The judgement highlights the balancing of "respect for his private life, on the one hand, and his employer’s right to take measures in order to ensure the smooth running of the company, on the other".
While it is fair to expect that one "follows the rules", breach should not imply that your private life is something that the employer can do with what they wish, Especially, as the court decision notes, when the risks (e.g. damage and liability) are theoretical.
Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private?
It seems that the judgement is less about the monitoring and notification thereof, but whether or not you have an expectation for private things to remain private at work.
> Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private?
I think that any expectation of privacy when using work resources to communicate is unreasonable — IOW, I believe it's illogical to expect that the company will not be aware of the fact that one has communicated.
The question of whether the company may use the contents of such messages for its own purposes is a bit trickier, and I can see arguments in either direction. The best course of action is don't use an employer's resources for private purposes; then one cannot go astray.
It's important to note that a lot of these privacy rules from a time when mobile phones and computers were not common. As such, pretty much the only way to contact an employee inside a workplace (for medical, personal, family, etc.) reasons was via company owned equipment. If your wife had to tell you she has cancer, she HAD to use the company equipment. As such, the stance was that it's resonable that workers can expect privacy even when phoning their family between breaks with company hardware. This is important to prevent employers abusing this information to gain leverage over workers (and if I recall, even in USA certain information is protected).
And this is STILL the case in many industries - you're not allowed to carry your phone with you on a factory floor, so when something important happens, your personal communication MUST go through company owned equipment. In those cases, ensuring that employers don't needlessly invade employee privacy is rather reasonable.
Remember, most of the world's workers aren't rockstar developers sitting in an office with their phones in the pocket.
> I think that any expectation of privacy when using work resources to communicate is unreasonable
I assume this must be depend on the society, as I have a very strong expectation in the contrary. I already mentioned this in another thread; here the employer may never read e-mail contents, and reading metadata requires very specific legal steps to be taken.
A spam filter is usually a computer program. As far as I know, they are never employers. If your company's "spam filter" tells your employer what your sexual orientation is, whether you or your wife are picking the kids up from school, or when you're looking for a new job, I suggest you stop calling it a "spam filter" and start looking for a better job.
It is like saying because Google mail goes through the text of the mail to guess whether a message is spam, it no longer matters that they don't use the contents of the message for targeted ads. This is clearly not true assuming Google keeps the spam training data and the ad serving days separate. Am I missing something?
They aren't equivalent. But they are both examples of processing data about a person. The GDPR doesn't say anything about advertising vs. security and network management purposes.
Is it useful to compare a similar situation in the analog world? If the email addressed to you@yourcompany.com was a letter addressed to your company, attn: you what would the expectations of privacy be? Are the 2 situations even legally comparable?
> ...whether or not you have an expectation for private things to remain private at work
Or to frame that question another way, if you have an expectation of privacy when you have taken no steps to ensure it and other privacy-protecting options abound. To extend your example, your wife could simply email your work address to say "you've got mail".
While it is fair to expect that one "follows the rules", breach should not imply that your private life is something that the employer can do with what they wish, Especially, as the court decision notes, when the risks (e.g. damage and liability) are theoretical.
Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private?
It seems that the judgement is less about the monitoring and notification thereof, but whether or not you have an expectation for private things to remain private at work.