When the Protection of Personal Information Act (POPIA) came into effect on 1 July 2021, there were some areas of possible dispute that could arise between employers and employees, including the monitoring of employee’s work emails.

In South Africa, the right to privacy, especially in the workplace, isn’t as absolute as you might think. It is almost impossible to conduct business in any sector without the use of electronic devices and therefore, many employers will provide staff with either electronic devices and/or access to email and internet facilities to conduct business in an orderly and effective manner. 

But, why is there such a big interest in what employees are writing in their emails? Part of it is to avoid legal liability. An email creates an electronic footprint that employers may have to hand over if they are sued. 

Which is why many contracts between employee and employer include clauses pertaining to the monitoring and interception of communication on any devices used for work purposes. 

In most instances, these clauses state that all telecommunication within the workplace must promote the business’ objectives and can only be used for business purposes.

Furthermore, these clauses will also include that the employer has the right to intercept or monitor any communication at any time on any work devices. 

Considering the employees right to privacy, the Regulation of Interception of Communications and Provision of Communication-Related Information Act, 70 of 2002, which applies to direct oral communications and to indirect communications such as the telephone, voicemail, e-mail, the internet and an internal mail system, prohibits the interception of employees’ communications except in certain circumstances:

• Essentially any communication may be intercepted by anyone who is a party to the communication, unless the purpose of the interception is to commit a criminal offense, or with the written consent of a party to the communication.
• Any communication may also be intercepted in the course of carrying on any business if it relates to that business; or if it takes place in the course of carrying on that business, as long as it is done with the consent of the telecommunication system controller who is usually the chief executive officer or a duly authorized officer of the employer.
• In addition, a communication may be intercepted if the purpose of the interception is either to establish the existence of facts; to investigate or detect unauthorized use of the telecommunication system; to secure the effective operation of the telecommunication system; or to monitor calls to confidential telephone counseling or support services.

What this means is that before your employer can justify intercepting its employees’ communications, there must be a valid business rationale to do so.

In terms of POPIA, the following will apply when it comes to your employer monitoring your work emails:

• An employer who processes the personal information of an employee must do so fairly and without negatively impacting the rights of the data subject.
• Ideally, personal information should be processed with the data subject’s consent. Absent consent, there are other grounds that an employer can also rely on in order to process personal information, including where the processing is necessary for pursuing the legitimate interests of the responsible party, in this case the employer, or of a third party to whom the information is supplied.
• To comply with POPIA, employers should ensure that any clause in an employment contract allowing for the monitoring and interception of communications on the employer’s devices, or using the employer’s telecommunication systems, also clearly explains the purpose for such monitoring and interception. An employer may monitor and intercept communications on a company device and, if the employee is using their device, communications sent and/or received using the employer’s telecommunication systems. The reason for this is that these devices and/or systems are provided by the employer to enable the employee to perform their duties and to assist the employer to meet its legal, business, administrative and management obligations. This would constitute a legitimate reason for processing. If such a clause was inserted into a contract of employment, an employer could use the argument raised in the Turkish Constitutional Court to justify the processing of information because the employee would have been notified of the reason and the purpose for such processing.
• An employer may only use personal information obtained from the employer’s devices or systems to ensure compliance with its obligations and not for any other purpose. An employee will be provided with an opportunity to object to the use of his/her personal information during an investigation and/or disciplinary process thereby ensuring compliance with the openness and data participation condition.

Source

In order to avoid any legal issues which could arise from the monitoring of your emails, it is important to keep your telecommunications at work strictly for business purposes. Use the devices your employer provides you to only conduct business. Avoid using any internal communications systems like e-mail, the internet, landlines or internal communication systems to conduct or attend to any personal matters, and also avoid logging into your personal email from any work device. 

Need assistance from an employment attorney? Our attorneys have offices in Randburg, Centurion and Emalahleni. Talk to us today.