In the Age of Surveillance, the Law Still Demands Restraint

Let’s set the scene. You’re an employer. You suspect one of your employees of leaking confidential information. Naturally, your first instinct is to check their business mailbox, after all, it’s your server, your domain, your liability. But here’s the catch: in the Netherlands, "ownership" doesn’t give you carte blanche to read business emails at will.

European law, Dutch courts, and privacy regulators have made it clear: a company inbox is not a free-for-all. Misjudging this can sabotage your legal standing, trigger privacy claims, and even render your evidence unusable in court.

This isn’t about formality. It’s about power, trust, and boundaries. When you cross the line, even with good intentions, the law won’t be on your side.

The Legal Tightrope: Article 8 ECHR Meets the GDPR

Under Article 8 of the European Convention on Human Rights, employees have a right to respect for their private life, even at work. Yes, even in their business mailbox. And because reading someone’s email qualifies as personal data processing, the GDPR applies too. That means: purpose limitation, proportionality, necessity, transparency.

Dutch courts look at six critical factors, grounded in the Bărbulescu v. Romania judgment. Ignore them, and you’re setting yourself up for legal disaster:

1. Was the employee informed in advance about the possibility of mailbox inspection?
2. Was the inspection proportionate to the suspected issue?
3. Did the employer have legitimate grounds for the search?
4. Were less intrusive alternatives considered first?
5. What were the consequences for the employee?
6. Were there safeguards to protect the employee’s privacy?

This isn’t a checkbox exercise. Judges want evidence that you thought about all six. If you didn’t? The mailbox becomes a legal minefield.

Case Law: The Difference Between Justified and Unlawful Access

Dutch jurisprudence offers two revealing examples:

• In one case, the District Court of Midden-Nederland sided with the employer. Why? Because the company had informed the employee in advance, kept the inspection limited, and faced a situation of inaccessibility that warranted it.
• In another case, the same court refused a dismissal. The employer hadn’t disclosed their motives, didn’t document their reasoning, and couldn’t prove any legitimate interest. Result? The entire mailbox search backfired.

That’s how fine the line is. Transparency and procedural discipline can make or break your case.

How to Stay Compliant (Without Losing Control)

If you're dealing with potential employee misconduct, here’s how to avoid crossing into unlawful territory, without tying your hands behind your back.

1. Policy First, Action Later

Have a written, GDPR-proof policy in place that explains what is and isn’t allowed regarding email, internet, and phone use. This must also cover the conditions under which monitoring may occur. And don’t forget: your Works Council has the right of consent here.

Make sure every employee acknowledges and signs this policy. That signature is your first line of defence.

2. Perform a Privacy Impact Assessment Before You Access Anything

You need to balance your legitimate interest against the employee’s privacy rights and document that assessment. Ask yourself:

• Is the suspicion specific and credible?
• Can the issue be addressed without reading emails?
• Can private content be avoided?

If you can’t justify the access in writing, don’t do it.

3. Keep It Surgical

If you proceed, limit the scope and duration. Avoid reading private correspondence. Better yet: let employees classify personal emails in a separate folder. If no such folder exists, don’t pretend that all business inbox content is automatically fair game.

One Reckless Click Can Undo a Legitimate Dismissal

Here’s what’s at stake if you get it wrong:

• The court may disregard your evidence entirely.
• You could be forced to pay damages or a higher dismissal fee.
• The employee might report you to the Dutch Data Protection Authority.
• Your internal credibility could take a hit—especially if you’re trying to build a culture of trust.

Final Word: Reading Emails Is Not a Shortcut to Truth

Suspicion does not suspend rights. Even when you believe an employee has breached your trust, your investigation must still respect the rules. That’s not bureaucracy, that’s strategy.