The use of professional messaging directly confronts the employer’s prerogatives with the employee’s fundamental rights. Emails sent or received through professional tools are, as a rule, presumed to be professional in nature, but their consultation, conservation, and use for disciplinary or probative purposes are strictly regulated.
According to local reports, the decisions made in 2025 and 2026 confirm the need to balance this presumption with respect for privacy, secrecy of correspondence, the right to evidence, and the requirements of the General Data Protection Regulation (GDPR). These decisions invite clarification on the conditions under which an employer can access an employee’s messages and use them in the context of the employment relationship.
Professional Email and Privacy
Professional email has become a primary means of conserving a company’s memory, with instructions, commercial exchanges, internal alerts, and confidential documents all being transmitted via email. This raises a particular legal difficulty, as the email box is provided by the company and intended for work, but it is used by an individual who retains their right to privacy and secrecy of correspondence, even within the company.
The jurisprudence has progressively constructed a balance between these two imperatives. The decisions made since 2023, particularly in 2025 and 2026, have clarified the contours of this balance, including the presumption of professional character, protection of personal messages, the right of access to emails under the GDPR, the admissibility of evidence from private messages, and rules applicable upon employee departure.
Read Also: Paris court weighs mental health in subway assault case
Key Principles Apply
Six key principles govern professional emails: messages sent or received through professional email are, as a rule, presumed professional unless clearly identified as personal or private; the employer can access professional elements for business needs, but this power does not authorize general and permanent surveillance of employees; messages marked “Personal” or “Private” benefit from enhanced protection under privacy and secrecy of correspondence laws.
A professional email can be used in a disciplinary procedure, as confirmed by the Cour de cassation on January 14, 2026, in a case involving exchanges between colleagues related to professional activity. The admissibility of an email as evidence and the lawfulness of its obtaining are two distinct questions.
The difficulty in regulating professional messaging stems from the hybrid nature of the tool, which is created by the employer but used by an individual who retains their fundamental rights. The article 9 of the Civil Code guarantees respect for privacy, while article 8 of the European Convention on Human Rights protects privacy and correspondence.
The Cour de cassation has established that a salarié has the right to respect for their private life, including the secrecy of correspondence, even at work. The Nikon decision of October 2, 2001, remains a landmark in this area, affirming that the salarié has a right to privacy at work.
Read Also: Mediation Week Kicks Off With Over 100 Events
Email Privacy Protections
A message sent from a company email account is presumed professional unless clearly identified as personal. This presumption is practical, as the company needs to access professional information, such as client communications or business documents, even when the salarié is absent. However, this presumption is not absolute, and a message clearly marked as personal is subject to a different regime.
In a decision on January 14, 2026, the Cour de cassation ruled that messages exchanged between colleagues using a company email account were professional in nature, even if they contained insulting or denigrating remarks about superiors. The court held that the messages were subject to a presumption of professional character, as they were sent using a company email account and related to professional activity.
The company can implement email surveillance, but it must be encadred. The CNIL recalls that control mechanisms must be justified by the nature of the tasks and proportionate to the purpose pursued. Several company interests can justify control measures, including protection of the information system, prevention of data leaks, detection of malicious software, protection of trade secrets, detection of fraudulent behavior, and search of elements necessary for an internal investigation.
