Are you allowed to inspect your employees' emails?

When are you, as the employer, allowed to inspect employees’ emails? What regulations must you consider? In this blog, you will learn about the regulations that apply when the employer wants to inspect an employee’s emails.  

In what cases is it permittable to inspect employees’ emails? 

It is permittable for an employer to inspect employee’s emails and/or private files on the business data network: 

1. When the employer has reason to assume the email box contains the information necessary to ensure the continuity of business operations or to ensure other justifiable interests of the business. An example is when the employee is ill or absent over a longer period, and there is reason to believe the employee has received emails containing information important to business operations. 
2. When there is a justified suspicion of serious breaches of duties following the contract or when the employer suspects employees’ use of the email account can provide sufficient grounds for dismissal with or without notice. Examples are when the employer suspects the employee utilizes the email account for a criminal offense, such as downloading illegal material or harassing a co-worker.  

Assumptions are not adequate to permit an inspection, as in clause 2. There must be concrete information, such as a tip from co-workers.  

Note: Employees can always grant access to an inspection of emails.

Also read: Employee rights in Norway 

Inspection of employees’ personal area at the business computer network

Inspection of an employee’s emails is regulated according to the stipulation regarding inspection of email and other electronically stored material (Norwegian link). The stipulation applies to the email account the employer made available for the employee’s work-related use.  

The stipulation also regulates the employer’s request to inspect the employee’s personal area on the business computer network and other electronic equipment the employer makes available for employees’ work-related use. 

The employer may be permitted to inspect files the employee has deleted from these areas that are available through backup copies or other formats accessible to the employer.  

Note: The stipulation does not account for an inspection of equipment that belongs to the employee, even if the equipment is used for work-related matters.  

Also read: Norwegian employment contracts – do’s and don’ts 

Inspection procedure 

The employer must, as early as possible, notify the employee of the inspection, and the employee must be provided an opportunity to produce a statement before the employer conducts the inspection. In the notice, the employer must reason why the required conditions for an inspection are met and inform the employee of his or her rights. 

If possible, the employee should be present during the inspection. The employee is allowed assistance from an employee representative or another representative as he or she wishes. 

We recommend the employer to journal the inspection together with the employee to avoid disagreements at a later point. 

Inspection without notice 

If the employer performs an inspection without informing the employee in advance, the employee is entitled to a written notice as soon as possible. In addition to explaining why the conditions are met, the employer must explain: 

• The rights of the employee as stated in the stipulation 
• What the method of inspection was utilized 
• What emails or other documents were retrieved and inspected 
• The result of the inspection

Note: Inspections must be performed in a way that ensures the information, as far as possible, is not altered and can be re-examined. 

It is important that the employer notifies the employee at the first possible instance. 

Also read: The rules for working hours and overtime in Norway 

Deletion upon end of employment 

When employment ends, the employer must shut down the employee’s email account. Content not essential to the operation of the day-to-day business must be deleted within a reasonable period.  

The main regulation regarding the deletion of personal information as described in the GDPR art. 5 letter e, requiring personal data to be kept in a way making it impossible to identify the registered people for a longer period of time than what is necessary based on the purpose of processing the information.