Key takeaways
- The unlawfulness of a means of proof no longer results automatically in its exclusion by the civil court, which must assess both its proportionality and its necessity.
- This judicial development does not, however, authorise employers to make unrestricted use of surveillance methods or disloyal means of evidence gathering.
- The collection of personal data by fraudulent, unfair or unlawful means may give rise to the employer’s criminal liability, independently of any employment tribunal proceedings.
- The IKEA case illustrates that even publicly accessible data may constitute a criminally punishable collection where its use diverts it from its original purpose.
- Employers must therefore strike a balance between the evidential interest of relying on unlawful evidence and the criminal risk incurred in its collection and subsequent use.
The IKEA case
Following a complaint lodged by a trade union alleging the existence of an organised surveillance system within IKEA France, several searches were carried out. Inspections were also conducted by the CNIL (the French data protection authority). As a result of these initial steps, a judicial investigation was opened, in particular in respect of the offence of collecting personal data contained in a file by a fraudulent, unfair or unlawful means, an offence punishable under Article 226-18 of the French Criminal Code.
The investigations quickly highlighted the role played by the Director of the Risk Management Department of IKEA France, who regularly instructed various companies, including company E, to carry out background checks on individuals. In this context, Mr JPF, acting as director of company E, conducted numerous private investigations into job applicants (notably to verify the accuracy of information contained in CVs), as well as into employees (suspected of theft or who had reported internal issues, such as food hygiene conditions in an in-store restaurant). Customers involved in disputes with the company, including defaulting customers, were also subject to investigations, which focused on their assets and solvency.
In order to carry out these assignments, Mr JPF used software that systematically scanned various online databases (Facebook, Twitter, etc.), enabling him to collect extensive information about the targeted individuals (professional or private activities, family circumstances, state of mind, marital or professional difficulties, legal disputes). He also reviewed local press coverage, which often reported minor criminal matters, and, where necessary, carried out neighbourhood enquiries.
By a judgment dated 15 June 2021 [1], the Versailles Criminal Court found the Director of the Risk Management Department of IKEA France guilty of unlawfully collecting personal data by a fraudulent, unfair or unlawful means, and sentenced him to eighteen months’ imprisonment, suspended, together with a fine of EUR 10,000. Mr JPF was convicted, for the same offences as an accomplice, and sentenced to two years’ imprisonment, suspended, together with a fine of EUR 20,000 [2].
Mr JPF, unlike the Director of the Risk Management Department of IKEA France, appealed against the decision. The appellate court dismissed the appeal and found him guilty, not as an accomplice but as the principal offender, of the offence under Article 226-18 of the Criminal Code. The Versailles Court of Appeal held that: “Collection is regarded as unfair, in particular in the context of employer/employee relationships, where it consists of capturing information disseminated on public sites (websites, directories, discussion forums, social networks, etc.) where the information collected is used for a purpose unrelated to that for which it was made public, and where it is gathered without the knowledge of the persons concerned, thereby depriving them of their right to object as provided for by the Data Protection Act.” [3]
Mr JPF subsequently lodged an appeal on points of law, without success. The Criminal Chamber of the Court of Cassation held that the Court of Appeal had not misapplied Article 226-18 of the Criminal Code, stating that: “The fact that some of the personal data collected by the defendant was freely accessible on the internet does not remove the unfair nature of that collection, where such collection, moreover carried out for distorted purposes of profiling the individuals concerned and investigating their private lives, without their knowledge, could not be undertaken without informing them.” [4]
The lawfulness of evidence obtained through private investigations
The principle has been established for several years: although an employer is entitled to monitor and supervise employees’ activities during working hours, it may not implement a monitoring system that has not been previously brought to the employees’ attention. In particular, surveillance reports (or investigation reports) (i) commissioned by an employer and prepared by a private investigator, establishing employee misconduct, and (ii) carried out without the employee’s knowledge, are regarded as unlawful means of evidence. [5]
It is therefore legitimate to ask whether this principle continues to apply with the same force today, given that the Social Chamber of the Court of Cassation now holds that: “The unlawfulness of a means of evidence does not necessarily lead to its exclusion from the proceedings. Where requested, the judge must assess whether the use of that evidence has undermined the fairness of the proceedings as a whole, by balancing the employee’s right to respect for private life against the right to evidence, which may justify the production of material infringing an employee’s private life, provided that such production is indispensable to the exercise of that right and that the infringement is strictly proportionate to the aim pursued.” [6]
According to the Supreme Court, in such circumstances: “Where unlawful evidence is produced, the judge must first examine the legitimacy of the control exercised by the employer and determine whether there were concrete reasons justifying recourse to surveillance and the extent of that surveillance. The judge must then consider whether the employer could have achieved the same result by using other means that were more respectful of the employee’s private life. Finally, the judge must assess whether the resulting interference with private life was proportionate to the aim pursued.” This position was recently confirmed by the Plenary Assembly of the Court of Cassation, which held that: “It must now be accepted that, in civil proceedings, the unlawfulness or unfairness in obtaining or producing a means of evidence does not necessarily lead to its exclusion from the proceedings.” [7]
Beware of the other side of the coin
While a means of evidence obtained through an unlawful mechanism may now, in civil proceedings, be regarded as admissible, this does not alter the fact that the implementation of such a mechanism and its use by the employer may constitute a criminal offence. As illustrated by the IKEA case, this would be the position in relation to private investigations resulting in the collection of personal data carried out without the knowledge of the persons concerned, for the purposes of profiling and investigation. Article 226-18 of the Criminal Code would then apply in full.
Other provisions may also be relied upon depending on the sensitivity of the data collected (Article 226-19 of the Criminal Code), in cases involving a diversion from the original purpose of the processing (Article 226-21 of the Criminal Code), or where data is transmitted to a third party to the detriment of the data subject (damage to reputation or intrusion into private life: Article 226-22 of the Criminal Code).
Accordingly, while the civil courts must balance the right to respect for an employee’s private life against the right to evidence when determining admissibility, employers themselves must weigh, on the one hand, the benefit of relying on unlawful evidence in litigation and, on the other hand, their exposure to criminal liability.
References
[1] Versailles Criminal Court, 5th Chamber, 15 June 2021.
[2] By way of anecdote, IKEA France was found guilty of the offence of habitual handling of goods obtained through a criminal offence and was sentenced to the payment of a fine of EUR 1 million.
[3] Versailles Court of Appeal, 9th Chamber, Case No. 21/02436, 27 January 2023.
[4] Court of Cassation, Criminal Chamber, 30 April 2024, No. 23-80.962.
[5] Court of Cassation, Social Chamber, 26 September 2018, No. 17-16.020; Court of Cassation, Social Chamber, 23 November 2005, No. 03-41.401; Court of Cassation, Social Chamber, 4 February 1998, No. 95-43.421; Court of Cassation, Social Chamber, 22 May 1995, No. 93-44.078.
[6] Court of Cassation, Social Chamber, 8 March 2023, No. 21-17.802; Court of Cassation, Social Chamber, 8 March 2023, No. 21-20.798; Court of Cassation, Social Chamber, 4 October 2023, No. 22-18.105.
[7] Court of Cassation, Plenary Assembly, 22 December 2023, No. 20-20.648; Court of Cassation, Plenary Assembly, 22 December 2023, No. 21-11.330.
Disclaimer
The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Evidency. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
