ING – Court Ruling (Netherlands, 2022)

The controller is ING, a Dutch bank, and the data subject is one of its former employees. The controller had received signals of fraud: an anonymous report which stated that the data subject was involved in money laundering, skimming money of supermarkets he co-owned, and mortgage fraud. This, together with other elements, led the controller to monitor the email use of the employee, after which it became clear that the data subject had structurally used his work-equipment for private purposes. The controller requested the Subdistrict Court to dissolve the employment agreement on grounds of the culpable acts or omissions of the data subject. The Court, however, dismissed the request because it was unclear whether the controller had respected the conditions set by the ECHR in Bărbulescu for monitoring employees' email use. The Court held that, according to these requirements, the following questions must be asked:1. Was the employee informed in advance of (the nature of) possible monitoring of correspondence and other communications by the employer? 2. What was the scope of the monitoring and seriousness of the breach of the employee’s privacy (or: proportionality)? 3. Did the employer have legitimate grounds to justify the monitoring applied? 4. Would monitoring have been possible with less intrusive methods and measures? 5. What we're the consequences of the monitoring for the employee? 6. Have adequate safeguards been provided for the employee, especially in the case of intrusive monitoring? The Court stated that it was unable to assess whether (1) ING had a justification for monitoring the business emails, and (2) whether the monitoring was legitimate and proportionate. It therefore denied the controller's request who, in turn, appealed the Subdistrict Court’s decision. First, the Court of Appeal noted that the Subdistrict Court incorrectly referred to the guidelines listed in Bărbulescu as cumulative conditions. It followed that these conditions do not all hav