Can employers monitor their employees’ social media posts?

Increasingly, employers are being made aware of employee misconduct that is evidenced by photos, videos or other social media posts. What are employers allowed to do when it comes to their employees‘ posts, what are the limits, what should they bear in mind when using these posts? Here we consider the situation in Germany, with comments from our experts in 19 other jurisdictions.

Employee posts as a source of information

Posts by employees on social media can be interesting for employers in several situations. It may be that an employee reports to their employer that a colleague who is supposedly ill is on a party holiday in Majorca, or that the employer fears being defamed, or that internal company information could be published. In all these cases, the employee’s profile could provide information. But what exactly is an employer in Germany allowed to do?

As a rule, monitoring is not allowed

Systematic monitoring of all of an employee’s posts will generally be impermissible, regardless of the type of social media platform (i.e. whether professional or ‘private’). After all, this is a processing of personal data within the meaning of the German General Data Protection Regulation (GGDPR), which is only allowed in certain defined circumstances. The fact that the employee’s posts are publicly accessible on the internet does not change this. There is no indication in the relevant laws that a different level of protection, deviating from the usual requirements, applies to such data. The fact that the personal data is publicly accessible can at most strengthen the interests of the employer processing the data, but it does not remove the protection the data subject has under the law.

In the context of an employment relationship, the authorisation in section 26(1) of the Federal Data Protection Act has often been used. This allows employees’ personal data to be processed for the purposes of the employment relationship if this is necessary for the implementation or termination of the employment relationship. According to the case law of the Federal Labour Court, the employer may, taking into account the principle of proportionality, store and use all data that it requires to meet its burden of proof in a potential dismissal protection case. However, in view of a decision of the CJEU on a comparable standard, employers should, in future, orient themselves to article 6(1) of the GGDPR. In many cases, this provides a sufficient legal basis for data processing if it is necessary for the performance of the employment relationship or is in the legitimate interest of the employer.

The systematic monitoring of social media posts by employees cannot be justified by any of the above-mentioned norms. This is because the interests of the employee outweigh the interests of the employer in any case within the framework of the balancing of interests. The employee has the fundamental right to informational self-determination, and a legitimate interest in being able to post outside of work time without hindrance and without being controlled by the employer. Otherwise, there would be permanent monitoring pressure even outside the workplace. Monitoring of this kind would is comparable to an investigation ‘out of the blue’ or without notice. According to relevant case law, this is not allowed.

Event-related viewing is allowed in some cases

It is possible to view individual posts for specific reasons. If the employer suspects that an employee may have violated their contractual obligations, perhaps based on information provided by another employee, an analysis of individual posts will usually be permissible. The processing of personal data is then permissible under article 6(1) of the GGDPR, because it is likely to be in the legitimate interest of the employer. Conceivable measures that could be taken after reviewing individual posts include the issuing of a warning or termination.

The processing of personal data is also proportionate in the case of an occasion-related review of individual posts. On the one hand, the employee concerned has a stronger interest in his or her right to informational self-determination concerning the publication of their post. On the other hand, the assessment expressed in article 9(2)(e) of the GGDPR also makes it clear that the legislator does not consider the data subject to be in particular need of protection with regard to these kinds of publications.

The duty to inform the employee

In addition to the question of the lawfulness of data processing, employers should also note that there may be a duty to inform the employee concerned. Article 14 of the GGDPR provides for a duty to inform on the part of the data processor who collects personal data from third parties. This also applies to the processing of personal data from publicly accessible sources. Exceptions to the duty to inform are provided for in article 14(5) GGDPR. Depending on the case, an exception may be considered due to the impossibility or disproportionate nature of the provision of information or due to the impairment of any civil law claims. Here, a precise examination of the individual case is necessary, and it may be prudent to seek legal advice.

Using (unlawfully obtained) findings

The employer can use the knowledge gained from the review of the social media posts as evidence. Even if the review and evaluation of the posts was not permitted, the knowledge gained can generally be used in court proceedings. Neither the German Code of Civil Procedure nor the German Labor Court Act, the Federal Data Protection Act or the GGDPR contain provisions that limit the usability of illegally obtained knowledge. The Federal Labour Court has held that the right to be heard and the principle of the free assessment of evidence by the courts require that the employer’s submissions and the evidence offered, even if obtained unlawfully, be taken into consideration. This information could only be excluded from consideration if its use would violate the employee’s fundamental rights, in particular the general right of personality (‘Persönlichkeitsrecht’).

The message for employers

In order to prove an employee’s breach of contract and to be prepared for a possible dismissal dispute, the evaluation of an employee’s social media posts can be a useful tool. It is important that employers always keep the proportionality of the evaluation in mind and limit themselves to individual posts. It is advisable to document the reasons for and the scope of the screening as well as the evaluation of the contributions, in order to be able to demonstrate the permissibility of the data processing later.