Spanish Case Highlights Need for Workplace-Device Policies

By Dinah Wisenberg Brin August 19, 2019
Spanish Case Highlights Need for Workplace-Device Policies

​A Spanish firm that dismissed an employee accused of spending his workdays exploring the Internet on a company computer—visiting websites featuring betting, sexual content, shopping and travel—breached his constitutional privacy right in obtaining the evidence, an appeals court has ruled.

The decision earlier this year from the High Court of Justice of Andalusia underscores how important it is that employers in Spain, and elsewhere in Europe, establish and communicate clear policies on use of company devices, including a firm's right to monitor workers' activities, according to legal experts.

The employer, analyzing the browser history and hard disk in a computer that the employee regularly used, also found downloaded files potentially related to illegal activities such as how to hack websites and video game consoles, and it said the employee had been devoting little of his workday to the job, according to the court record. However, other employees had access to the computer.

The employer, which hadn't expressly prohibited personal use of company devices nor informed employees that they shouldn't expect privacy, fired the appliance repair worker in 2016 for abuse of trust and violation of good faith after discovering the computer evidence.

Evidence Illegally Obtained

The worker sued, and a trial court ruled in the company's favor. However, the Andalusia appeals court found that the employer had illegally acquired the evidence by breaching his privacy right under Spain's Constitution, according to Raquel Flórez, an attorney with Freshfields Bruckhaus Deringer based in Madrid.

The Andalusia court noted that:

  • Employees have a reasonable expectation of privacy that could include "moderate" use of company devices for personal purposes.
  • A company could neutralize this expectation by expressly prohibiting private use of its digital devices.
  • Employees must be informed of such a prohibition through collective bargaining agreements, individual employment contracts, or company protocols or policies covering information and communication technology.

It is key, Flórez said, for employers "to have a clear protocol explaining what is the permitted use of the relevant devices; whether private use is allowed and, if so, to what level; and what sort of tools and potential access could the employer exercise."

It's also vital for employers to be able to show that they have communicated these rules to all employees and that workers are aware of and fully understand them, she said.

This new case law on one hand confirms the employer's right to monitor workplace compliance, but at the same time notes that employees don't leave their fundamental rights outside the office doors or in their lockers, she said. "Those rights are there when the individual is using the company devices and navigating through the Internet or social media," Flórez said.

"Following this case law, it would be important to understand the expectation of privacy that the employee may have," she said, adding that the decision could lead to more-stringent workplace policies about private use of company devices.

Philip Gordon, a Denver-based attorney and privacy practice co-chair at Littler, said the court's decision suggests that employers that prohibit employees from using corporate electronic resources for personal purposes and that notify employees of that prohibition can justify disciplinary action based on evidence obtained through monitoring that a worker violated the ban.

Almudena Álvarez, an attorney with Álvarez Lentner in Madrid, said the evidence the company collected would have been admissible in court if the firm had implemented an information and communication technology protocol.

Rather than invalidating the termination and ordering the employee reinstated, the Andalusia court sent the case back to the trial court to rule on the dismissal without considering the improperly obtained computer evidence, she noted.

If the company presented additional evidence supporting the employee's alleged breach, she added, the trial court may dismiss the employee's complaint and "confirm the fairness of the termination regardless of the obtaining of evidence in a clear violation of the right to privacy."

Because other court decisions have voided dismissals that involved similar privacy violations, Álvarez expects that Spain's Supreme Court eventually will need to clarify whether improperly obtained evidence will automatically nullify a termination or whether courts will simply be able to ignore the wrongly acquired evidence.

Workers' Right to Privacy vs. Employers' Monitoring Rights

Spain's new data protection law, enacted in 2018, didn't apply in the Andalusia court case. Nonetheless, the court's ruling appears to rely on principles contained in that law and in European Court of Human Rights (ECHR) case law and the European Union's General Data Protection Regulation (GDPR), which aims to protect Europeans' personal data.

[SHRM members-only toolkit: Introduction to the Global Human Resources Discipline]

The new Spanish data protection law "guarantees the right to privacy of employees when using work devices put at their disposal by the employer," Flórez said. She noted that the legislation embraces standards previously set in case law. "It also guarantees the possibility for the employer to access those digital devices provided to employees with a view to monitoring compliance with employment obligations and to ensuring the integrity of the relevant devices."

The employer must have clearly informed workers about the permitted use of those devices and the possibility of the employer accessing them to monitor compliance. "Finally, this monitoring must be proportionate—that is, it cannot be done without justification," she said.

These principles arise from ECHR case law and the GDPR, and the Andalusia high court decision confirms those precepts, Flórez said. The ruling refers to a 2017 ECHR decision supporting employees' privacy right and the need for employers to warn workers of the type of monitoring they may perform.

Dinah Wisenberg Brin is a freelance writer and journalist based in Philadelphia.


Job Finder

Find an HR Job Near You
Search Jobs

Move your HR career forward.

Apply for the SHRM-CP or SHRM-SCP exam today! Applicants now have the option to test from home.

Apply for the SHRM-CP or SHRM-SCP exam today! Applicants now have the option to test from home.



HR Daily Newsletter

News, trends and analysis, as well as breaking news alerts, to help HR professionals do their jobs better each business day.