EUROITCOUNSEL QUESTIONNAIRE ON INTERNET AND MONITORING RESTRICTIONS ACROSS EUROPE SPAIN

Transcription

1 EUROITCOUNSEL QUESTIONNAIRE ON INTERNET AND MONITORING RESTRICTIONS ACROSS EUROPE Factual background SPAIN 1. Is it usual for employers to provide a corporate account to their employees? Are there any statistics on the on-line work force in your jurisdiction? Spanish companies often provide their employees with corporate accounts (especially the so-called big companies that provide their employees with corporate accounts in 90% of all cases). The worldwide online workforce is estimated at 100 million people. The Spanish online workforce is estimated at 4 million people. 2. What is the public opinion in your country regarding the employer s right of inspection? Do people believe in the right to the privacy of communications above all, or do they sympathise with the position of the employer? The vast majority of the Spanish population place the respect of privacy of communications above most other values. 91% of employees believe to be entitled to use their corporate mail for personal ends with moderation though, and 72% of employees believe that employers have no legal title to inspect their electronic mail. 3. What are the usual monitoring methods used by employers (e.g., random checks, opening of s, individualised and/or aggregate monitoring, filters)? Spanish employers supervise the use of the Internet facilities in 45% of all cases. Only 24% of all employers supervise the use of electronic mail. The supervision rates appear to rise with the turnover of the company; the larger the company, the more the employers supervise their employees. The most common supervising methods used by Spanish companies are: - Filters: Nearly half of the Spanish companies have some kind of filter for preventing workers to enter particular web sites. - Random Checks: Regarding the use of the Internet: Whilst 22% of Spanish companies only supervise specific workers that are suspected of misusing the corporate Internet facilities, 14% of employers make indiscriminate

2 - 2 - supervisions. Entertainment, music and shopping web sites constitute approximately 25% of the Internet traffic of Spanish companies. Regarding the use of electronic mail: The abovementioned percentages are only 18% and 7% respectively when is concerned. A recent study by DOMEUS, an marketing company, shows that 74% of Spanish employees use electronic mail for personal ends. A study by Veritas Software revealed that 40 % of Spanish employers from big companies use electronic mail to communicate with their employees (dismissal notices included). - Opening of s: This practice is quite common, despite the fact that whatever information is found during these searches would normally be not acceptable as legally obtained evidence in trial. An address, an s subject or even the number of bytes it contains can be inspected by the employer, but not the s content. If a Spanish employer wishes to inspect the content of an electronic mail, he will have to comply with the applicable legal requirements: reasonable grounds, a notification to both the employee and the labour union, and the presence of at least one representative of the latter during the inspection (these are the same requirements as set out in Article 18 of the Labour Law for the inspection of employees lockers). Unless all above requirements are met, the inspection of the contents of s would be considered as a violation of the employee s privacy. - Monitoring: Nearly half of the large companies in Spain monitor their employees activities. Applicable legislation 4. Does your jurisdiction have specific legislation for Internet and/or monitoring? If so, what are the rules and what do they provide for? In the absence of specific legislation, what is the legal regime applicable to Internet and monitoring? There is no specific legislation as yet. In the absence of such specific legislation, the following rules apply: - The Spanish Constitution: Article 18.3 of the Spanish Constitution guarantees the privacy of communications. More in particular, this article protects the confidentiality of postal, telegraphic and telephone messages. Moreover, paragraph 4 of the same article establishes that the law should limit the use of technology in order to guarantee the citizen s honour and privacy.

3 The Spanish Labour Law: The Spanish Labour Law clearly mentions (Article 54.2.d) as a cause of dismissal for breach of contract the violation of the contractual good faith, the abuse of trust [ ] and the decrease in efficiency on the performance of the activities. Privacy is described as a fundamental right for workers in this Law. Nonetheless, Article 18 of the same Law states that employee s lockers can be inspected if necessary for the protection of corporate resources or the safety of others workers. Moreover, Article 20 allows employers to supervise employees, provided they adopt the most suitable supervising measures. - Spanish Penal Code: Article 197 of the Spanish Penal Code on the discovery and revealing of secrets, states that (1.) Who discovers the secrets or violates the privacy of another person, takes possession of electronic mail messages or intercepts his or her telecommunications or uses technical devices for recording or reproducing sound or images, will be punished by imprisonment between one and four years plus a fine of between twelve and twenty-four months (*) ; (2.) The same punishment will apply to any individual who, without authorisation, seizes, uses or modifies such data, recorded on computer, electronic or telematic files or media, or in any type of file or record. (*) (These fines are of a monetary kind and they are imposed on a day-fine basis. The daily fee value may go between 1,20 to 300,5 per day, depending on the offence in question.) - Spanish Law 15/1999 on Data Protection: Article 4 of the Spanish Law on Data Protection prohibits the collection of data through fraudulent, disloyal or illicit means. 5. Does your jurisdiction limit the type of monitoring that can be carried out by employers? If so, when is monitoring authorised and what is the scope of this monitoring (e.g., corporate s, web-based accounts)? The employer is in principle entitled to monitor corporate accounts, as they are a corporate resource. The legality of the monitoring measures will depend to a large extent on the way in which the inspection is carried out. Personal accounts are banned from inspection under all circumstances. 6. Do employers have particular obligations towards employees upon the implementation of a monitoring system (e.g., information to the workers representatives)? Employers should inform their employees of the existence of a control or surveillance system (as per Article 5 of the Spanish Law on Data Protection). Nevertheless, the best preventive measure is the existence of clear and known policies.

