Start of main content

The review of e-mails by companies: About the Supreme Court ruling on February 8th 2018

| Publications | Employment Law and Social Security

Analysis of the February 8th 2018 Supreme Court ruling

Following the judgment of the European Court of Human Rights (Grand Chamber) of 5 September 2017 (Barbulescu II v. Romania), legal operators were waiting for the Supreme Court to rule on the possible legality of the employer's access to the corporate e-mails of its employees and, therefore, on the feasibility of using them as evidence to substantiate disciplinary business decisions.

Well, to a certain extent, the question has been cleared up. The Social Chamber of the Supreme Court in its ruling of 8 February 2018 (Inditex case; RCUD 1121/2015) states that the doctrine of the European Court does not add anything substantial to the traditional jurisprudential doctrine of the Supreme Court or to that developed by the Constitutional Court.

The background of the case being prosecuted was:

1.- Within the company, there were specific corporate 'information systems' and an 'information security policy' regulation for the group, which limited the use of the company's computers to strict work purposes and therefore prohibited their use for personal matters.

2.- Each time the employees accessed the company's computer systems from their own computer, and prior to such access, they had to accept the guidelines established in the group's information security policy, which stated that access was for strictly professional purposes, and the company reserved the right to adopt the necessary monitoring and control measures to verify the correct use of the tools it made available to its employees, The complainant was therefore aware that he could not use the mail for any particular purpose and that the company could monitor compliance with the guidelines in the use of the information technology provided by it.

3.- The examination of the computer used by the actioning employee was agreed following the "accidental discovery" of two photocopies of  bank transfers made by a supplier of the company in favour to the plaintiff for a total amount of €50,000 (one direct for €11,000 and the other for €39,000 from a car dealership), which were used to purchase a Mercedes X6. This fact is expressly prohibited in the company's code of conduct and imputed in the dismissal letter.

4.- From 2008 to 2013, the supplier invoiced the company 32,899,913 dollars. Of this total amount, $15,734,080 was invoiced for purchases made from that supplier by the claimant. From 2011 to 2013, the supplier invoiced the Group 6,379,733 dollars, of which 2,370,188 dollars were invoiced for orders made by the worker.

5.- The contents of certain e-mails in the plaintiff's corporate e-mail account were examined, but not in a generic and indiscriminate manner, but rather attempting to find elements that would allow the selection of which e-mails to examine, using keywords that could be used to infer in which e-mails there might be information relevant to the investigation and taking into account the proximity of the date of the bank transfers.

a.- What is the jurisprudential doctrine that our Supreme Court has established behind the Europeaan Courth of Human Rights judgement in the Barbulescu case?

The High Court underlines that the doctrine of the European Court of Human Rights, when attributing legitimacy to the activity of control over workers' e-mails, highlights as decisive five factors to be taken into account: a) the degree of interference by the employer; b) the existence of legitimate business reasons justifying the monitoring; c) the absence or existence of less intrusive means to achieve the same objective; d) the destination given by the company to the result of the control and, e) the provision of guarantees for the worker.

The Supreme Court then ruled that the factors to be taken into account in the compulsory balancing of interests are basically the three successive "suitability", "necessity" and "proportionality" judgments required by the Constitutional Court and the Supreme Court's own jurisprudence.

The Supreme Court considers that these factors were scrupulously respected, and therefore the company's appeal for the unification of the doctrine is deemed to have been accepted, attributing full procedural validity to the evidence derived from the examination of the e-mail address on the employee's computer.

b.- What aspects have been specially taken into consideration by the Supreme Court to validate the examination of the content of certain e-mails?

First, that the "accidental" discovery of photocopies of bank transfers made by a company supplier in favour of a worker excludes the application of the Anglo-Saxon doctrine of the "fruit of the poisoned tree", under which the judge is barred from assessing not only the evidence obtained in violation of a fundamental right, but also that resulting from it.

Secondly, the fact that the company had a policy on the use of computer resources which limited the use of those resources, including, in particular, electronic mail, for exclusively professional purposes. Furthermore, the internal rules clearly stated that the company could monitor or supervise the use of such means by employees. The worker was aware of these rules and accepted them on a daily basis when accessing his assigned computer.

Thirdly, the review of the e-mails was not carried out in a generic or indiscriminate manner, but rather in an attempt to find elements that would allow the selection of the e-mails to be examined, using keywords that would make it possible to infer in which e-mails there might be information relevant to the investigation.

In this way, the examination was limited to those mails relevant to the investigation, available in the employee's corporate mail, through access to the server hosted on the company's own premises, i.e. no particular device or device of the employee was ever accessed.

c.- Are there other aspects of interest in Supreme Court ruling?

We would highlight three:

1º.- That the use of the computer in the company, although personalised, falls within the scope of the employer's supervisory powers and, therefore, the exercise of the corresponding powers of control is covered by Article 20 of the Worker’s Statute and does not have the limitations that correspond to the function of "private police" that Article 18 of the Worker’s Statute allows, which is an exceptional regime referring to the private sphere of the worker (ticket office and personal effects), so that although the presence of third parties (notary, employee’s legal representative, other worker and the person concerned) may be convenient, its absence does not, however, in any way condition the validity of the control act.

2º.- The company's interest or assessment to appeal to the Supreme Court, since although the High Court of Galicia confirmed the origin of the disciplinary dismissal sitting in the High Court chamber nº 1 in A Coruña, it was based on the illegality of the control of the actor's emails and could not be denied that: a) the extent of the supervisory powers of the company was at stake; b) the specific evidence of the breach alleged in the dismissal letter; and c) the possible demand for liability of any kind for the company's actions, which the Territorial Court's ruling described as infringing the fundamental rights of workers.

3º.- The delay in the appeal, which, as in so many other appeals for the unification of doctrine, takes too long to be resolved, as several legal operators have already stressed with great concern. The High Court judgement combated in Galicia was issued on December 30, 2014 and the High Court judgement is from February 8, 2018.

In conclusion, the Supreme Court in this peculiar case, in which both the worker (Chamber of the High Court nº 1 A Coruña 14-4-14 and STSJ Galicia 30-12-14 confirmed the origin of the dismissal) and the company appealed, revokes the nullity affecting the evidence obtained by the employer through the control of its e-mails, set out in the judgment of the Territorial Court, and attributes full procedural validity to the evidence derived from the partial examination of the e-mails existing in the worker's computer.


For further information, please contact:

Alfredo Aspra

José Antonio Sanfulgencio


Download the PDF file here


End of main content