Ажил олгогч таны WhatsApp мессежийг уншдаг: Голландын хуулиар юу зөвшөөрдөг вэ

Your employer may not simply read your WhatsApp messages, on a private phone or on a company phone. Reading them is only lawful as an exception: where there is a concrete, serious suspicion, no less intrusive way to investigate it, and a policy that told staff in advance what may be checked; a structural monitoring arrangement also needs the consent of the works council under Article 27(1)(l) of the Works Councils Act (Wet op de ondernemingsraden, WOR).

Messages are personal data, so the GDPR applies in full. Below we explain the legal framework, the difference between private and business messaging, the works council’s role and what you can do if the line has been crossed.

Which rules protect your messages at work?

Three layers of law apply at once: the right to private life, data protection law and employment law. Each one limits what an employer may do with your messages.

Article 8 of the European Convention on Human Rights (ECHR) protects private life and correspondence, also at work, and Article 10 of the Dutch Constitution (Grondwet) does the same. The European Court of Human Rights requires employers to inform staff in advance about the nature and extent of monitoring, and courts must weigh the employer’s reasons against the intrusion and the availability of less intrusive means.

The content of a message, the sender and recipient, and the time it was sent are all personal data. Reading them is processing under the GDPR, with its principles of purpose limitation, data minimisation and storage limitation. Our overview of мэдээллийн ерөнхий хамгаалалт эдгээр зарчмуудыг тодорхойлсон бөгөөд Голландын Мэдээлэл Хамгаалах Газар (Autoriteit Persoonsgegevens, AP) supervises them.

In employment law, the employer’s right to give instructions covers how work is done, not your private life. An employer that goes further and breaks into an account or device without permission may commit computer trespass (computervredebreuk) under Article 138ab of the Dutch Criminal Code (Sr), punishable by up to two years’ imprisonment.

On what legal basis may an employer read messages?

Every processing operation needs a lawful basis under Article 6 GDPR. In an employment relationship, that basis is almost never consent, so the employer must rely on a legitimate interest.

Consent must be freely given, and because you depend on your employer, refusing is rarely free of consequences. The AP and the European data protection authorities therefore treat consent as invalid for almost all workplace monitoring; a clause in your contract or IT policy does not change that.

A legitimate interest can be protecting company property and confidential information, investigating a concrete suspicion of fraud, complying with a statutory duty or securing the network. Curiosity, general distrust, checking productivity or wanting to know what staff say about management are not. The employer must record its assessment before monitoring starts. The AP sets out the conditions it applies to monitoring employees.

Шаардлагатай байдал, пропорциональ байдал ба дэд байдал

Even with a legitimate interest, reading messages must be necessary, proportionate and the least intrusive option. If interviewing the people involved, checking system logs or examining the transactions would answer the question, reading messages is unlawful, however incriminating the result.

A credible suspicion that an employee is selling the customer database justifies far more than a question about expense claims. In practice the employer must narrow the search beforehand: a limited date range, named participants, defined search terms and a rule that obviously private content is not read. Where monitoring is systematic and large-scale, a data protection impact assessment (DPIA) is required under Article 35 GDPR before it starts.

Ил тод байдал: бодлого нэн тэргүүнд тавигддаг

Monitoring that was never announced is almost always unlawful. The employer needs a written, accessible policy that says whether private use of company devices is allowed, what is logged and for how long, when content may be inspected, who decides and who carries out the check.

A policy that only reserves the right “to monitor everything at any time” is unlikely to hold up. It signals to the court that the employer never considered proportionality.

Ажлын зөвлөл санал нэгдэх шаардлагатай юу?

Yes, for the monitoring arrangement itself. Under Article 27(1)(k) and (l) WOR, the employer needs the works council’s (ondernemingsraad) consent for any arrangement on processing employees’ personal data and for any system that is intended for, or suitable for, monitoring attendance, behaviour or performance.

A works council is mandatory in an undertaking that normally employs at least 50 people (Article 2 WOR). If the council refuses consent, the employer can ask the subdistrict court (kantonrechter) for permission, which is only given if the refusal is unreasonable or the decision is required by compelling business reasons (Article 27(4) WOR).

Skipping this step has serious consequences. Under Article 27(5) WOR a decision taken without consent is void if the works council invokes the nullity in writing within one month after being informed of the decision or noticing that it is being applied.

Does it matter whose phone it is?

Less than employers think. What matters is the nature of the communication and what you could reasonably expect, although ownership affects what the employer can practically access.

Private phone

On your private phone, the employer has no right of access. It cannot require you to hand over or unlock the phone or install software without your agreement, and refusing is exercising a right, not obstructing an investigation. Access to material on a private device is only possible through criminal investigation powers or a court order.

Company phone

If private use is allowed, explicitly or in practice, you keep a reasonable expectation of privacy in private conversations on that phone. WhatsApp messages are end-to-end encrypted, so the employer cannot read them on the company network or wi-fi, but on a managed phone the IT department may see installed apps, backups or, with the phone in hand, the chat history. Legally, the employer may only look at what it needs for a defined and legitimate purpose.

Bring your own device and WhatsApp Web

If you use your own phone for work, the employer’s access should be limited to a separate managed work environment, such as the company mail account and work apps. Before installing mobile device management software, ask in writing what it can see, whether remote wiping affects private data and what happens when you leave. On a work computer, WhatsApp Web can be visible through screen monitoring or other IT tools.

Is business chat treated differently?

Yes. A message in a company WhatsApp group about a client, or in a workplace chat tool, is business communication on systems the employer controls, and in some sectors it must be kept for regulatory reasons.

