of ensuring the effective conduct of business. In this case, it can be argued that making the corporate email account available in a manner that allows access to the flow and content of communications constitutes a legitimate interest from the perspective of workplace management in this specific instance, and that it is a suitable method for achieving the intended purpose. 

On the other hand, it should be emphasized that in cases where there has been no prior, full, and clear notification regarding the monitoring of communications via the email account and the terms of use of communication tools, it is a situation that the employer could reasonably foresee that an employee might use the corporate email for personal correspondence, based on the employee’s legitimate expectation that their fundamental rights and freedoms will be protected in the workplace as well. Consequently, it can be argued that in cases where employees have not been explicitly informed, they have a reasonable expectation that their rights and freedoms will not be infringed upon, and they should be afforded the safeguards provided by fundamental rights and freedoms. 

However, if clear notification has been provided, the employer cannot be expected to obtain the employee’s separate consent before reviewing the corporate email account. In this context, it must be emphasized that, unless an objection to the employer’s monitoring authority is raised after the notification, the employee’s consent is deemed to exist and remains valid until proven otherwise.

In the specific case, the applicant alleged that the employer reviewed the corporate email account without providing notice and without the applicant’s consent. Upon reviewing the employment contract to which the applicant is bound, it was observed that the contract stipulates that the corporate email account assigned to the applicant is to be used solely for business purposes; that the corporate email may be monitored by management without prior notice; and that employees shall not object to this and shall comply with such instructions. Furthermore, it is clear that the employment contract explicitly provides that the contract may be terminated if the employee fails to comply with the obligations set forth therein, such as using the corporate email account in accordance with its intended purpose, addressing identified performance issues, and refraining from working at another job.

In this context, it can be stated that the employer has specified in the employment contract the limits on the use of corporate email, the procedures for monitoring email, the authority to review it, the obligations the employee must comply with while performing their job and using email, and the sanctions that will be applied under Law No. 4857 in the event of non-compliance with these obligations. In light of this, it must be accepted that the corporate email provided to the applicant is subject to monitoring, that the procedures for such monitoring were clearly communicated in advance via the Employment Contract, and that the applicant consented to the monitoring procedures and authority specified in the Employment Contract by signing it.

On the other hand, the scope of the employer’s intervention in this specific case must be discussed. In this context, when the correspondence provided by the employer to the applicant and the litigation process are evaluated as a whole within the scope of the proceedings, it is observed that the employer reviewed messages supporting the claim that the applicant was working at another job and used them solely during the judicial process to prove that claim. In this situation, it can be said that the employer conducted a review within the scope of its investigative purpose and used the data obtained as a result of the review in a manner consistent with that purpose.

However, upon reviewing the legal proceedings, it was observed that the Court reached its conclusion not only by evaluating the information and documents obtained through the review of the corporate email but also by considering witness testimonies, the employment contract, the workplace file, and other documents submitted to the case, and that it provided relevant and sufficient reasoning.

Given that the trial courts, in resolving the dispute arising from private law employment relations based on the stated grounds, have fulfilled their positive obligations, it must be ruled that the applicant’s right to the protection of personal data, which falls under the right to respect for private life guaranteed by Article 20 of the Constitution, and the freedom of communication guaranteed by Article 22 of the Constitution, have not been violated.”

In this respect, the employer’s right to management and supervision cannot be regarded as an absolute authority that removes the fundamental rights and freedoms of employees. A fair balance must be struck between the employer’s interests and the employee’s right to privacy, based on the specific circumstances of the case.

3. Monitoring of Corporate Email Accounts by the Employer

The fact that a corporate email account has been assigned by the employer does not mean that all correspondence within the account can be read without any restrictions.

Per the Law, email correspondence may constitute personal data if its content includes information that identifies or makes a person identifiable. In its decision dated November 25, 2021 and numbered 2021/1187, the Personal Data Protection Board (“Board”) rejected the employer’s defense that the corporate email account assigned to an employee by the employer (and the account itself) was outside the scope of the Law; and explicitly determined that all information, such as email addresses, private correspondence, bank account statements, and expense records, that directly or indirectly makes an individual identifiable constitutes personal data.

Pursuant to Article 5 of the Law, obtaining explicit consent is not mandatory in all cases for the processing of personal data. In particular, data processing is permissible without explicit consent when it is necessary for the establishment, exercise, or protection of a right, or when it is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject. However, it must be emphasized that the concept of “legitimate interest” does not grant the employer an unlimited monitoring authority.

Pursuant to the Board’s decision dated January 19, 2023 and numbered 2023/86, the conditions under which corporate email monitoring may be lawful were addressed in detail, and the Board has acknowledged that, in the relevant case, the employer had a legitimate interest in protecting trade secrets, preventing the misuse of corporate communication tools, and identifying conduct by the employee that violated the duty of loyalty arising from the employment contract. However, the Board emphasized that there is a significant difference between monitoring the flow of communication and examining its content.

Accordingly, the employer must first resort to less intrusive methods and, to the extent possible, attempt to determine whether any violation or security issue exists by examining communication traffic, sender and recipient information, file types, or similar technical data without accessing the content of the communications. Access to the content of communications should only be carried out in situations where it can be demonstrated that such access is necessary and proportionate, considering the specific circumstances of the case; this would be more appropriate in light of the principle of proportionality. Thus, in the decision mentioned above, the Board deemed it proportionate to conduct a content review limited solely to the relevant employee and the specified purpose, only after suspicious emails had been identified.

