Letter to Attorney

Dear Attorney,

I am writing to seek clarification regarding an issue of concern in our company. Specifically, I would like to know whether the email account assigned to an employee can be subjected to investigation or accessed by the company if there is suspicion of sensitive information related to company operations being sent out. The employee in question has signed a Non-Disclosure Agreement (NDA) with the company.

I would appreciate it if you could provide detailed guidance on the legal framework governing such scenarios, particularly in the context of Philippine law. Could you also elaborate on the rights and responsibilities of the employer and employee in relation to the use of company-provided email accounts, the extent of the NDA's applicability, and the conditions under which an employer may lawfully access an employee’s email account for investigation?

Your expert advice on this matter will be greatly valued.

Sincerely,
A Concerned Employer

Legal Perspective: Investigation of Employee Emails in the Context of Philippine Law

Under Philippine law, several principles govern the use of company email systems, the rights and duties of employers and employees, and the implications of NDAs. The central concern revolves around balancing the employer's legitimate interests in safeguarding its operations against the employee's constitutional and statutory rights to privacy. Here, we explore the key considerations in detail.

1. Employer’s Ownership of the Email System

Philippine law recognizes that an employer has property rights over the tools and systems it provides to its employees, including email accounts. This principle is rooted in the Civil Code of the Philippines, which affirms the property rights of owners over their possessions (Article 428). Thus, a company-provided email account is generally deemed part of the employer’s property.

Because of this ownership, employers have a legitimate interest in ensuring that their email systems are used properly and securely. This includes the right to investigate misuse, particularly if there is reasonable suspicion that the account is being used to leak sensitive or confidential information.

2. The Right to Privacy of Employees

While the employer has ownership of the email system, this does not negate the employee’s right to privacy. The 1987 Philippine Constitution explicitly protects privacy under Article III, Section 3, stating that "the privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise as prescribed by law."

Additionally, Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA), provides robust protection for personal information. It applies to employers who process employee data, including monitoring email accounts. Employers must ensure compliance with the DPA, which requires that data processing be legitimate, proportional, and transparent.

The tension between the employer’s ownership and the employee’s privacy creates a legal balancing act. An employer must tread carefully to ensure that any actions to investigate or monitor employee emails are lawful and justified.

3. Applicability of the Non-Disclosure Agreement (NDA)

The NDA plays a critical role in safeguarding sensitive company information. By signing an NDA, the employee agrees not to disclose or misuse confidential information obtained during their employment. Violations of the NDA, such as transmitting sensitive information to unauthorized parties, may result in both civil and criminal liability under applicable laws, such as:

Article 19 and Article 20 of the Civil Code: These establish liability for acts contrary to morals, good customs, or public policy.
Article 22 of the Civil Code: This addresses unjust enrichment.
Republic Act No. 8293 (Intellectual Property Code): For confidential intellectual property.
Revised Penal Code: For crimes like theft or unauthorized access to company data.

However, the NDA itself does not grant the employer carte blanche to access employee emails. Any investigation must still comply with legal standards, including respecting privacy rights.

4. Legitimacy of Monitoring and Investigations

a. Company Policies

Employers should establish clear policies regarding the use of company email accounts. These policies should state:

That the email system is the property of the company.
That the company reserves the right to monitor or access email communications for legitimate purposes.
That employees should have no expectation of privacy when using company-provided tools.

b. Consent

Explicit consent is a cornerstone of lawful monitoring under the Data Privacy Act. When employees are informed through company policies or contracts that their email accounts may be monitored, this constitutes consent. Employers must ensure that such policies are communicated clearly and acknowledged by the employee.

c. Reasonable Grounds

Employers must demonstrate reasonable grounds for suspicion before accessing an employee's email. For instance, if there is evidence of unusual activity, such as large file transfers to unknown recipients, this may justify an investigation.

d. Proportionality

The investigation should be proportional to the suspected offense. Broad or intrusive monitoring without a clear basis may be considered excessive and could result in liability under the Data Privacy Act.

e. Confidentiality of Findings

Any information obtained during the investigation must be handled with the utmost confidentiality. Unauthorized disclosure could lead to liability for the employer under both the DPA and other applicable laws.

5. Process for Accessing Employee Emails

a. Internal Procedure

Employers should follow an established protocol when accessing employee emails. This includes obtaining approval from higher management or a compliance officer and documenting the reasons for the investigation.

b. Involvement of Legal Counsel

Engaging legal counsel ensures that the investigation complies with all applicable laws and mitigates the risk of potential claims from the employee.

c. Notification to the Employee

While prior notification is ideal, it may not always be feasible in cases where notifying the employee could compromise the investigation. In such cases, employers should provide a justification for the lack of notification if challenged.

6. Relevant Case Law and Precedents

Philippine jurisprudence offers limited direct guidance on this issue, but analogous cases provide useful insights:

In Pollo v. Constantino-David (G.R. No. 181881, October 18, 2011), the Supreme Court ruled on an employee’s expectation of privacy in relation to government-owned equipment. The Court held that while the employer owned the equipment, privacy rights were not automatically waived. Employers must demonstrate that their actions are lawful and justified.
Internationally, cases like City of Ontario v. Quon (U.S. Supreme Court, 2010) highlight similar principles, emphasizing the need for proportionality and legitimate grounds for investigations.

7. Potential Liabilities for Employers

Employers who unlawfully access or misuse employee data may face:

Data Privacy Violations:
- Fines ranging from ₱500,000 to ₱5,000,000 under the Data Privacy Act.
- Criminal liability for unauthorized access.
Civil Claims:
- Employees may sue for damages under Articles 19, 20, and 21 of the Civil Code for breaches of privacy or bad faith.
Labor Complaints:
- Employees may file complaints with the National Labor Relations Commission (NLRC) for unfair labor practices if the investigation leads to wrongful disciplinary action.

Conclusion

Under Philippine law, a company email account assigned to an employee may be accessed and investigated if there is reasonable suspicion of misuse, provided that the employer adheres to strict legal standards. These include establishing clear policies, securing employee consent, ensuring proportionality, and respecting privacy rights.

While the NDA reinforces the employee’s duty to maintain confidentiality, it does not supersede privacy laws. Employers must navigate this complex interplay with care to avoid potential liabilities. Consultation with legal counsel is recommended to ensure compliance and to balance the interests of both parties effectively.