Section: Justice & law | Technology & AI Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: employer, e-mail, monitoring, § 316, GDPR, Bărbulescu, metadata, privacy SEO / Working Title: May an employer read your e-mails and monitor a computer?
May an employer read your e-mails and monitor a computer? The question sounds simple until we notice that we are not comparing one thing. A check of time on the web can be reasonable and the reading of the body of a message still an excess. A directive can exist and the scope can still be missing. A hidden camera at a checkout can stand in one judgment and in a changing room it must not stand. Consent in an employment contract can be signed without being free consent under the GDPR.[9] The following text therefore does not ask to whom the computer belongs. It asks how deep the interference reaches — and whether it can bear a reason, information and a milder path.
1. One hundred and two hours on the web in one September is not an opened body of work mail in January
Picture a meeting after an incident. The employer says: the laptop and the mailbox jmeno@firma.cz are ours. The employee answers with Article 13 of the Charter and the secrecy of messages.[3] IT shows a listing of visited pages and of time. HR prepares a disciplinary proceeding. The labour inspectorate reads Section 316 of the Labour Code. ÚOOÚ asks about the controller of personal data and the legal title. Everyone speaks of a check. Everyone, however, means a different depth of interference.
The Supreme Court in the matter 21 Cdo 1771/2011 dealt with a listing of internet activities of one employee for the period 1.–30. 9. 2009. In the facts there appeared 102.97 hours of surfing unrelated to work. The court stressed that it was not a reading of the content of e-mails, SMS or MMS, but a check of the use of work resources.[6]
An expert analysis of the same decision on epravo.cz works with the same cut: for the assessment of private use of the internet the record of activity was decisive, not the opening of private communication.[17] That matters, because the dispute is often told as a general permission for monitoring. A more precise reading says something narrower.
The Supreme Administrative Court in judgment 6 Ads 21/2026-27 of 18. 3. 2026 dealt with a different situation. After a particular leak of personal data at ČÚZK the content of the work mail of one civil servant was checked in a narrow window 2.–4. 1. 2024. The disciplinary measure was 15% of salary for 3 months; it is a sanction in one service matter, not a tariff for reading mails.[7]
At first glance this is a dispute “may or may not read e-mails”. In fact we are comparing a listing of activities with the opening of the content of mail. That is why they can all be partly right and the shared sentence still wrong. Company equipment is not a private vault. Nor does ownership of a computer give a free right to read every message.
A company computer is not a private vault. Nor is a directive permission to read love letters.
— Jiný Kontext
2. A check at the workplace has at least six layers
The first layer is ownership of the resource. A laptop, a telephone, a work e-mail and a company network can belong to the employer. Section 316(1) of the Labour Code forbids an employee, without consent, from using the employer’s production and work resources including computing technology and telecommunications equipment for personal need; the employer may check compliance with this prohibition in a reasonable manner.[1]
The second layer is an expectation of privacy at the workplace. In the decisions Halford, Copland and Bărbulescu the ECtHR works with the fact that even communication from a work environment can fall under private life and correspondence.[16][12][4] The Supreme Administrative Court 2026 cites this line beside Article 13 of the Charter.[7][3]
The third layer is the depth of the interference. A block of websites is not the same as a log of time and URL. A log of time and URL is not the same as an e-mail header. A header is not the body of a message. The body of a message is not the tapping of a call. A camera at a publicly accessible checkout is not a camera in employees’ back rooms.
The fourth layer is legal regimes side by side. The Labour Code deals with the labour-law boundary. The Charter protects privacy and messages. The GDPR deals with personal data, purpose, minimisation, information and legal title. The Labour Inspection Act sets administrative offences. With cameras the methodology of ÚOOÚ enters as a guide.[1][8][13][14]
The fifth layer is transparency and the exception. The general rule is to inform in advance of the scope and manner of the check if the employer introduces an interference under Section 316(2).[1] The exception for a covert interference is, in European case-law, bound to a strong and concrete reason, not to the convenience of surveillance.[5]
The sixth layer is the use of the result. A log or an e-mail that was obtained for the protection of property or data must not end as entertainment in a collective. The Supreme Administrative Court in 2026 expressly assessed that the results of the check were not used for another purpose.[7]
3. The best check is the one whose interference you can bear to explain
Technology can log many things. That is not an answer. The right question is which interference can be explained to an employee, a court, a labour inspectorate and ÚOOÚ. If the explanation stands only on the sentence “it is our computer”, it is weak even before the first log.
