Can Your Boss Access Your Phone? Employer WhatsApp Monitoring, Privacy Violation, and the Limits of Mobbing

An employee may have left WhatsApp Web open on their employer's computer. Customer information may have been shared in a WhatsApp group created for tracking sales team work. The employer may suspect that company secrets have been sent to another firm. A manager, without any concrete justification, may have requested the employee's personal phone, read private conversations with family members, and shared screenshots of the messages with other managers.

In all of these scenarios, the employer has access to the employee's WhatsApp conversations. However, the legal outcome is not the same for each case.

The employer has the authority to manage the workplace, supervise the conduct of work, and protect company assets. Conversely, an employee is not deemed to have waived their right to privacy, confidentiality of communication, and protection of personal data upon entering the workplace. Even if the employer's computer, telephone, or internet connection is used, the employer cannot unlimitedly examine all of the employee's correspondence.

The real issue is not whether the employer can conduct an inspection, but rather for what purpose, by what method, to what extent, and with prior notification to the employee.

An Example from Everyday Life: WhatsApp Web Left Open

Zeynep works as a sales representative at a company. She uses WhatsApp Web on her work computer because she mostly communicates with customers via WhatsApp. Her employer has not communicated any policy to employees regarding the monitoring of corporate devices.

One day, Zeynep leaves work without closing WhatsApp Web. Her manager sees that the computer is on and reads not only the customer messages but also Zeynep's private conversations with her husband, friends, and doctor. He takes screenshots of some of the messages and sends them to the human resources department.

Then to Zeynep;

"You wrote negative things about the company to your friends. We no longer trust you."

She is asked to provide a defense. In the following days, Zeynep's phone usage is checked, her online hours are questioned, and references are made to her private messages in front of other employees.

There are three separate legal problems in this case:

1. Is it legal for an employer to review WhatsApp messages?
2. Is reading and sharing private conversations a violation of privacy?
3. Can turning supervision into a constant tool of oppression constitute mobbing?

Does the employer have the authority to review WhatsApp messages?

Employers do not have general and unlimited authority to review all of an employee's WhatsApp messages. However, a certain degree of review may be permissible if there are legitimate purposes such as conducting business, ensuring information security, investigating customer complaints, protecting trade secrets, or investigating an alleged workplace breach.

For this audit to be considered lawful, the following conditions must be considered together:

• The audit must have a specific and legitimate purpose.
• The employee should be informed in advance about the scope and method of the audit.
• The audit must be necessary for achieving the desired outcome.
• It should not be possible to achieve the same result using a less drastic method.
• Only the necessary messages and data should be reviewed.
• The information obtained should not be used for purposes other than those intended and should not be shared with unnecessary individuals.

The Constitutional Court acknowledges that when employers monitor employees' electronic communications, it is necessary to examine whether prior and explicit notification was provided, whether the monitoring is limited to legitimate purposes, whether less intrusive methods are available, and whether the monitoring is carried out proportionally.

Therefore, the employer's approach of saying, "The computer belongs to the company, I can read everything on it," is not legally correct.

Is there a difference between a personal phone and a company phone?

employee's personal phone

An employee's personal WhatsApp account on their phone is the area where expectations for privacy are highest. Forcing the employee to provide their phone, demanding password disclosure, secretly accessing the phone, or copying messages is, as a rule, a serious intrusion into the privacy of personal life and communication.

An employee's presence in a workplace group or their use of their own phone to speak with clients does not give the employer the right to monitor all phone conversations.

For example, if an employer only wants to see a specific conversation with a client, they might ask the employee to show that conversation or provide relevant messages only within the scope of the work relationship. However, this does not justify reading other conversations with a spouse, family members, or friends.

Phone provided by the employer

The fact that the phone belongs to the employer does not mean that the employee has no expectation of privacy. The primary consideration here is whether the employer has a clear information and communication policy.

