OGH on Data Protection at Work

Nov 3, 2023 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) has examined whether an employer’s inspection of former employees’ emails is in breach of the General Data Protection Regulation (GDPR). Under Article 4(1) of the GDPR, any information contained in emails is generally considered personal data.

The plaintiffs were employed by the defendant as assistants to the management of the company. Each employee had their own Microsoft Outlook account and address. The executive assistants were given access to the e-mail accounts of their predecessors and to those of the managing directors. Accessing their predecessors’ correspondence was relevant to accessing communications with clients and contractors.

The day after the second claimant's employment had been terminated by mutual agreement, the managing director of the defendant accessed her e-mail account. In doing so, he became aware that the first plaintiff had written to the second plaintiff that everyone was ‘incapable’, that she was ‘freaking out’, and that she was ‘not going to do much’. The manager responded by sacking the first plaintiff.

The plaintiffs claimed non-pecuniary damages of EUR 1,000 for violation of their fundamental right to data protection.

The OGH ruled as follows:

The processing of personal data is permitted under Article 6(1)(f) of the GDPR under the following conditions: It must be necessary to protect a legitimate interest and the interests and fundamental freedoms of the data subject must not be overridden.

The legitimate interest and necessity of the inspection lies in the maintenance of the defendant’s business. Since the plaintiffs were also given access to the communications of their predecessors, they should have reasonably expected that their emails would also be inspected unless they were obviously private. In the case of two executive assistants communicating with each other, it can be assumed that the communication was official.

In view of these circumstances, the defendant’s interest in inspection outweighs the plaintiffs’ interest in the protection of their personal data and privacy.

6 ObA 1/22y (28 June 2023)