| Type of failure | What it looks like | How to test | What will limit the damage |
|---|---|---|---|
| A swap of paragraph 1 and paragraph 2 | A listing of URLs is taken as permission to read the body of a mail | Compare NS 21 Cdo 1771/2011 with the wording of Section 316(2) | Metadata earlier than content, and a narrow reason |
| A directive without a scope | The sentence “we may monitor” does not say how | Use the Bărbulescu criteria and Section 316(3) | Direct information about scope and manner |
| Blanket coverage for certainty | A reading of all mailboxes without a particular incident | Compare NSS: one employee, 2.–4. 1. 2024, a leak of data | A time window, a subject and subsidiarity |
| A hidden camera outside an extreme | A hidden recording in back rooms, a changing room or a kitchenette | Compare López Ribalda and the Regional Court in Ostrava | Visibility, a public space and a serious reason |
| Consent as a stamp | Consent in a contract is to replace a GDPR title | Read WP29 2/2017 on the inequality of the parties | A legitimate interest or a duty plus information |
| A foreign purpose of the result | A log from a check is used for slander or other pressure | Check purpose, access and the period of retention | Access rights and an audit |
Interpretive scheme: The table does not say that every check is forbidden. It shows the places where a reasonable check becomes a deeper interference without support.
A good process therefore does not begin with what IT can switch on. It begins with which harm the check is to avert. Otherwise the tool begins to expand according to convenience, not according to a reason. First more websites are logged, then more headers, then several messages are opened and finally no one knows exactly when a check of a work resource became surveillance of privacy. Precisely this transition must be visible before a dispute arrives.
4. A check of the use of resources is not a check of the content of mail
Section 316 of the Labour Code is short, but it matters precisely by the distinction of layers. Paragraph 1 aims at the use of the employer’s resources. An employee must not, without consent, use work resources for personal need and the employer may reasonably check this rule.[1] That is the basis for a check of whether company equipment is being misused.
Paragraph 2 is another level. It forbids the employer, without a serious reason consisting in the special nature of his activity, from interfering with an employee’s privacy at the workplace and in common spaces by open or covert surveillance, by tapping of calls, by a check of electronic mail or of letter consignments.[1]
Paragraph 3 then says that if a serious reason under paragraph 2 is given at the employer, the employee must be directly informed of the scope of the check and the manners of its carrying out.[1] A directive is therefore not a magic word. It must say what is checked, how and why.
It does not follow that an employer may never check an electronic trail. It follows that a reasonable check of the use of resources and a check of the content of messages are not the same interference. The first asks whether and for how long. The second asks what exactly was written.
5. Metadata are not content
Metadata are not insignificant. They show who communicated, when, through which service, with what length or volume. With the web they can show a visited domain and a time. With e-mail they can show a sender, an addressee, a subject, a time or a size. All of that can be sensitive.
Content is something else. The body of an e-mail, an attachment, the text of a private message or a recording of a call interfere more deeply. The Supreme Court in judgment 21 Cdo 1771/2011 built precisely on the fact that the employer did not check the content of e-mails, SMS or MMS, but a listing of activities on the internet and time spent outside a work purpose.[6]
That is the practical strength of the word metadata. It does not excuse blanket surveillance. It helps to find a milder means. If an employer is dealing with whether an employee spends working time outside work, a listing of time and of categories can be less invasive than the opening of personal communication. If the employer is dealing with a leak of particular data, the question can move to content. But precisely then the demand for a reason, a scope and safeguards grows.