To the employee;

• The phone will only be used for business purposes,
• Which data can be checked?
• In what situations will the audit be conducted?
• Whether or not the message contents will be accessible,
• How long the data will be stored,
• Who can access the data,

If explicitly stated, an employee's expectation of privacy may decrease to some extent. Nevertheless, monitoring should still be limited to the purpose and proportionate.

WhatsApp Web left open on work computer

An employee using their personal WhatsApp account on a work computer does not give the employer the right to view all messages. A reasonable expectation of privacy regarding personal conversations remains, especially if the employee has not been informed beforehand that their communications may be monitored.

In the case of Samet Ayyıldız, which was the subject of the Constitutional Court's decision, the employer examined the WhatsApp conversations of an employee on a computer provided for use at work and used this information to terminate the employment contract. The court ruled that the employee's right to protection of personal data and freedom of communication had been violated, taking into account the failure to clearly inform the employee that their communication could be monitored, the lack of explanation as to why accessing the message content was necessary, and the failure to consider less stringent methods.

Corporate WhatsApp groups

In WhatsApp groups created by employers and used solely for work purposes, the expectation of privacy is lower compared to personal conversations. If the employer is a participant in the group, they can already see the messages sent within the group.

However, an employer viewing messages within a group is not the same as secretly accessing private conversations between employees. Using group messages for disciplinary action may also not be legally permissible in all cases. The context of the message, the method of its acquisition, its connection to the employment relationship, and the severity of the penalty to be applied must all be considered.

When does a violation of privacy and communication rights become apparent?

Article 20 of the Constitution protects the right to respect for private life and the protection of personal data, while Article 22 protects freedom of communication and the confidentiality of communication.

WhatsApp conversations aren't just composed of written sentences. Messages also contain information about a person's personality;

• Family relationships,
• Health information,
• Their political or religious views,
• Trade union activities,
• Economic situation,
• Emotional relationships,
• Location information,
• Photographs and audio recordings,

This may occur. Therefore, examining messages often constitutes a simultaneous interference with privacy, confidentiality of communication, and the protection of personal data.

When assessing whether an intervention constitutes a breach, the following questions should be specifically asked:

Was the employee informed in advance?
Instead of general and vague statements, the purpose, scope, method, and results of the audit should be clearly stated. The Personal Data Protection Authority also emphasizes that information texts must be clear, understandable, and specific; vague and general statements will not be considered sufficient.

Was there a legitimate reason for the audit?
A concrete customer complaint, suspicion of a data breach, or an allegation of company secret disclosure might exist. However, constantly monitoring all employees' messages or simply out of curiosity on the part of a manager does not constitute a legitimate purpose.

Was it necessary to delve into the message content?
In some cases, a conclusion can be reached by examining the date, time, sender, and recipient information without reading the message content. Reading the entire private conversation directly might be excessive when it's possible to hear witness testimony, review workplace records, or obtain the parties' defenses.

How broad was the investigation?
If a three-day interview with a client needs to be investigated, then copying all of an employee's conversations over the years would not be legally permissible.

With whom were the messages shared?
Review should only be conducted by authorized personnel. Sending messages to a workplace group, showing them to other employees, or using them to humiliate an employee may also constitute a violation.

According to Article 419 of the Turkish Code of Obligations, an employer may only use an employee's personal data to the extent that it is related to the employee's suitability for the job or is necessary for the performance of the employment contract. Article 417 of the same Code imposes on the employer the obligation to protect the employee's personality and to ensure an orderly environment in the workplace in accordance with the principles of honesty.

Analysis of WhatsApp Messages from the Perspective of the Personal Data Protection Law (KVKK)

Reading, saving, screenshotting, storing, or sending WhatsApp messages to other people constitutes personal data processing.

The employer can be considered the data controller in this context and must act in accordance with the obligations in the Law No. 6698 on the Protection of Personal Data. It is not sufficient for data processing to be based on a legal reason. The processing activity must also:

• In accordance with the law and principles of honesty,
• Connected to specific, clear and legitimate purposes,
• Limited and proportionate for processing purposes,
• Kept for as long as necessary,

There needs to be an activity.

