06. Social Media and Data Privacy in Ireland

Restrictions in the Workplace

An employer can restrict an employee’s access on a workplace device to the internet and social media during work hours where the employer puts in place appropriate policies.

Can the employer monitor, access, review the employee’s electronic communications?

Blanket monitoring of employee’s electronic communications does not comply with Irish data protection law.  Employees enjoy a reasonable expectation of privacy at work.  Any monitoring of individuals must be limited in purpose and duration to comply with the GDPR principles of purpose limitation and data minimisation. Before it monitors its employees’ electronic communications, an employer must first establish the legal basis under Article 6(1) of the GDPR that it relies on to carry out such monitoring. An organisation should carry out a balancing exercise before conducting any monitoring which should form part of its data protection impact assessment because monitoring is a high-risk activity in data protection terms. A data protection impact assessment (DPIA) should ascertain whether the proposed monitoring can be justified as a proportionate measure and what impact the processing would have on the employee exercising their fundamental rights.

Employee’s Use of Social Media to Disparage the Employer or Divulge Confidential Information

There is no statutory law or relevant guidelines in place in Ireland relating to the divulging of confidential information by employees.  This issue is dealt with via the employment contract which typically includes an obligation on the employee not to disclose any confidential information belonging to its employer or a third party that the employee receives in the course of their employment.   Such a clause will also typically place a restriction on the employee’s use of such confidential information, for example prohibiting sharing any confidential information on social media unless the employer directly instructs / authorises the employee to do so.  If an employment contract does not contain a confidentiality clause expressly prohibiting the employee from disclosing the organisation’s confidential information,  the employer can instead rely on its rights under the common law tort of breach of confidence.  The remedies that are available for breach of confidence include injunctive relief, damages, delivery up and destruction.

In relation to any act prohibiting the employee from disparaging the employer, if such a prohibition is placed on an employee, it is typically as a contractual obligation under the employment contract or a policy to which the employee is subject.  A contractual or policy obligation may restrict the employee from posting negative opinions about their employer on social media where this is harmful to the reputation of the employer.  However, such a restriction must be balanced against the employee’s competing right to express their views. Article 40.6.1 of the Constitution of Ireland protects the rights of individuals to freely express their convictions and opinions. Since freedom of expression is protected as a fundamental right in the Constitution, an employer must balance the competing rights of an employee’s expression and its good name when limiting its employees’ right to use social media or any other media to express negative opinions about the employer. If such a restriction is included in an employment contract or policy, its terms should not be too broad so as to not infringe the employee’s right to expression and therefore be unenforceable.