As society becomes increasingly data-driven, the question of who owns the data kept on a work device is often raised.
The introduction of the General Data Protection Regulation (‘GDPR’) in May 2018 raised many questions, not least whether a work email address should be regarded as personal data. The answer to this is that a work email address and the contents of any emails sent from a work account can be personal data as it allows an individual to be identified. This means that the GDPR will apply.
The perception of many will be that personal emails sent from work email accounts are ‘personal’ and as such employers have no entitlement to look at them. However, whilst employees are entitled to a degree of privacy at work, employers are, in certain circumstances, able to monitor and read an employee’s emails, whether or not they are work related. Employers do, however, need to have a valid legal basis for doing so to comply with the GDPR and the UK’s Data Protection Act 2018, and must also inform employees about its monitoring activities, including telling them why the monitoring is carried out, how the information will be used and who the information will be disclosed to (if anyone). Employers will often have policies setting out these details and this may also include specifying requirements for sending personal emails at work. For example, this might include always using the title ‘personal’ as the subject heading or marking the email as private in the settings.
If employees do want to use their work email accounts to send personal emails, they should do so with caution. They should consider whether they would want the content of their email read by their employer, make sure they comply with any policies relating to personal emails at work and ultimately, if there are any concerns about an employer reading an email, send it from a private email account instead.
If you would like any further advice, please contact Emma Loveday-Hill.
Emma Loveday-Hill
Senior Associate
Data Protection Team
