> Even if the company has a rule that you're not allowed to use it for personal things, the law supersedes that and you still can't do it willy nilly.

Companies are not homogeneous blocks of matter and there is always information some people at the company may need to know that others have no business dealing with. Tax, banking and health related information are some of the things that I can think of that would be shared on a need to know basis with people at work and have no business to be seen by people outside of the intended audience.

Health related information may absolutely not be shared, and doesn't need to be.

Employer don't even get diagnosis behind sick leave. Not sure how work accidents are treated in that regard so.

Honestly I wasn't sure how much that point applied. However with people that suffer chronic illnesses or disabilities that require special consideration I would be surprised if it was always possible to adequately communicate those needs without also mentioning information that the employee might not want to share publicly.

You can communicate special needs (e.g. "do not put this person in a loud room"), but not health information (e.g. "this person has epilepsy"). I struggle to think a special consideration a person could need that you could not just articulate instead of whatever medical issue they have (at least it has never come up for me).

> Tax, banking and health related information are some of the things that I can think of that would be shared on a need to know basis with people at work and have no business to be seen by people outside of the intended audience.

I am against workplace surveillance, but why would people receive this information to their work email address?

Why would HR receive my information?

My bad, I misunderstood the above comment.

I don't think this is correct - even under the GDPR. If the company has good reason to look inside someone's mailbox (I don't think the bar for that is particularly high for a company email account) then any personal data they encounter would be being processed under "legitimate interest" as long as they don't do anything unnecessary with it in order to achieve whatever it was they were doing.

Tue bar is actually quite high. Teo things can block it: if there is a workers council, it has to approve surveillance of an employees use of IT systems. That surveillance can only be target to specific, named users and for specific purposes, almost like a mini search warrant. If there is no workers council, at the latest stage a court will have a very, very close look at what isbpresented as evidence. The middle ground is an affected employee's lawyer and the employer. Result being, that kind of comms / IT surveillance is basically never happeneing. Which is a very, very good thing!

You need to be specific about what legal jurisdiction you're talking about here then - the world is a very big place and different laws apply.

I'm not aware of any EU wide laws that prevent what you're talking about here. In the UK an employment contract will state that the employer can monitor your activity if they need to and this is completely legal.

Source: https://www.gov.uk/monitoring-work-workers-rights

In some countries (Germany springs to mind) there are much stricter rules. A blanket statement like the one you've made here is not correct unless you're being very specific about where you're talking about.

Germany it is, should have mentioned that.

this was way before gdpr. more like employee rights. employer cant just come by and snoop throu your drawers either.