4 - 4 - Data Protection issues 7. Are there any guidelines issued by your data protection authority regarding Internet and monitoring? No. The Data Protection Agency ( Agencia de Protección de Datos - ) has not issued any guidelines yet. Nonetheless, the Agency has a consulting service that provides advice on issues relating to data protection, including Internet and monitoring. 8. In your jurisdiction, is it necessary for employers to file a declaration with the relevant data protection authority prior to the implementation of Internet and monitoring? Employers do not have to file a declaration with the relevant data protection authority, unless the data of the employees concerned is of a personal kind and is about to be processed. In Spain, employers may supervise or establish some method of control on the use of the corporate telephone without any prior permission or prior declaration thereon (as well as supervising the number or type of s received) provided the employer does not quote the contents of the conversations or messages in and out. Employer s guidelines 9. In your jurisdiction, is it common for employers to develop policies and/or guidelines regulating the use of the Internet and/or s? If so, what is the content of these guidelines and what are the penalties in case of violation? Nearly 80% of large Spanish companies have developed policies regulating the use of the Internet and electronic mail, though only half of these policies comply with the legal requirements to become enforceable. For small companies, this percentage is significantly lower. Productivity and legal and security reasons are the most common reasons for employers to establish such policies and supervise their implementation. Some of these guidelines prohibit the use of Internet and , others partially restrict their use and still others leave the employees completely free to use the Internet and . (see the chart below). FORBIDDEN PARTIALLY FREE RESTRICTED INTERNET USE 37% 32% 12% USE 38% 29% 14% Although no official standard guidelines exist, the following provisions are likely to be included as a general rule:

5 - 5 - accepted and forbidden types of use; amount of the personal use allowed; types of supervision; how private information is managed; penalties for non-observance of the rules set out in the policies. If the guidelines are fully enforceable, infringement of the provisions set out therein might be a sufficient ground for immediate dismissal. Nonetheless, only 2% of all companies admitted to having dismissed employees on these particular grounds. Spanish employers are far more likely to impose financial sanctions for infringements of the guidelines to date. One out of ten employees has been financially sanctioned by his employer for infringement of guidelines on and Internet use. No financial sanctions exceeding EUR were reported. Another common sanction is the withdrawal of the Internet and privileges. 10. Is it possible, in your jurisdiction, to provide that the violation of any policies and/or guidelines is a cause for immediate dismissal? The infringement of well-known, written and enforceable corporate guidelines may constitute sufficient legal grounds for a dismissal. By a way of example, Judgement of Superior Court of Cataluña issued on November 14, 2000 (Deutsche Bank case), revoked a former lower Court decision and awarded fair dismissal on the grounds of infringement by the worker of already known corporate policies prohibiting the abuse of the Internet and corporate facilities for personal purposes. It is expected that in the very near future one fifth of Spanish workers might well fall within such infringements. Case-law 11. Is there any relevant case-law in your jurisdiction? What redress is usually awarded and how do courts generally strike the balance between employers and employees rights? In Spain, Deutsche Bank was the first company to dismiss an employee for misusing corporate account for personal ends and during office hours. On a first decision, the Court declared the dismissal null and void, but on appeal this decision was quashed and the dismissal was eventually upheld. Nonetheless, the Spanish case law on the matter is not uniform. There is no established doctrine in this field, so it is hard to predict how Courts would strike the balance between workers and employers rights. Sentence of the Superior Court of Justice of Madrid of 13 November 2001: A dismissal was upheld on the basis of personal and inappropriate use of the Internet facilities. The Court clearly stated that computers constituted work tools and were therefore liable to be inspected.

6 - 6 - The key issue in this particular case turned out to be the particular requirements of the job, which made the constant presence and full attention of the worker essential. Sentence of the Superior Court of Justice of Madrid of 30 October 2001: A dismissal was upheld on the grounds of use of the corporate electronic mail for personal purposes and during working hours. Two particular factors led to that decision: a) the fact that the company had warned the employees in writing about an inspection weeks in advance, and b) there was evidence of misconduct of the worker other than misuse of the electronic mail. Sentence of the Superior Court of Justice of Madrid of 4 December 2001: The dismissal was not upheld on the grounds that although the employee received 47 electronic mails, he only replied to three of them over a period of eight months. The Court held that the employee could not avoid receiving those electronic mails and he only made moderate use of the corporate facility by replying to only three of those s. This particular attitude only constituted a minor offence and did not constitute sufficient grounds for an immediate dismissal. 12. Do the courts in your jurisdiction consider that the use of the IT system of the employer for personal purposes is a sufficient ground for immediate dismissal? As stated above, under Spanish Labour Law the lack of discipline, the insubordination, the violation of contractual good faith, the abuse of trust and the decrease in efficiency of work performance (Article 54.2), are sufficient grounds for immediate fair dismissal. The use by the worker of employer s IT system may be sufficient grounds for fair dismissal provided they fall within misuse or breach of contractual good faith. Therefore, the personal use of the corporate IT system is not by itself sufficient grounds for fair dismissal. To sum up, personal use of the Internet or might lead to an immediate fair dismissal provided such use can be construed as misuse or breach of contractual good faith obligations. Developments 13. Are there any known possible future developments (e.g., draft legislation with respect to Internet and monitoring)? Specific legislation on and Internet monitoring needs to be enacted and official guidelines and/or policies need to be issued. Whilst workers want more privacy they turn a deaf ear to their duties. The key issue here might not be the inviolability of correspondence but the non-observance of contractual duties and the principle of good faith. There is no clear indication on future developments for the time being. * All statistics are taken from the e-business Center PwC&IESE ( ** Statistics may vary depending on the size of the companies and the number of employees referred to above.