An employer may rely on the establishment, exercise, or protection of a right, or on legitimate interests, provided that no fundamental rights are prejudiced, depending on the specific circumstances of the case. However, "legitimate interest" does not mean having the authority to constantly monitor all messages of all employees. A balance must be struck between the necessity of monitoring and the fundamental rights of the employee.

In the case subject to the Personal Data Protection Board's decision numbered 2019/138, it was alleged that a company owner illegally obtained and shared WhatsApp conversations belonging to an employee with third parties. The Board indicated that reading, photographing, or taking screenshots of WhatsApp group conversations via a workplace computer should also be evaluated under the Turkish Penal Code, depending on the specifics of the incident.

Is the "Employee consented" defense always valid?

Employers sometimes include a clause in employment contracts stating that "All electronic communications of the employee may be reviewed by the employer," believing this grants them unlimited monitoring power.

However, not every document signed by an employee constitutes valid explicit consent.

Explicit consent;

• Relating to a specific topic,
• Based on sufficient information,
• Given voluntarily,

There needs to be a statement.

Given the economic and hierarchical power imbalance between employee and employer, it is particularly important to carefully assess whether consent obtained without giving the employee a genuine opportunity to refuse is based on free will. A general consent obtained in the form of, "You cannot start work unless you sign this document," does not render all forms of supervision legally valid.

Furthermore, even with the employee's consent, supervision must be proportionate. An employer cannot opt ​​for the most stringent method of supervision if a less intrusive method can achieve a specific goal.

Is monitoring WhatsApp considered workplace bullying (mobbing)?

A one-off investigation aimed at examining a specific workplace violation cannot, in itself, be classified as mobbing.

For mobbing to be considered, the behaviors must generally:

• Targeting a specific employee,
• It must continue for a certain period of time
• Systematic repetition,
• Whether it is arbitrary or intentional,
• It aims to intimidate, exclude, devalue, or force an employee to leave their job
• Causing harm to, or posing a serious risk of harm to, the employee's personality, professional status, or health,

This is being sought. The Constitutional Court also states that in the assessment of psychological harassment, the continuity, systematicity, intent, intimidation, and harm caused with the aim of exclusion must be considered together.

Therefore, the employer;

• Constantly questioning the employee's online hours,
• He asks for screenshots of her private conversations every day,
• Threatening her because she didn't hand over her phone,
• Disclosing private messages in front of other employees
• Making fun of the message content,
• Keeping an employee under constant supervision and waiting for them to make mistakes,
• Using the audit as a tool to force resignations,

In this case, the incident may cease to be merely a personal data breach and escalate into psychological harassment.

The Personal Data Protection Board has also assessed that surveillance practices that cause employees to feel constantly monitored in their private lives may be contrary to the principles of fairness and may be incompatible with the employer's obligation to protect the employee from psychological harassment.

However, allegations of workplace bullying (mobbing) must be evaluated on a case-by-case basis. It is not sufficient for an employee to simply be uncomfortable with supervision. The duration, frequency, purpose, perpetrators, and impact on the employee of the behaviors must all be examined together.

Legal Limits in Three Concrete Examples

1. Review of the work group based on a customer complaint

A customer alleged that a sales representative insulted them and sent screenshots of the conversation to the employer. The employer only reviewed the conversation with that customer, heard the employee's statement, and did not access any other private conversations.

The inspection is likely to be deemed lawful because it is limited to a specific complaint and concerns the conduct of the employment relationship.

2. Forcibly confiscating the employee's personal phone

The manager, suspecting the employee of talking about the company, requested the employee's personal phone, had them unlock it, and reviewed all their messages, including conversations with their spouse.

The absence of a concrete and compelling reason, the extension of the investigation to the entire account, and the employee's lack of a truly free choice will raise concerns about a violation of privacy and communication rights.