Metadata also show better when it is necessary to stop. If a listing is enough to confirm a breach of a rule, there is no reason to open the body of a message out of curiosity. If a listing is not enough, the next step must receive its own reasoning. This sequence is not a bureaucratic ornament. It is a way not to turn every problem into the deepest possible interference.
The example is plain. If the suspicion is of excessive private surfing, the body of an e-mail will usually not answer better than a work listing of web activity. If the suspicion is that a particular file has left an office or a firm, the mere number of visited pages may not suffice. The precision of the means should follow the precision of the reason. Not the other way around.
Metadata are not content. A listing of pages is not an opened mailbox.
— Jiný Kontext
6. A company address with a name is not a free vault. A private account is another thing
E-mail is not one type of space. A private Gmail or Seznam opened on a company computer is a different case from a work address jmeno@firma.cz. A functional address of the type info@firma.cz is still another. The expectation of privacy differs according to the purpose of the account, the designation, internal rules and information.
Expert literature citing the historical opinion of ÚOOÚ 2/2009 describes the difference between a private free-mail, a work address with a name and a functional mailbox. A private account has the strongest expectation of privacy. With a work address with a name a check of headers rather than of content is typically admitted. A functional address has a lower personal element.[10][11]
A reservation is needed here. The opinion of ÚOOÚ 2/2009 was not, as of September 2026, found on the website of ÚOOÚ as a current document in the dossier. It therefore cannot be treated as a binding living rule. It is a historical interpretation cited by literature. The valid framework needs to be built mainly on Section 316, the Charter, the GDPR, the ECtHR and Czech case-law.[1][3][8][4][7]
It is therefore not a free vault. Nor is it a company notice-board without privacy. It is a work tool in which a personal trail can lie. And the depth of the interference must match the reason.
7. Announced monitoring is not a hidden camera
Visible monitoring with a clear announcement and a hidden recording are not two versions of the same thing. They differ in the interference with an expectation of privacy. An employee who knows what is measured, when and why can adapt their behaviour and can defend themselves. A covert interference takes this possibility away.
The ECtHR in the matter López Ribalda and Others v. Spain assessed hidden cameras at supermarket checkouts. The Grand Chamber on 17. 10. 2019 by a ratio of 14 : 3 found no violation of Article 8 of the Convention. What mattered, however, was that it was a space open to the public, a reasoned suspicion of thefts, losses and a recording limited to 10 days in 2009.[5]
It does not follow that a hidden camera is generally in order at work. It follows that an extreme and narrow set of facts can stand before the ECtHR. Czech Section 316(2) expressly ranks covert surveillance among interferences that must not occur without a serious reason consisting in the special nature of the activity, and paragraph 3 requires information about the scope and manner of the check.[1]
The practical distinction is simple. A checkout open to the public is not a changing room. A visible camera with a pictogram is not a hidden camera. A short check after losses is not blanket surveillance for certainty.
8. Consent in an employment contract is not free consent
In labour law consent easily changes into a stamp. An employee signs a contract, an annex or a directive because they want work or want to keep it. That is precisely why WP29 in opinion 2/2017 on the processing of data at the workplace stresses the inequality of the parties and caution in using consent as a legal title.[9]
The GDPR requires for the processing of personal data a legal title, a purpose, transparency and minimisation.[8] With an employer it is usually more appropriate to think of a legal duty or a legitimate interest, if the conditions are met. A mere “I agree to all monitoring” is weak, because the employee may not have a real choice.
That does not mean that an employee should not receive information. On the contrary. Information is distinct from consent. The employer should describe what is processed, why, for how long, who has access to it and how the employee can defend themselves. With interferences under Section 316(2) the Labour Code moreover works with direct information about the scope and manner of the check.[1]
The short sentence is therefore: consent is not a covering sheet. If a check would not stand without consent, an employee’s signature will usually not save it.
