Call me maybe

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

Nowadays most employers in the services sector provide their employees with an email account and a mobile phone/number for business use. However, if an employer requires an employee to provide it with their personal phone number or email address for work purposes, does this breach the employee's data protection and privacy rights?

This issue was considered recently in Spain by the National High Court in the case of an employer that required employees to sign up to a contractual provision entitling the employer to contact them on their personal phone number or via their personal email account. (An additional indirect effect of the provision was that it required employees to have privately owned electronic devices in order to be contactable by the employer.)

Unions argued that the requirement to agree to contact by the employer in this manner gave rise to a clear abuse of employees' right to privacy and potentially obliged employees to be available 24/7. The court, however, considered the contractual provision in the context of data protection rights and decided that it breached the Spanish Organic Law 15/1999 on personal data protection, in summary, because (i) power over the disclosure and control of personal data (which would include personal phone numbers and email addresses) should remain with the individual employee and (ii) the information required by the employer was not necessary for the performance of the employment contract.

As a result, the Spanish Court has identified an indirect way for employees to protect their privacy in the event that their employer exceeds its management power. In every case, however, a balance will need to be struck between the rights of the employee and the needs of the employer, taking into account the extent of the consent required to be given by the employee and the particular circumstances.

In France, as a general principle, the law guarantees an employee's right to privacy in the workplace.

There is no statutory obligation on employees to communicate their personal phone number or email address to their employer. Such communication can only be made on a voluntary basis. There is no case law on the subject aside from one isolated case. In 2004, the Social Chamber of the French Supreme Court ruled that an ambulance driver could not be dismissed for gross misconduct for not answering his employer's phone calls on his personal mobile phone outside regular business hours.

In conclusion, employers in France may ask for an employee's personal phone number or email address, but cannot force them to give such information. A requirement to provide a personal email address could be challenged by an employee as it clearly does not relate to professional needs.

In Germany, the legal situation is very similar. There is no statutory obligation requiring the employee to provide their personal phone number or email address to their employer. In practice, however, is common to agree on such an obligation in the contract of employment with the employee being required to inform the employer of any relevant changes. Breach by the employee of this contractual obligation would not be considered to be of such gravity, however, that it could be regarded as misconduct justifying termination of employment and, in this regard, the employee's right to privacy would prevail.

In the UK, an unnecessary requirement for an employee to provide a personal mobile phone number or email address to an employer could potentially amount to unlawful processing of personal data in breach of data protection rights. Although an employee could agree to provide the required personal contact details to the employer, the Information Commissioner has indicated that the extent to which employee consent can be relied on by an employer is limited given that, in practice, such consent often cannot be said to be freely given. Further, once information such as a personal mobile phone number and email address is obtained, the employer will need to adhere to other data protection obligations including those relating to retention, security and disclosure.

An employee's right to privacy is a developing area in the UK and each case is likely to be fact specific and will depend on the reason why the employer requires the employee's personal mobile phone number/email address and, separately, the extent to which the employee is expected to be contactable by the employer outside working hours. An additional issue for employers requiring employees to be contactable outside normal working hours is whether this means that the employee is "on call", potentially giving rise to rights under working time and national minimum wage legislation.

In practice, an employer should consider whether provision of personal mobile phone numbers and email addresses is necessary for the performance of the employment contract - the Information Commissioner's Office Employment Practices Code recommends that employers should ensure that there is a clear and foreseeable need for any information collected from workers and that the information collected actually meets that need. Where such information is required, for example for contact outside normal working hours, employers should explain the reason for its retention and use.