Skip to main content

Disclaimer: Educational purposes only. Not legal advice. Consult a qualified NZ legal practitioner for your specific circumstances.

SimplifiedLaw.co.nz
employment

Can an employer monitor your work emails?

Key Takeaway

In New Zealand, employers can monitor work emails, but this is subject to significant legal obligations under the Privacy Act 2020 and the Employment Relations Act 2000. Monitoring must generally be for a legitimate business purpose, conducted fairly, and employees should be transparently informed about such practices through clear workplace policies. Reasonable expectations of privacy play a crucial role.

Employer Monitoring of Work Emails in New Zealand

In New Zealand, the monitoring of work emails by employers involves a balance between an employer's legitimate business interests and an employee's right to privacy. The legal framework governing this area primarily includes the Employment Relations Act 2000 and the Privacy Act 2020.

The Legal Framework

Good Faith Obligations

The Employment Relations Act 2000 requires employers and employees to deal with each other in good faith [Source: Employment Relations Act 2000, s 4]. Good faith involves being open, honest, and responsive, and not doing anything to mislead or deceive [Source: Employment Relations Act 2000, s 4]. This obligation extends to matters of workplace monitoring, implying that employers should be transparent about any monitoring practices.

Privacy Act 2020

The Privacy Act 2020 governs how personal information (information about an identifiable individual [Source: Privacy Act 2020, s 7]) is collected, held, used, and disclosed by agencies, which include employers. Several information privacy principles (rules for handling personal information [Source: Privacy Act 2020, s 22]) are particularly relevant to email monitoring:

  • Principle 1 – Purpose of Collection: Personal information should only be collected if it is necessary for a lawful purpose connected with a function or activity of the agency, and the collection is necessary for that purpose [Source: Privacy Act 2020, s 22, Principle 1]. An employer must have a legitimate business reason for monitoring emails.
  • Principle 3 – Collection from Subject: When collecting personal information directly from the individual concerned, the agency must take reasonable steps to ensure the individual is aware of the fact that the information is being collected, the purpose for which it is being collected, and the intended recipients of the information [Source: Privacy Act 2020, s 22, Principle 3]. This means employees should be informed about email monitoring.
  • Principle 4 – Manner of Collection: Personal information must be collected fairly and without undue intrusion into the individual's personal affairs [Source: Privacy Act 2020, s 22, Principle 4]. Covert or intrusive monitoring without prior notice may breach this principle.
  • Principle 10 – Limits on Use: An agency holding personal information must not use that information for a purpose other than that for which it was collected unless certain exceptions apply [Source: Privacy Act 2020, s 22, Principle 10]. For example, if emails are monitored for IT security, the collected information should not then be used for unrelated performance management unless specific exceptions are met.
  • Principle 11 – Limits on Disclosure: An agency must not disclose personal information to another person or agency unless specific exceptions apply [Source: Privacy Act 2020, s 22, Principle 11]. This means information obtained through email monitoring generally cannot be shared outside the organisation or for unrelated purposes.

Workplace Policies and Expectations of Privacy

Clear and comprehensive workplace policies play a critical role in establishing reasonable expectations of privacy for employees. If an employer has a clear, communicated policy stating that work emails (including those on company-provided devices or networks) may be monitored and for what purposes, an employee's expectation of privacy regarding those communications is significantly reduced. Such policies should be made available to employees, for example, within an employment agreement or a staff handbook, and employees should be aware of them.

Without a clear policy, employees may have a higher expectation of privacy, making monitoring more likely to breach the Privacy Act 2020 or the good faith obligations under the Employment Relations Act 2000.

Legitimate Business Reasons for Monitoring

Employers may have several legitimate business reasons for monitoring work emails, such as:

  • Protecting confidential or proprietary business information.
  • Ensuring compliance with legal and regulatory obligations.
  • Preventing harassment, bullying, or discrimination.
  • Investigating workplace misconduct.
  • Managing network and system security.
  • Ensuring productivity and appropriate use of company resources.

What Employees Should Know

Employees should be aware that communications made using employer-provided email systems, devices, or networks may not be considered private. It is generally advisable for employees to avoid using work email for personal communications if they wish to maintain privacy.

What Employers Should Do

Employers considering email monitoring practices are generally expected to:

  • Develop a clear, written workplace policy on email and internet usage, including details about monitoring [Source: Privacy Act 2020, s 22, Principle 3].
  • Communicate this policy effectively to all employees [Source: Employment Relations Act 2000, s 4; Privacy Act 2020, s 22, Principle 3].
  • Ensure that monitoring is for a legitimate business purpose [Source: Privacy Act 2020, s 22, Principle 1].
  • Conduct monitoring in a fair and non-intrusive manner [Source: Privacy Act 2020, s 22, Principle 4].
  • Limit the use and disclosure of any collected information to its intended purpose [Source: Privacy Act 2020, s 22, Principle 10; Privacy Act 2020, s 22, Principle 11].

When to Seek Independent Legal Advice

Individuals who believe their personal information has been mishandled or their privacy rights have been breached, or employers seeking to implement monitoring policies, may find it beneficial to seek independent legal advice. The Office of the Privacy Commissioner can provide guidance on privacy matters. Community Law Centres also offer free legal advice on a range of employment issues and privacy concerns. Further assistance may be obtained from the Employment Relations Authority or an employment lawyer.

Key Resources