4. Obligation to Inform

It is not always sufficient for an employer to issue a general notice to an employee stating that “the corporate email account belongs to the company”. Pursuant to Article 10 of the Law, the data subject must be informed in a specific, clear, and understandable manner regarding the identity of the data controller; the purposes for which their personal data is processed; to whom and for what purposes it may be transferred; the method and legal basis for data collection; and their rights under the Law. For this reason, it is important that employee email and information security policies clearly and comprehensibly address, at a minimum, the purposes for which the corporate email account may be used; whether personal use is prohibited or restricted; under what circumstances monitoring may be conducted; the scope of such monitoring; the conditions under which content reviews may be conducted; who may view the collected data, and for how long it will be retained.

In the Board’s decision dated November 25, 2021 and numbered 2021/1187, the legal basis for the processing of personal data and the obligation to provide information were separately evaluated regarding access to a former employee’s corporate email account and the processing of correspondence contained therein. In the relevant case, the failure to demonstrate that the employee had been sufficiently informed about the purpose of using the corporate email account and the scope of the audit that could be conducted on that account was also taken into account in the assessment of legal compliance, and an administrative sanction was imposed on the data controller. This decision demonstrates that, in the context of monitoring corporate email, the sole existence of a data processing condition is not sufficient; the obligation to provide information, as well as the legal conditions and principles set forth in Articles 4 and 5 of the Law, must also be observed. On the other hand, in Board’s decision dated January 19, 2023 and numbered 2023/86, the fact that the employer clearly communicated the purposes and conditions of email monitoring to employees in various policies and information notes was taken into consideration in favor of the employer during the legal compliance assessment. When these two decisions are evaluated together, it becomes evident that not only the existence of a monitoring policy is important, but also that this policy must be accessible, clear, and understandable to employees.

5. Legal Status Regarding WhatsApp Messages

WhatsApp messages constitute a more sensitive area in terms of the privacy of personal life and freedom of communication. In particular, the employer’s access to private messages, which are stored on an employee’s personal cell phone and exchanged through their personal WhatsApp account, without a legal basis or a concrete reason justifying an intrusion into the employee’s private life cannot be evaluated within the same framework as the monitoring of corporate email accounts.

The Board’s decision dated May 16, 2019 and numbered 2019/138 pertains to an allegation that a company owner obtained WhatsApp messages belonging to an employee. In the case in question, it was alleged that the employer read, photographed, or took screenshots of messages exchanged in a WhatsApp group via the computer the employee used at the workplace. However, the Board did not review the application under the provisions of the Law, noting that the action in question should be evaluated under the Turkish Penal Code and that a criminal complaint had been filed with the Public Prosecutor’s Office regarding the incident. It is particularly important to emphasize here that the decision does not grant employers any authorization or legal justification to monitor or obtain employees’ WhatsApp messages. The Board did not investigate within its own jurisdiction because the dispute essentially constituted the subject matter of a criminal investigation.

In this regard, an employer’s unauthorized access to an employee’s personal phone or personal WhatsApp account may be evaluated not only under the Law but also under the Turkish Penal Code’s provisions regarding personal data, violation of the confidentiality of communications, and other relevant provisions, depending on the specific circumstances of the case.

The act of other employees forwarding messages from WhatsApp groups to the employer may lead to different legal consequences than the employer directly accessing the employee’s phone to obtain the messages. Therefore, in each case, matters such as how the data was obtained, to whom the account belongs, whether the employee’s consent was obtained, and the purpose for which the data was used must be examined in detail.

6. Principles for Conducting Monitoring in Compliance with the Law

From the perspective of employers, establishing a monitoring mechanism within a predetermined, clear, and systematic framework is the appropriate approach for mitigating legal risks and protecting employees’ fundamental rights and freedoms.

In this respect, it will be of great importance for the employer to prepare a clear and understandable policy regarding the use of corporate email, computers, internet, and communication tools; to inform employees about this policy before they begin work and, when necessary, to provide refresher training; to clearly define the purpose and legal basis of monitoring; to limit the monitoring, to the extent possible, to communication traffic and technical data; to conduct content reviews only when there is a concrete reason necessitating access to the content of communications and only to the extent necessary to achieve the intended purpose; to ensure that the data to be reviewed and the duration of the review are limited to the purpose; to limit the number of individuals who can access the collected data; not to collect or retain unnecessary data; to avoid direct access to employees’ personal email accounts and private communication channels such as WhatsApp; and to ensure that the collected data is not used for any purpose other than the one originally stated.

7. Conclusion

In conclusion, while an employer’s monitoring of employees’ use of communication tools provided by the employer is permissible under certain conditions within the scope of the employer’s management and monitoring rights and legitimate interests, this authority does not constitute an unlimited right to monitor or content review.

Particularly with regard to corporate email accounts, while it is accepted that an employer may conduct monitoring for legitimate purposes, such as protecting trade secrets, ensuring information security, preventing the misuse of corporate resources, and safeguarding employees’ duty of loyalty, such monitoring must comply with the principles of prior notification, necessity, and proportionality.

On the other hand, an employer’s intervention in private messages exchanged on an employee’s personal WhatsApp account is considered a much more severe intrusion into the privacy of personal life.

In this context, the balance to be struck between the employer’s commercial and managerial interests and the employee’s right to privacy and freedom of communication must be established based on principles such as transparency, prior notice, legitimate purpose, necessity, proportionality, and access restrictions. Failure to comply with these principles may result in administrative sanctions for unlawful data processing, liability for damages, and, depending on the specific circumstances of the case, criminal liability.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.