Israel's National Labor Court Imposes Strict Limits on Employee Monitoring

Dan Or-Hof, a privacy and technology partner at the Israeli law firm Pearl Cohen Zedek Latzer is reporting that a decision by Israel's National Labor Court imposes severe restrictions on the employers' ability to monitor employee emails. Organizations with employees in Israel must promptly take steps to verify that their employee monitoring policies and practices in the country are consistent with the ruling.

In this particular case, the court considered whether an employer may access employees' email messages and submit them as evidence in the course of court proceedings brought by the employee against the employer. Typically, an employer may wish to present evidence obtained from an employee's email account in an effort to dismiss the employee's claim of unlawful termination. However, the "fruit of the poisonous tree" evidence rule under Israel's Privacy Protection Act prohibits submission of evidence obtained through invasion of privacy.

Chief Judge Nili Arad delivered the National Labor Court's opinion on two appeals from District Labor Courts that reached inconsistent decisions regarding an employer's right to monitor employee emails. In its decisions, the court set out the following principles that will govern employee monitoring in Israel:

• An employer must establish a balanced policy for use of the corporate IT and email systems. The employer must bring the policy to the attention of its employees and must incorporate the policy into the employees' employment contracts.

• A clear line should be drawn in the application of monitoring policies between an email account allocated by the employer to an employee and an employee private email account, such as a web-based email account.

• An employer may allocate accounts to employees and designate them as (i) professional purposes accounts (permitting only business communications); (ii) dual purpose accounts (for both personal and business purposes); or (iii) personal accounts (to be used for personal communications only). 

• If an employer makes its employees aware of the company's email monitoring policy, the employer may monitor professional purpose accounts. However, if an employee uses his or her "professional" mailbox for personal email communications (even in violation of company policy), the employer may access the personal messages in that account only subject to the employee's explicit, informed and freely given consent, and only if the contents of such personal messages are unlawful or abusive.

• An employer may monitor and access personal messages in dual purpose and personal accounts only when: (i) there are unusual circumstances that justify access to the messages; (ii) the employer first uses less invasive tools that reveal the monitored employee's misconduct; (iii) the employee gives explicit, informed and freely given consent to the corporate monitoring policy and, specifically, to the monitoring of or access to his personal (not work related) messages; or (iv) the employee provides specific consent to each access by the employer to the contents of personal messages in a dual purpose account, or specific consent for any surveillance activity by the employer that includes access to a personal account, and to personal content in such account.

• An employer may not monitor or access an employee's private web-based email account, even if the employee uses workplace IT system to access the account and even if the employee consented to such access. An employee's private account may be accessed only subject to an appropriate court order (which courts in Israel rarely grant).

Applying these principles, the court granted the employees' motion to suppress the evidence in both cases because the court found that the employers obtained the evidence while unlawfully invading the privacy of their employees.

Action item:  Employers that have employees in Israel should review and, as appropriate, revise their employee monitoring policies to comply with the requirements set forth in the ruling. Special attention should be given to corporate monitoring policies, employment contracts, adequate consent processes and harmonizing corporate information security systems and policies with the new pro-privacy legal framework.