Monitoring employees’ digital tools and social media can reveal misconduct that may justify a disciplinary sanction, or even dismissal. However, the monitoring must have been carried out properly, and the information gathered must then be usable as evidence to justify a sanction or dismissal.
Any monitoring involving personal data must comply with the GDPR. Employees must therefore be informed in advance of the possibility of monitoring, its purposes and its main terms.
The employer must define a specific purpose and an appropriate legal basis. Monitoring may be justified by the employer’s legitimate interests, in particular where misconduct or breaches are suspected. The monitoring must nevertheless remain as targeted as possible in light of its purpose. With regard to the monitoring of electronic communications specifically, Collective Bargaining Agreement (CBA) No. 81 reinforces the aforementioned obligations of transparency, purpose limitation and proportionality.
For example, rather than going through an employee’s entire mailbox, the employer should limit its search to a specific period and to keywords related to the suspected facts. E-mails clearly marked as “private” must always be excluded.
On social media, regularly monitoring employees’ profiles without a specific reason is out of the question. A public social media profile does not mean the employer may freely use its content. Any monitoring must have a specific reason and remain proportionate.
Checking whether the monitoring constitutes private investigation
An internal investigation aimed at establishing facts alleged against an employee, in particular by monitoring e-mails and social media, may fall within the scope of the Act of 18 May 2024 regulating private investigation. This Act then imposes various requirements, notably regarding how the investigation is organised, the collection and processing of information, the documentation of the investigation and the rights of the person concerned.
Compliance with these rules is essential, as any breach may directly affect the possibility of using the information gathered as evidence. Some evidence obtained during the investigation could be declared null and void. It could then not be used by the employer to prove the facts justifying a sanction or dismissal. Before monitoring an employee’s e-mails or social media as part of an internal investigation, it is therefore crucial to ensure that the applicable legal framework is complied with.
Follow-up to the monitoring
Once the information has been gathered through monitoring, possibly supplemented by other evidence obtained during an internal investigation, the employer must determine whether the established facts justify a warning, an ordinary dismissal or, in the most serious cases, a dismissal for serious cause. This decision must be taken in compliance with the rules and time limits applicable to the measure envisaged.
It should also be borne in mind that the burden of proving the facts on which the decision is based lies with the employer. The employer must be able to produce evidence that is sufficiently precise, reliable and, in principle, lawfully obtained to establish that the alleged breaches actually occurred. The way in which the information was gathered is therefore decisive in order to effectively defend the sanction or dismissal if it is challenged.
Monitoring, yes, but not just any way
Monitoring digital tools and social media can be a valuable source of information for detecting and establishing certain misconduct or breaches, and thus for supporting a sanction or dismissal. However, such monitoring must be carried out in compliance with the applicable rules. Otherwise, the use of the evidence gathered may be compromised. Caution is therefore required, both in how the monitoring is carried out and in how the information obtained is used.
By Thierry Duquesne, Partner | Avocat NautaDutilh and Alix de la Barre, Associate | Avocate NautaDutilh