9. Bărbulescu is not a ban on a company IT audit. It is six criteria
Bărbulescu v. Romania is often used as a hammer. One side says: the ECtHR forbade employers to read messages. The other says: the employee used a company account, so they lost. Neither shortcut matches the judgment of the Grand Chamber of 5. 9. 2017, which by a ratio of 11 : 6 found a violation of Article 8 of the Convention because the domestic courts did not sufficiently verify the protection of the employee against arbitrariness.[4]
What matters is the test. The ECtHR formulated questions around prior information, the scope of monitoring, a legitimate reason, the possibility of using less invasive means, the consequences for the employee and safeguards against abuse. The Supreme Administrative Court in 2026 summarised this test in point [27] and applied it to the Czech facts.[7]
What needs to be tested
The test is not done over a sentence in a directive. It is done over a particular interference. Was the employee informed in advance of the nature and scope of the monitoring? Was the interference limited in subject and time? Was there a legitimate reason? Would a milder means have sufficed? To what was the result used? Were there safeguards against arbitrariness?
It does not follow that an IT audit is forbidden. It follows that its depth must be borne. An audit of accesses after a leak of data is different from a blanket reading of the mailboxes of all employees. A listing of metadata is different from the opening of the body of a message.
10. López Ribalda did not legalise changing rooms
The judgment López Ribalda is well cited badly. Yes, the ECtHR in it admitted a hidden camera recording without prior information. But it was supermarket checkouts, a suspicion of thefts, losses, a space open to the public and a recording lasting 10 days in 2009.[5]
Precisely the details hold the result together. If we remove them, there remains no rule “hidden cameras are permitted”. There remains only a convenient phrase. A changing room, a toilet, a rest room or an office kitchenette have a different intensity of privacy than a checkout where an employee works in front of customers.
The Czech regime is moreover not only a copy of Article 8 of the Convention. The Labour Code in Section 316(2) expressly speaks of open and covert surveillance and binds them to a serious reason in the special nature of the employer’s activity.[1] Labour inspection can assess a work regime even when someone argues with a European judgment.
It is not a ban on cameras. It is a demand for place, purpose, visibility, scope, information and a period of retention.
11. Hardware can be the employer’s. Personal data in a log are subject to the GDPR
Ownership of a computer deals with property. The GDPR deals with personal data. These regimes meet, but they do not merge. An employer can own a laptop and at the same time be the controller of data in a log, an e-mail header, a camera recording or an export from a security tool.[8]
A controller under the GDPR determines the purposes and means of processing. They must have a legal title under Article 6, observe the principles under Article 5 and inform under Article 13.[8] Act No. 110/2019 Sb. supplements the Czech framework of the processing of personal data.[15] With deeper or systematic interferences an impact assessment can also come into consideration if the conditions of Article 35 GDPR are met.[8]
The practical error is the sentence: “It is our computer, so we can do as we like with the data.” No. It is our computer, so we can protect property and organise work. If personal data about an employee arise in that, purpose, minimisation, transparency and access rights enter the game.
The Charter of Fundamental Rights of the EU protects private and family life and the protection of personal data in Articles 7 and 8.[21] The Czech Charter in Article 13 protects the secrecy of messages submitted by telephone, telegraph or another similar device.[3] Company ownership does not switch these layers off.
The GDPR at the same time forces an employer to describe even apparently technical details in human language. A log is not only a line in a system. It is a datum about a particular person, their working day, sometimes about their contacts and habits. A camera recording is not only a security image. It is a record of movement and behaviour. An e-mail header is not only an operational mark. It can show a relation, a time and a direction of communication. That is why it is not enough for the IT department to know the rule. It must be intelligible also to the person whom it concerns.
That has an operational consequence. An employer should be able to show which data are collected automatically, which only upon an incident and which must not be opened without a special approval. Otherwise the access of a controller becomes the informal power of an administrator. The law does not assess only a technical possibility, but also a purpose and the safeguards that have been set.
12. The Supreme Administrative Court bore three days after a leak. It would not bear a blanket reading for certainty
The judgment of the Supreme Administrative Court 6 Ads 21/2026-27 matters precisely because it admitted a check of the content of work mail within particular limits. It was a service relationship, a particular leak of personal data, one civil servant of ČÚZK, a time window 2.–4. 1. 2024 and information by an internal regulation and by a message at login.[7]
Commentaries on the judgment stress that the Supreme Administrative Court assessed a narrow interference after an incident and that employers should not infer from it a free licence for a preventive reading of mail.[19][22] That is the right reading. The judgment is more a map of conditions than a permit.
