MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
What is an email and internet protocol? It is an internal regulation in which you establish how employees may use business email and the internet, and under what conditions the employer may monitor that usage. The protocol provides clarity regarding private use, what is permitted, and the limits of monitoring. Without such a regulation, as an employer, you run into privacy rules, because monitoring employees infringes upon their fundamental right to privacy (Article 8 ECHR) and falls under the GDPR. A good protocol enables monitoring within the legal framework.
The short answer
- What: an internal code of conduct regarding the use and monitoring of email and the internet at work.
- Objective: clarity and a valid basis to be allowed to monitor use.
- Who: employer and employees; the Works Council has the right of consent.
- Legal framework: GDPR, Article 8 ECHR (privacy) and Article 27 WOR (Works Council consent).
- Core: upfront transparency regarding what is permitted and how checks are carried out.
What is an email and internet protocol and why do you need it?
Employees use email and the internet every day. Mostly for business, sometimes for personal use. As an employer, you have an interest in monitoring: security, protection of company data, prevention of misuse, and compliance with internal rules. However, monitoring employees is not unrestricted. It infringes upon their right to privacy and confidential communication. An email and internet protocol resolves this by clarifying in advance what is permitted, what private use is accepted, and under what conditions the employer may monitor.
The core is transparency. The GDPR (Article 5) requires that the processing of personal data be fair and transparent. If you monitor employees without them knowing in advance that and how this is being done, that monitoring is almost always unlawful. The protocol fulfills this duty to inform and simultaneously establishes the ground rules that both parties must adhere to.
What does the protocol regulate?
An email and internet protocol typically contains the following components:
- Permitted use: what is allowed for business purposes and to what extent is private use permitted.
- Prohibited use: for example, illegal downloads, discriminatory or offensive content, and the sharing of trade secrets.
- Control: whether, when and how the employer monitors use and who is authorized to do so.
- Purpose limitation: the purpose for which the check is carried out, for example security or investigation in the event of a concrete suspicion.
- Retention periods: how long log data is retained.
- Consequences: what measures follow in the event of a violation.
The limits of control
Monitoring is permitted, but within limits. The employer must have a legitimate interest (Article 6(1)(f) GDPR), and the monitoring must be necessary and proportionate. This means: no structural, all-encompassing monitoring if a less restrictive measure suffices. Targeted monitoring based on a concrete suspicion is permitted rather than permanent monitoring. The European Court of Human Rights has ruled in its case law that employees must be informed in advance of the nature and extent of the monitoring, and that the infringement on their privacy must be proportionate to the objective.
Good employership (Article 7:611 of the Dutch Civil Code) also applies. An employer who secretly and without cause searches through employees' private communications acts in violation of that standard, even if there appears to be a formal basis.
The role of the works council
An email and internet protocol is typically an employee tracking system or a regulation concerning the processing of employee data. The Works Council has the right of consent for this pursuant to Article 27 of the Works Councils Act (WOR). Without the consent of the Works Council, such a regulation is not legally validly implemented. If your company does not have a Works Council, this right of consent does not apply, but the GDPR requirements and the standard of good employership remain fully applicable.
A practical example: an SME suspects that an employee is emailing sensitive business information to his private address. Because the company has an email and internet protocol that allows for targeted checks in the event of a concrete suspicion, and the Works Council has agreed to this, the company is permitted to investigate the business mailbox under certain conditions. Without the protocol, that same monitoring would almost certainly have been unlawful.
Honest recommendation
You do not always need a lawyer. If you are a small employer with no need for control and a brief house rule regarding normal use suffices, a simple document will suffice. However, if you require actual inspection, process sensitive data, or have a works council, legal support is advisable. The combination of the GDPR, Article 8 of the ECHR, and the right of consent under Article 27 of the Works Councils Act means that an incorrect protocol is worthless in practice: inspection based on an invalid protocol will not stand up in court.
Want to know more? View the Email and Internet Protocol, read about drafting the Email and Internet Protocol and about having the Email and Internet Protocol drafted.
Frequently Asked Questions
An internal policy in which you stipulate how employees may use business email and the internet, and under what conditions the employer may monitor that usage. It provides clarity and forms the legal basis for monitoring.
Yes, but within limits. The employer must have a legitimate interest (Article 6 GDPR), the monitoring must be necessary and proportionate, and employees must be informed in advance. Targeted monitoring based on a concrete suspicion is permitted more readily than permanent monitoring.
Yes. An email and internet protocol affects personnel tracking systems and the processing of personnel data, for which the Works Council has the right of consent pursuant to Article 27 of the Works Councils Act (WOR). Without consent, the regulation has not been validly implemented.
A complete ban is difficult to enforce and not always realistic. It is more common to allow limited private use under clear conditions. Whatever you choose, record it in the protocol to avoid any misunderstanding.
In that case, the employer lacks a valid basis to conduct checks. Checks without prior transparency violate the GDPR and good employment practices (Article 7:611 of the Dutch Civil Code) and usually do not stand up in court.
Yes. If you do not have a Works Council, the right of consent under Article 27 of the Works Councils Act does not apply, but the GDPR and the standard of good employership remain fully applicable. A protocol is still required to be permitted to conduct inspections.
Not always. For a small employer with no need for control, a short house rule suffices. If you really want to be able to monitor, process sensitive data, or have a Works Council, legal support is advisable because an incorrect protocol is worthless.