The same GDPR principles still apply: a defined purpose, no more data than needed, transparency about what is logged and a rule for private matters that appear in work channels. Colleagues discussing a birthday present in a work group have not given up their private life, but keeping private conversations off work channels strengthens your position.

When may an employer look at messages?

Only after a concrete suspicion of serious misconduct, an investigation that starts with the least intrusive step, and a narrow, documented search. Covert monitoring, without telling you in advance, is only possible in exceptional cases, for a limited time, and you must be informed afterwards.

An example to illustrate: an employer suspects that an employee is passing client files to a competitor. A lawful investigation first examines which files were downloaded, when and from which account. Only if that does not answer the question may the employer define a limited period and channel on its own equipment, have a small group carry out the search and record its reasoning, and then hear the employee. Installing monitoring software on a whole department’s phones and reading months of conversations fails every test, even if it finds evidence.

Хамтран ажиллагч нь мессежийг дамжуулах үед

Usually the employer does not search at all: a colleague forwards a screenshot. The employer has then received information rather than accessed it, but from that moment it processes personal data and must still have a legitimate interest and limit its use to what that interest requires.

A recipient is generally free to pass on a message, so the argument that the employer obtained it unlawfully rarely succeeds. What you can argue is context: four messages from a long exchange give a partial picture. An employer that acts on a screenshot without asking for the full conversation and hearing you has not investigated properly.

Situations that often go wrong

• Sickness absence: checking messages or social media to test whether you are really ill means processing health data, which the employer may not do; questions about the illness belong with the company doctor.
• Suspected side activities: reading messages is almost never the least intrusive way to find out what someone does in their own time.
• An escalated conflict or reorganisation: searching communications for ammunition will be seen by the court as building a file, not investigating an incident.

Can unlawfully obtained messages be used against you?

Often, yes. In Dutch civil proceedings, including employment cases, evidence obtained in breach of privacy rules is only excluded in exceptional circumstances, because the interest in establishing the truth usually prevails.

The breach still matters. It can support a separate claim for damages, it affects how the court views the employer, and in a dismissal case it can count towards seriously culpable conduct (ernstig verwijtbaar handelen) by the employer, which can lead to a fair compensation (billijke vergoeding). Our article on WhatsApp мессеж дээр үндэслэсэн хураангуйг хэрэгсэхгүй болгох explains how this plays out.

What can you do if your employer has read your messages?

Do not delete anything, and first find out exactly what happened. Deleting messages once a dispute has arisen looks like concealment and can be held against you.

Ask your employer in writing on what basis the messages were accessed, what was accessed, by whom, when and for what purpose. Submit an access request under Article 15 GDPR; the employer must respond within one month, extendable by two months for complex requests (Article 12(3) GDPR).

Then choose your route. An internal complaint to the employer or the data protection officer is quickest. The works council is the right body if the problem lies in the monitoring arrangement itself. A complaint to the AP is free, but the AP decides for itself whether to investigate and does not award compensation. For compensation or an order to stop, you go to the civil court; Article 82 GDPR gives a right to compensation, but Dutch courts award restrained amounts for non-material damage and require you to substantiate your loss. Our overview of Нидерланд дахь ажилчдын эрх илүү өргөн хүрээтэй байр суурийг тодорхойлдог.

Ажилтан байхдаа юуг шалгах ёстой вэ?

• Read the IT and monitoring policy now, before there is a problem.
• Keep private conversations on your own phone, off company devices and networks.
• Check whether work chats back up to your personal cloud or work apps sync more than intended.
• If asked to unlock a phone, ask on what basis, what will be checked and by whom, and confirm the answer in writing.
• Before installing management software on your own phone, ask what it can see and what happens when you leave.
• If your messages were read, send an access request under Article 15 GDPR and keep all correspondence.

Ажил олгогчийн хувьд та юуг шалгах ёстой вэ?

• Have a written policy stating what is monitored, why, by whom and how long data is kept.
• Obtain and record the works council’s consent under Article 27(1)(k) and (l) WOR before introducing monitoring.
• Carry out a DPIA under Article 35 GDPR where monitoring is systematic or large-scale.
• When an incident arises, exhaust objective sources first and define the scope of any message search in writing.
• Hear the employee before drawing conclusions, and delete the material once its purpose has been served.
• Do not treat ownership of a device as permission to read everything on it. Our guide to Нидерландын мэдээллийн нууцлалын хууль эргэн тойрон дахь үүргүүдийг хамарна.

What can we do for you with workplace monitoring?

Манай хөдөлмөр эрхлэлтийн хуульчид advise employees and employers on reading messages at work:

• We assess whether your employer’s access to your messages was lawful under the GDPR and Article 8 ECHR.
• We draft your access request under Article 15 GDPR and follow up on the one-month deadline.
• We draft or review a monitoring and IT policy and prepare the consent request to the works council.
• We set up a scoped, documented internal investigation that respects necessity and proportionality.
• Where monitoring led to dismissal, we handle the dismissal case and the privacy claim together.
• We file a complaint with the AP or bring proceedings for an order to stop and compensation.

Дүгнэлт

• An employer may only read WhatsApp messages with a legitimate interest, when necessary and proportionate, and after announcing it in a policy.
• Consent from an employee is almost never a valid basis for monitoring.
• Monitoring arrangements need the works council’s consent under Article 27(1)(k) and (l) WOR; without it they can be void.
• You never have to unlock your private phone; on a company phone, only a defined, limited check is allowed.
• Unlawfully obtained messages may still be used in court, but the breach can lead to damages or count against the employer.

Түгээмэл асуултууд