An employer processes a lot of data about its employees. It also has the right to check how work is done. The rules on privacy in the workplace are therefore one of the most important areas.
What the Labour Code says
§ 316 of the Labour Code provides:
- Employees must not, without the employer's consent, use the employer's production and work equipment, including computers and telecommunications equipment, for personal purposes. The employer may check proportionately that this ban is observed (paragraph 1).
- The employer must not, without a serious reason arising from the special nature of its activity, interfere with the employee's privacy at workplaces and in shared areas. The law names open or covert surveillance, wiretapping and recording of telephone calls, checking of electronic mail and checking of postal items (paragraph 2).
- If there is a serious reason, the employer must inform the employee directly of the scope of the monitoring and the methods used (paragraph 3).
- The employer must not demand information that is not directly related to the performance of the work. The law names, for example, pregnancy, family and financial circumstances, sexual orientation, origin, membership of trade unions or political parties, church affiliation and a clean criminal record. For pregnancy, family and financial circumstances and a clean criminal record there is an exception: where there is a substantive reason arising from the nature of the work and the requirement is proportionate, or where the law provides so. The employer must not demand the other information listed. It must not obtain it through third parties either (paragraph 4).
What this means for e-mail and the internet
If the employer bans private use of work e-mail and the internet, it may check proportionately that the ban is observed. It should do so as gently as possible. For example, it should first look at the volume and type of traffic rather than read the content of messages. If it allows private use, checking the content interferes with privacy and must meet the conditions of § 316(2) and (3) and of the GDPR. The rules must be clear and communicated in advance, ideally in an internal policy.
Cameras
A camera system in the workplace processes personal data. The employer needs a lawful basis (usually legitimate interest, for example protecting property), may monitor only what is necessary, must inform people (signs, information for employees) and must set a short retention period for recordings. Cameras do not belong where people rightly do not expect to be watched and where no work is done, for example in toilets or changing rooms. The guidelines of the European Data Protection Board (EDPB) on video devices state that in toilets people's privacy outweighs the controller's interest. Permanent monitoring of employees at work also requires a serious reason under § 316(2).
Informing employees
Employees have the right to know what data about them is processed, for what purpose, for how long and to whom it is passed on (Article 13 GDPR). The employer usually meets this duty with information for employees, which you receive when you start work or find on the intranet.
The rodné číslo
The rodné číslo (the Czech personal identification number) is a special identifier. It may be used only under the conditions of § 13c of the Act on the Population Register (Act No. 133/2000 Sb.), that is only:
- in the activities of ministries, other administrative authorities, bodies entrusted with the exercise of state administration and courts, within their statutory competence
- when a special law provides for it
- when it is necessary to enforce private-law claims or to prevent unpaid debts and the controller has taken specific safeguards
- with the consent of the holder of the number or their legal representative
Any combination of date of birth and ending from which a person can be identified also counts as a rodné číslo. Whoever handles another person's rodné číslo without authorisation commits an offence punishable by a fine of up to CZK 100,000 (§ 17d). An employer knows the rodné číslo of its employees mainly because laws impose duties on it towards the social security administration and health insurance companies. That does not mean it may demand or write out the rodné číslo for everything. It has no place on an attendance sheet, in a list of training participants or on an internal noticeboard.
The same applies to copies of identity cards and other documents. They may be made only where the law allows it or with consent, and not "just in case".
Private devices and social networks
An employer generally must not check your private phone or your own social network accounts. It must not ask you for the login details of your private accounts. On the other hand, it does have access to work accounts and company devices.
What to remember
- § 316 of the Labour Code protects the employee's privacy; checks must be proportionate and communicated in advance.
- Monitoring employees requires a serious reason and informing them.
- Cameras do not belong in toilets or changing rooms.
- The rodné číslo is used only under § 13c of the Act on the Population Register.