The Supreme Administrative Court applied the Bărbulescu test and assessed among other things the reason, the scope, the information and the use of the results.[7] If an employer read all mailboxes every month for certainty, precisely what the judgment holds would be missing: a particular incident, a limited time, a limited circle of persons and a connection with the protection of data.
It does not follow that the content of mail is always inviolable. It follows that the opening of content is a late and narrow tool. First come prevention, permissions, training, a technical restriction, headers, an audit of accesses and other milder paths.
The judgment is useful for an employee as well. It does not tell them that a work mailbox is a private diary. It tells them that even a service mailbox is not a space without rules. If an employee is informed in advance, works in a service account and a particular suspicion of a leak of data arises, their expectation of privacy can be narrower. If, however, an employer lets blanket surveillance run without a clear reason, without a scope and without a check of use, the resemblance to the Supreme Administrative Court disappears.
13. A camera in an office with a kitchenette is not a camera at a checkout
The Regional Court in Ostrava in judgment 22 Ad 11/2023-29 dealt with a fine of CZK 28,000 for cameras in an office with a kitchenette without a serious reason.[18] The figure is a fine in one court matter, not an average price for a badly set camera system. More important than the amount is the distinction of space.
A supermarket checkout is a place where an employee works in front of a customer and where property losses are dealt with. An office kitchenette is a back room. A changing room and a toilet are still more sensitive. To transfer a conclusion from one space into another without this layer is a methodological error.
The ÚOOÚ methodology on camera systems works with information and the requirements of the GDPR as a guide for a controller.[14] It is not a substitute for the Labour Code. It does, however, help to put practical questions: why a camera exists, what it covers, how long a recording is kept, who can see it, whether there is a pictogram and where an employee finds a second level of information.
A camera is therefore always also a spatial question. The same device can have a different legal meaning according to where it points.
14. A ceiling of a fine is not an average of imposed fines
The law works with ceilings. The media often make from them an expected fine. That is an error. The Labour Inspection Act in Section 24a sets for an interference with an employee’s privacy under defined facts an upper rate of up to CZK 1,000,000 and for a failure to inform about a check under Section 316(3) an upper rate of up to CZK 100,000.[13]
The GDPR has its own sanction regime. For selected breaches under Article 83(5) the upper limit can be up to EUR 20,000,000 or 4% of total worldwide annual turnover, whichever value is higher.[8] That is a ceiling of an administrative fine in the European regime, not an automatic fine for one work e-mail.
These figures need to be read with a unit, a period and a regime. They are upper rates in legal provisions valid according to the dossier as of 2026. They do not measure an average of imposed sanctions. They do not measure the probability of a check. They do not measure reputational harm or the costs of a dispute.
The sense of the ceilings is different. They show that monitoring is not only an internal IT setting. It can change into a labour-law and data matter with responsibility before two types of authority: labour inspection and ÚOOÚ.
15. A result may serve only the purpose of the check
The lawfulness of obtaining is one question. The use of the result is a second. An employer can have a reason to check access to data after an incident. That does not yet mean that the content of communication may circulate in the firm, end in an unlimited folder or be used for a purpose that is not connected with the original reason.
The GDPR stands on the principle of purpose limitation and of minimisation.[8] If a log is collected for a security incident, it should be used to resolve the incident. If a camera protects property, it should not become a tool of permanent evaluation of every movement, unless there is a separate reason and information for that.
The Supreme Administrative Court in judgment 6 Ads 21/2026-27 also assessed that the results of the check were not used for another purpose.[7] That is not a formality. Precisely the purpose holds the interference within limits. Once the result is used outside the original frame, the assessment of proportionality changes as well.
The practical rule is: before collection it must be clear where the result will go. Who will see it, how long it will be retained, whether it will end in a disciplinary file, whether it will be handed to a lawyer and when it will be deleted. Without that a check is only an open drawer.
