Corporate Email: Employee Privacy and Monitoring

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazilian labor case law considers employer monitoring of corporate email lawful, as long as the employee has been told about it in advance and the tool is used exclusively for work.

The Settled Position of the Labor Courts

Brazil’s Superior Labor Court has taken the position that corporate email, which the employer provides as a work tool, is not the same as the employee’s private correspondence. The mailbox the company supplies belongs to the employer, forms part of its digital assets, and exists solely for carrying out work activities.

For that reason, the labor court recognizes the employer’s right to access, inspect, and audit the content that passes through this tool. The reasoning starts from the premise that the holder of the corporate account is the legal entity, not the worker. This takes the case outside the direct application of the inviolability of the confidentiality of communications under Article 5, item XII, of the Brazilian Federal Constitution.

Personal email is treated differently, even when it is accessed in the workplace. In that situation, the constitutional protection of privacy prevails, and an employer’s intrusion may amount to a civil wrong and even a labor violation, entitling the employee to compensation for moral damages.

This distinction has been established by repeated rulings of the panels of the TST (Brazil’s Superior Labor Court), which recognize that a corporate tool is instrumental in nature and refuse to equate it with private email. The position guides both the admissibility of evidence in labor lawsuits and the assessment of an employee’s responsibility in internal disciplinary proceedings.

Conditions for Lawful Monitoring

Labor case law requires several cumulative conditions to be met before the monitoring of corporate email is considered proper. The first is that the employee has clear, prior notice that monitoring is possible, set out in the employment contract, internal rules, a code of conduct, or a specific form signed at the time of hiring.

A legitimate purpose tied to the company’s business is also required, such as preventing leaks of confidential information, investigating irregularities, meeting regulatory obligations, or auditing information security. Random monitoring, without a concrete reason or out of proportion to the stated objective, may be found abusive.

Proportionality between the monitoring measure and its intended purpose is also a decisive criterion. The employer must use the least invasive means available, preferring automated analysis to reading entire messages, and must limit access to the professionals who strictly need it, such as compliance, information security, or legal teams.

If any of these requirements is missing, the evidence obtained may be declared void and the employer may be ordered to pay compensation for moral damages. This is especially so when the worker’s privacy was improperly exposed or sensitive information was disclosed to people who had no connection to the purpose of the monitoring.

In that situation, the constitutional protection of privacy prevails, and an employer’s intrusion may amount to a civil wrong and even a labor violation, entitling the employee to compensation for moral damages.

The Impact of the LGPD (Brazil’s General Personal Data Protection Law) and the Right to Privacy

Since Law 13.709/2018, the General Personal Data Protection Law, took effect, the processing of information contained in corporate email must rely on specific legal bases, such as the controller’s legitimate interest, compliance with a legal obligation, or performance of a contract. As the controller, the company must document the purpose, necessity, and proportionality of the processing.

Transparency has become a core element. The internal monitoring policy must describe what data is collected, how long it will be stored, who will have access to it, and in what circumstances monitoring will take place. Without this documentation, the employer’s position is weakened in any legal dispute, even when the email account is unmistakably corporate.

The overlap between labor law and data protection has raised the bar for companies, especially with respect to technical controls, access logs, manager training, and channels through which employees can exercise their rights as personal data subjects, as provided in Article 18 of the law.

Brazil’s National Data Protection Authority may impose administrative sanctions for noncompliance, ranging from a warning to a fine of up to two percent of revenue, subject to the statutory cap. This regulatory landscape reinforces the need for documented governance, with periodic policy reviews, records of processing operations, and a data protection impact assessment when the monitoring involves high-risk processing.

Frequently Asked Questions

Who can access the content of an employee’s corporate email?

Access is limited to the professionals the employer has designated for the purpose stated in the internal policy, usually members of the compliance, information security, legal, or audit departments. Indiscriminate access by managers, coworkers, or third parties with no connection to the purpose of the monitoring may be considered an abuse and make the company liable.

How should the monitoring policy be communicated to the employee?

Notice must be given in advance, stated expressly, and documented, preferably in writing, in the employment contract, internal rules, a code of conduct, or a specific form signed by the worker. Verbal or presumed notice does not meet the standard required by labor case law or by the General Personal Data Protection Law, and it may invalidate the evidence obtained and create liability for damages.

What consequences can an employee face for misusing corporate email?

Using corporate email for personal, offensive, or unlawful purposes, or in violation of the internal policy, may lead to a warning, a suspension, or dismissal for just cause, depending on how serious the conduct is. The employer must guarantee the employee a chance to respond and must produce reliable evidence, while observing the legal requirements of proportionality, immediacy, and the specific classification of the offense the worker committed.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.