Workplace privacy and surveillance in Finland: Email monitoring - Part 2

Email correspondence is generally considered confidential in Finland and employees have a right to privacy regarding their communications. According to the Finnish Act on the protection of privacy in working life (Laki yksityisyyden suojasta työelämässä, 759/2004​), the employer is expected to make necessary arrangements to avoid the need to read employee’s email.

Unless there is a legitimate, compelling reason tied to operational requirements, employers should not access (search) email messages. Retrieval is though permitted in the following circumstances:

When accessing an email account, the employer may use a system administrator to search for specific messages by criteria such as sender, recipient or subject. The employer is required to keep a detailed report of the retrieval, including the reason for accessing (searching) the messages, the time of retrieval and who performed the action. This report must be shared with the employee promptly.

As opening (reading) employee's email is more invasive than simply retrieving (locating) specific messages, it is subject to even stricter conditions. Employers can open employee's email only if it is essential to the completion of the employer's operations or to ensure business continuity. For example:

A formal report must be prepared whenever an email is opened (read), which includes details of the message, the reason for opening it and the individuals involved in the process. This information must be shared with the employee involved, without undue delay. The opened email must also be stored securely, and its content should only be processed to the extent necessary.

After employee’s employment is terminated, the employer no longer has a valid legal basis for continuing to process their email account and should close the account. However, in certain situations, the employer may need to keep the account open temporarily - this though requires employee’s consent.

The employee's consent is necessary for both keeping the email account active and for any actions such as reading or forwarding emails. The employer must ensure that this consent is obtained in a clear, informed and voluntary manner. Additionally, the employee has the right to withdraw consent at any time and they can also demand that their account be closed upon leaving the company.

In Finland, employee email privacy is protected by strict regulations and employers are only allowed to access, read or manage email accounts under very specific circumstances. Employers must always ensure that any access to email accounts is both justified and documented, providing transparency and respecting employees´ privacy rights (including the right to request the closure of their email accounts after employment ends). By understanding these guidelines, both employers and employees can navigate the balance between operational needs and privacy in the workplace.