An employer has the right to direct and allocate work and thus is able to restrict employees’ use of Internet and social media during work hours. However, practically, this depends on the type of work that is being performed.
Furthermore, an employer with a legitimate aim to supervise communications of the employee, may be allowed to do so as far as the employee has been informed of it beforehand and the supervision is not excessive in regard to the employee’s right to privacy.
As far as confidential information is concerned the Act on Trade Secrets is of relevance. A trade secret is defined as information concerning the business or industrial relations of a person conducting business or industrial activities which that person wants to keep secret and the divulgation of which would be likely to cause a damage from the point of view of competition. An employee who wilfully or through negligence attacks a trade secret of an employer, of which he or she has been informed in the course of the employment, shall compensate the employer for the damage caused by the attack. However, only under such circumstances that the employee understood, or ought to have understood, that he or she was not allowed to acquire, use or disclose it, shall the employee be liable for damages caused by the action.
Moreover, the employee may, by use of social media, act in breach of his or her employment contract, e.g. the duty of loyalty. Depending on the circumstances at hand, the employee may be dismissed for disloyal behaviour. Though, the employee may have certain rights to criticise the employer when grievance is at hand.
Data privacy
The General Data Protection Regulation provides protection for individuals against violation of their personal integrity by processing of personal data. Accordingly, there are restrictions on employers’ use of data regarding employees, former employees and applicants. According to the Regulation, any form of processing of personal data must be lawful. Employers may often rely on the performance of the employment contract or a legitimate interest when processing personal data relating to the employee. The processing must be relevant and necessary for the purpose stipulated and personal data may not be stored for longer than necessary with reference to the specified purposes. Furthermore, the legitimate interest of the employer may not be outweighed by the employee’s interest of personal integrity.
The Regulation also stipulates situations in which personal data may be processed in cases where the individual has not given his or her consent to the processing. For example, personal data may be processed in order to satisfy a purpose that concerns a legal obligation of the employer.
Sensitive personal data – for example, information about employees’ or applicants’ race or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or personal data concerning health or sexual preference – may only be processed in special circumstances.
