The digital era raises a fundamental question: Where does a worker's right to privacy end and where does a company's legitimate interest in protecting its data, know-how and assets begin? A recent resolution by the Supreme Court of the Czech Republic provides important clarification on how far an employer can go when controlling employees using company computers and IT resources.
When an employee misuses company facilities for his own business
The subject of the court proceedings was the case of an employee who, during the duration of his employment, developed his own business activity in the same field as his employer. Without the company's knowledge, he provided services to its regular client, using the company's internal documents for this activity. He subsequently stored this information on private cloud and external storage connected to his work laptop. By doing so, he fulfilled signs of conflict of interest according to § 304 Labor Code a compromised the employer's trade secrets.
At the same time, he systematically violated internal IT regulations – he bypassed cybersecurity, used the administrator password to install unauthorized software and gained access to unauthorized network folders. Because he continued to engage in this behavior despite repeated warnings, the employer immediately terminated his employment relationship for a particularly gross breach of duties. The district and regional courts dismissed the employee’s lawsuit for the invalidity of the dismissal. The Supreme Court subsequently addressed in particular whether the inspection of the company laptop was permissible in the given situation.
Employee privacy versus corporate data protection
The judges had to resolve the conflict between two protected values – the employee’s right to privacy (guaranteed by the European Convention on Human Rights and the Charter of Fundamental Rights and Freedoms) and the company’s right to protect its property and IT systems. Although the employee is perceived as the weaker party to the contract, the labor code strictly prohibits him from abusing company technology for personal needsOn the contrary, the employer has the right to adequately monitor compliance with this prohibition.
The Supreme Court therefore emphasized the necessary distinction between by checking how the device is used a by checking the content of the communication. In addition, the inspection involves the processing of personal data in accordance with the GDPR. For example, checking whether private storage is being connected, whether data is being leaked or whether security software is being bypassed is permissible if the legal conditions are met. On the other hand, for example, reading private emails or documents is an inadmissible interference with the confidentiality of correspondence, which cannot be validly waived even by formal consent.
The employer is therefore obliged to act reasonably a in accordance with clearly set internal rules. Correctly setting the rules for using company IT equipment and company addresses is an extremely important part of the labor law documents that our law firm prepares for clients.If the rules are set correctly, the employer can effectively and appropriately control the computer technology and protect its rights throughout the duration of the employment relationship.
When is an inspection permissible and why the employer succeeded
In the case under review, the employer detected suspicious data flows indicating information leakage during standard network maintenance. In response, it checked the company laptop.
The Supreme Court found that such a procedure was completely in accordance with the law. The intervention was not aimed at discovering the content of private messages, but at protecting the integrity of the systems. The decision fully corresponds to established domestic case law and the case law of the European Court of Human Rights.
The court also confirmed that the systematic, conscious violation of IT security in combination with competitive activity reaches the intensity of a particularly gross violation of work duties, which fully justifies the immediate termination of the employment relationship.
Summary for practice
The Supreme Court's decision sends a clear signal to both sides. It confirms to companies that they can protect your data and technology, if it does in accordance with the law, adequately a without inadmissible interference with privacyCorrect and transparent setting of rules and familiarizing employees with them, whether in internal guidelines or employment contracts, is a key prerequisite for an employer to succeed in a potential lawsuit based on monitoring.
It then shows employees that misuse of company funds and hidden competitive activities can have a major impact on their employment relationship. Control by the company is therefore possible if it is purposeful, lawful and does not cover the protected content of private correspondence..
On this topic pro e15 expressed our lawyer and partner JUDr. Ing. Jan Vych.
The correct setting of rules for the use of company IT equipment and company addresses is an extremely important part of the labor law documents that our law firm prepares for clients. Do you need to prepare them too? Contact us!