16. A checklist before an interference will say more than the sentence it is our computer
A good check does not begin with the installation of a tool. It begins with a description of the interference. What exactly do we want to find out? Which incident or risk are we dealing with? Which data suffice for that? Which legal regime switches on? Who will read the result?
Three tests of the depth of an interference
The first test is the object. Is company hardware being checked, a company account, a private account opened on a company computer, or a private telephone? Each object carries a different expectation of privacy.
The second test is content. Are time and URL being captured, a mail header, the body of an e-mail, an image, sound or a GPS location? If it is the content of a message, tapping or covert surveillance, we enter the stricter regime of Section 316(2).[1]
The third test is the reason. Is it a particular leak, a property loss or a security incident, or only prevention without a boundary? Bărbulescu and the Supreme Administrative Court require more than a general possibility that something might happen.[4][7]
Before introducing monitoring
An employer should have a written and intelligible notice of the scope and manner of the check if they introduce a check under Section 316(2).[1] Beside that they must, under the GDPR, inform about the processing of personal data, the purpose, the legal title, the recipients and the rights of the data subject.[8]
How to test whether a milder means suffices
First there offer themselves a block of categories of websites, a restriction of permissions, a log of headers, training, two-person approval, an audit of accesses or a check of only a few days. Only when a milder path does not suffice for the protection of a particular interest does it make sense to think of content. And even then only in a narrow window.
Whoever has a doubt deals with two addresses. A regional labour inspectorate assesses the labour-law side. ÚOOÚ assesses personal data. Fulfilment of one layer does not automatically excuse a breach of the other.[2][8]
A checklist has one more advantage. It forces the end of the interference to be written. When will the monitoring end? When will the recording be deleted? Who will confirm that the purpose has been fulfilled or has fallen away? Without an end even a reasonable check easily changes into a permanent infrastructure. And a permanent infrastructure then looks for new reasons for itself.
The practice of ÚOOÚ shows that these questions are not only training for lawyers. The authority’s inspection materials work with attendance, GPS, cameras and Section 316(2) as with an ordinary boundary between the management of work and an interference with privacy.[20] The earlier a firm draws this boundary, the less it later has to explain why it crossed it.
17. The hidden cost is privacy that a directive only enumerated
An internal directive often creates a feeling of a finished thing. The employee has confirmed that they can be monitored. The IT tool is running. HR knows where to find a listing. A lawyer has a paragraph on the protection of property. But the real interference does not take place in the sentence of the directive. It takes place in what is collected, for how long, with whom, in which space, after which reason and who reads it.
A directive should therefore be more a map than a shield. It should tell an employee what they can expect, and set brakes for the employer. If it only enumerates all possible interferences, but does not separate an ordinary operational log from the opening of content, it helps neither side. The employee does not know what privacy really remains. The employer does not know when they are crossing their own rule.
The hidden cost is therefore not only a loss of trust. It is also imprecision. A firm that does not distinguish metadata from content will use too strong a tool on a weak problem. A firm that swaps a checkout for a kitchenette will transfer a foreign judgment into another space. A firm that builds on consent in a contract will overlook the inequality of the parties. A firm that makes from NSS 2026 a blanket rule will overlook three days, one employee and a particular leak.
It does not follow that an employer is defenceless. It follows that the protection of work, property and data needs a precise depth. Sometimes a ban on private use and a reasonable listing suffice. Sometimes an audit is necessary. Sometimes in a narrow matter even the content of work mail can come. But every time we ask whether the interference can bear a reason, information, proportionality and a milder path.
At the moment when an employer buys a laptop, they buy a work resource. At the moment when they watch what a person does on it, they enter privacy and personal data. And then the question is no longer: “Is it our computer?”
It is: how deep does the interference reach — and why precisely so deep?
Related texts in this series
- May the police search your mobile phone? — another title, another filter. A company IT audit is not a criminal inspection.
- What does your mobile phone know about you? — layers of a device versus a work account.