Can the employer fully access employee data according to EU law?
<p>The computers at the company I work for recently show the message below during log on.</p>

<blockquote>
  <p>This computer system is the property of Company. It is for authorised
  use only. <strong>All activities conducted on and information accessed,
  processed, stored or sent using this system may be examined.</strong> By using
  this system, all users aknowledge notice of, and agree to comply with,
  the Company IT Acceptable Use standard. Unauthorised or improver use
  of this system may result in disciplinary action. By continuing to use
  this system you indicate your awareness of and consent to these terms
  and conditions of use. Log off immediately if you do not agree to the
  condictions stated in this warning.</p>
</blockquote>

<p>Is the statement legal according to European regulations?</p>

<p>Besides, it is my work computer, it is not that I have an option not to log on.</p>

<hr>

<p><a href="https://law.stackexchange.com/q/45090/27839">Related question for Norway</a></p>

<p>The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities).</p>

<p>According to <a href="https://www.insideprivacy.com/uncategorized/european-court-rules-that-employers-can-monitor-employee-private-communications/" rel="nofollow noreferrer">this ruling of the ECtHR</a>, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be:</p>

<ul>
<li>for <strong>legitimate purposes</strong> ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"),</li>
<li><strong>proportionate</strong> ("it was the only possible way available"), and</li>
<li><strong>communicated to the employee</strong> (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy).</li>
</ul>

<p>In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as <a href="https://law.stackexchange.com/questions/45056/can-the-employer-fully-access-employee-data-according-to-eu-law#comment85106_45057">Esa Jokinen already commented</a>: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably <em>cannot</em> ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where <a href="https://www.cooleygo.com/gdpr-a-guide-for-employers/" rel="nofollow noreferrer">this article</a> mentions "The GDPR states", I think they are referring to <a href="https://gdpr-info.eu/recitals/no-43/" rel="nofollow noreferrer">recital 43</a>).</p>

<p>No. That is not presented correctly. Generally, the employer must store and process the data that it actually needs for something in the employer-employee relationship.
They are not generally allowed to store private information.</p>

<p>That content must be presented to all uses in writing and they must sign for taking notice of it. Also, they must be offered the option not to consent.</p>

<p>To make this 100% legal, the employer must formulate something like:</p>

<ul>
<li>Employees are not allowed to use the computers for private purposes.</li>
<li>Limited exception to the above use: if you want to use it in limited manner for private matter (like checking private e-mail, etc) then you must agree to being monitored as specified (like it's specified in your text) and sign a consent.</li>
</ul>

<p>Then the user must sign the consent which should contain among others:</p>

<p>"I am giving you this consent for the Limited Exception under IT&amp;C Policy, which is for the personal use of the internet to the extent of access to the internet websites and internet search subject to the IT&amp;C Policy and giving this consent for [CompanyNameHere] to process, record and store the data relating to such personal use under Limited Exception." "I hereby give my consent:" <em>followed by Name, Date, Signature.</em> </p>

privacy