A legitimate and essential component of any employment relationship is the right of the employer to inspect and monitor the work-related conduct of employees. Technological progress and, particularly, the omnipresent use of email and the internet in the workplace have brought increased security issues including data theft or misuse, but they also give the employer unprecedented possibilities to monitor their employees. This creates a tension between the interests of the employer in protecting confidentiality and data and the employee's interest not to be subject to any excessive or disproportionate monitoring. Under Austrian law, a number of legal issues arise from the obligation of the employer to respect employee privacy at work, while maintaining an appropriate degree of control over the use of company data and facilities, particularly in the area of 'new media'.
Under labour law three central questions arise:
- Is Works Council approval required by way of a collective plant agreement?
- Must employee consent be obtained?
- Do surveillance measures infringe the law?
The legal complexity of employee monitoring in Austria derives from the fact that privacy issues in the workplace are governed by several, partly overlapping legal regimes.
Constitutional right to data protection
According to the constitutional provision of § 1 of the Act on Data Protection, everyone has the legal right for personal data to be kept secret. Any processing of personal data is only allowed either: if prior consent is obtained; or if the processing is in vital interest of the person concerned; or if the usage of the data is justified by an outweighing, legitimate interest of a third party. Even if these criteria are met, any intrusion has to observe the principle of proportionality.
In this sense, the processing of working time records, determination of holiday entitlements, payroll, accounting etc. is justified on the grounds that it is in the legitimate interests of the employer.
Personal rights under Civil Law / § 16 ABGB (the Austrian Civil Code)
Personal rights primarily derive from the protection of private and family life under the European Convention on Human Rights, the secrecy of telecommunication data as well as the fundamental right to data protection mentioned above.
Any measures that may affect personal rights and are introduced without valid justification require the prior consent of the affected employee. This applies, for example, to processing of telecommunications data, video recording in the workplace and the location of a person's car.
In these situations, the employer's interests have to be weighed against the interests of the employees. The monitoring measures will be permissible where the employer's interests predominate. However, the employer still has an obligation to use the least intrusive means of achieving its purposes, such as, for example, personal surveillance instead of video or mere picture transmission instead of picture recording.
Rights of the Works Council
Under § 96a of the Act on the Works Constitution, the introduction of an automated system in order to collect, process and transfer personal data of employees, in general requires a collective plant agreement between the business and its Works Council. Exceptions are: the processing of general data about the person or about their professional qualifications; and the processing of data if it does not exceed the extent necessary to fulfil the obligations resulting from the employment contract, a statutory requirement (such as recording for payroll accounting), a collective plant agreement or a collective bargaining agreement. If an agreement between the Works Council and the business is not reached, a decision of a settlement agency may substitute such an agreement.
Should operations exceed the pure collection, processing or transfer of data in the sense that monitoring or controlling measures are implemented, § 96 of the Act on the Works Constitution will have to be complied with. This requires the approval of the Works Council to a collective plant agreement which cannot be replaced by a decision of the settlement agency. If no Works Council exists in the company, the measure may only be implemented after having obtained the consent of each of the affected employees.
Email and internet control – rights of employees and Works Councils
The mere fact that an employer has monitoring capabilities can lead to the requirement to enter into a Works Council agreement or, in the absence of a Works Council, to get individual employee consent. This is the case even where the employer is not actually carrying out monitoring and the duty is only reversed by the implementation of technical measures to prevent any monitoring taking place.
Affected human dignity
Having said this, monitoring measures only require consent if human dignity is affected. The monitoring of job performance in general is a necessary and permissable method for the employer to ensure his own products and services are free of defects. Therefore, in principle, this does not affect human dignity. However, if only parts of the employee's work (e.g. electronic documents) are selected and analysed instead of an overall appraisal of the employee's capabilities, human dignity will be affected. It is also usually permissible to monitor attendance. However, a recording of any and all activities of an employee throughout the day without any pause will be held to be affecting human dignity.
It should also be remembered that the transfer of personal data to other group companies may require Works Council or employee consent.
Private use of email and the internet
Private use of email and the internet cannot be completely forbidden by the employer, however, instructions may be given to limit it to the extent that it is absolutely necessary. Where this is the case, sampling to check compliance is permitted.
Other than sampling to check compliance with any internet/email use policy, the review of the content of private emails is completely prohibited, even if Works Council or employee consent has been given. This also applies to the recording and review of browsing histories. Similarly, any analysis of private correspondence, private access recordings and also of private email addresses is not permitted, even with prior approval.
Where employees are allowed to use company facilities like the internet or email for private, non-essential use, human dignity and personal rights are more likely to come into play and more precautions will have to be introduced. It should be presumed that in most cases a collective plant agreement will have to be concluded with the Works Council or the consent of the affected employees obtained in relation to any sort of monitoring. The restriction of monitoring measures to job-related data which is allowed to be reviewed can be facilitated by an instruction to the employees to store private mails in separate files and to mark personal emails as "private".
However, employers must be aware that secret use of monitoring systems (spyware) cannot be justified under any circumstances.
The legal framework which governs employee monitoring in Austria is complex and employers should seek legal advice as to when and whether a Works Council agreement or employee consent needs to be obtained. Non-compliance could lead to applications for injunctions by Works Councils or employees or even to claims for damages.