Email and internet access at the workplace raise the issue of how the employer can monitor their use and limit their use for non-business purposes. The employer has a legitimate interest in maintaining control over employee internet use in order to:

• limit the use to work-related activities only and thus avoid a decrease in employee productivity;
• ensure the security of the IT infrastructure by banning certain activities and identifying the source of security breaches;
• avoid a waste of IT resources.

The monitoring and/or restriction of employees’ internet use is not only an issue under the FADP but also under labour laws and is not addressed in detail here. For reference, see the information and guidelines by the FDPIC.

Swiss labour law prohibits the use of monitoring devices for the sole purpose of monitoring the behaviour of employees at the workplace but allows the use of such devices for other purposes, if necessary, provided the health and liberty of employees is not compromised.

Systematic monitoring of an individual employee's internet use is prohibited. However, the monitoring of internet use through means that do not identify specific employees is allowed to ensure compliance with internal requirements (e.g., the acceptable use according to policies), provided that employees have been informed. Anonymous monitoring may be carried out without informing employees. Monitoring using pseudonyms, i.e., with the possibility to identify the authors of abusive usage, may only be used if employees have been notified in advance of its potential use.

Any monitoring needs to be performed in accordance with a monitoring policy which specifies, e.g., who is in charge of the monitoring, what is monitored, who will be notified if an abuse is identified and what the consequences of such abuse are.

In practice, it often makes sense to establish a single policy which combines an acceptable use policy and a monitoring policy.

The restrictions applicable to the monitoring of internet use also apply to the monitoring of employee emails. While email monitoring is not entirely restricted and considering that email may be considered work products, it must be conducted in a manner that balances the employer’s legitimate interests with the employee’s right to privacy, in particular where the employee is allowed to use their email account for private purposes as well.