3. Constant message monitoring and pressure to resign

The employer is forcing a specific employee to hand over their phone every day, questioning their online hours, and disclosing information gleaned from their private messages in front of other employees. The employee is repeatedly told, "If you continue like this, we won't keep you here.".

If this practice is systematic and intended to intimidate, it can constitute grounds for an allegation of workplace mobbing, in addition to being a violation of privacy.

What are the consequences of an unlawful investigation?

An unlawful WhatsApp review can give rise to multiple liabilities depending on the specifics of the case.

From the perspective of labor law

Termination based on private messages obtained illegally by the employer may be considered invalid or unfair. If job security conditions exist, a lawsuit for reinstatement may be filed; otherwise, claims for severance pay, notice pay, and other compensation may arise.

The employee's right to terminate the employment contract for just cause can be assessed depending on the severity and duration of the violation, and whether it makes the continuation of the employment relationship unbearable. Article 24 of the Labor Law grants the employee the right to immediate termination in cases where the employer's behavior infringes upon the employee's honor and dignity, includes intimidation, harassment, and similar behaviors that violate moral and good faith principles. However, not every breach of supervision automatically constitutes grounds for justified termination; the severity of the specific case must be examined separately.

In terms of compensation

Material and moral damages may be claimed due to the violation of privacy, personal rights, or the confidentiality of communication. Article 417 of the Turkish Code of Obligations links damages arising from the employer's failure to fulfill its obligation to protect the employee's personality to the provisions of breach of contract.

In terms of the protection of personal data

The employee should first apply to the employer in their capacity as data controller;

• Which data is being processed?
• Which method was used to obtain the data?
• For what purpose it is used,
• To whom was it transferred?
• Deletion or destruction of illegal data,

can request.

The employer must respond to the application within thirty days at the latest. If the application is rejected, the response is inadequate, or no response is given within the specified time, the employee may file a complaint with the Personal Data Protection Board within thirty days of learning of the response, and in any case within sixty days of the application date.

From a criminal law perspective

Secretly accessing messages, recording conversations, sharing private content, or unlawfully obtaining personal data may be evaluated in terms of violation of the confidentiality of communication, violation of the privacy of private life, or unlawful disclosure or acquisition of personal data, depending on how the act was committed. In each specific case, the method of access, the form of sharing, and the intent of the perpetrator must be examined separately.

What should employers pay attention to when conducting audits?

Employers need to prepare a clear and understandable IT policy before initiating electronic communication monitoring. This policy should include:

1. Whether personal use of corporate devices is permitted,
2. Which communication tools can be monitored?
3. The purposes for which the audit will be conducted,
4. Under what conditions the content of the messages can be accessed,
5. Who will be able to review the data,
6. How long it will be stored,
7. Employee rights and application procedures,
8. Actions that can be taken as a result of the audit,

It should be clearly stated.

When suspicion arises, instead of directly accessing all messages, less intrusive methods should be used first. If investigation is necessary, it should be limited to a specific person, date, customer, or event; if private conversations are encountered, these conversations should not be reviewed or disseminated.

Conclusion

Employers have the authority to supervise employees; however, this authority does not infringe upon the employee's right to privacy.

The use of a company phone, corporate computer, or workplace internet does not give the employer unlimited surveillance rights. Reviewing WhatsApp messages must have a legitimate purpose, the employee must be clearly informed beforehand, the review must be necessary and proportionate, and limited only to work-related data.

Secretly accessing an employee's personal phone, reading family and friend conversations, sharing private messages with other employees, or using the obtained information to pressure the employee may constitute a violation of privacy and the right to confidentiality of communication.

If supervision becomes a repetitive, humiliating practice that targets a specific employee and is aimed at forcing them to resign, then mobbing may be considered.

Therefore, in a legal assessment, it's not just the question of "Who did the phone belong to?" that matters;

Was the employee informed, did the investigation have a legitimate purpose, was accessing the message content truly necessary, and was the audit used as a tool to intimidate the employee?

The questions should be answered together.