FRANCE—Supreme Court Rules Employers Must Notify CNIL of Email Checking at Time of Collection

Employers using devices to control employees’ email volume and flows individually must notify the CNIL, the French data protection authority (DPA) before an employee may be dismissed for reasons involving the emails at hand,the French Supreme Court said in a decision of October 8.

The Supreme Court therefore overruled the Court of Appeal’s decision, which had been sympathetic to the employer's  will to fix the noncompliance by filing the necessary notification with the French DPA eight days after the launch of the dismissal procedure.

Although it was found that the employee had sent and received more than 600 emails a month, the Supreme Court ruled that the email-checking device was a data-processing system not notified to the CNIL at the time of data collection. It therefore was an unlawful means of evidence; the evidence collected could not be considered by the court.