Work laptops inspire a dangerous sense of intimacy.
We spend so much time with them that they begin to feel less like office equipment and more like a slightly unreliable extension of ourselves. We book flights during lunch, reply to friends between meetings, and occasionally send messages about work that were never intended for anyone at work.
Then we forget to log out.
In 2022, an open WhatsApp window became central to a case before Luxembourg's Court of Cassation. An employer accessed an employee's work computer to back up professional files.
The computer was still on, WhatsApp was open, and some of the employee's messages were visible on screen.
The messages were later used in proceedings concerning the employee's suspension and the termination of her employment. She argued that they belonged to a personal account and should be protected as private correspondence.
The court rejected her appeal and accepted that, in these particular circumstances, the messages could be treated as professional.
This does not mean your boss is entitled to scroll through the family group chat. It does mean that the line between 'personal' and 'professional' can become rather less reassuring when a private account is left open on a work device.
Sometimes, but certainly not whenever they feel like it.
An employer may need to access professional emails, protect confidential information, investigate a security problem, or retrieve a document while someone is away. Owning the computer gives the company a degree of control over it, but it does not erase the employee's private life.
Luxembourg's National Commission for Data Protection (CNPD) states that employees retain a right to privacy at work, including the confidentiality of personal correspondence. An employer may restrict or prohibit personal use of company equipment, but breaking that rule does not automatically make every private conversation available for inspection.
There is, after all, a difference between simply noticing that an employee opened WhatsApp at work and reading their family group chat to find out who is bringing the potato salad to Sunday lunch.
The distinction matters because the 2022 WhatsApp case did not involve a company installing software to monitor an employee. The employer accessed the computer to back up professional material and encountered WhatsApp already open.
The Court of Cassation focused on whether the messages could be treated as professional in those circumstances.
Deliberately monitoring employees is another matter.
An employer that wants to monitor emails, internet use, or other workplace communications must have a lawful reason and cannot go further than necessary. Employees must be informed beforehand. The employer must also inform the staff delegation or, if there is no delegation, the Inspectorate of Labour and Mines (ITM).
The employer must explain what is being monitored, why it is being monitored, how the system will operate, and how long the information will be kept, where applicable. These details are usually found in an IT policy, privacy notice, or employment handbook – documents whose main achievement is often being accepted by people who have not read them.
Still, it is worth finding yours.
A general warning that "monitoring may occur" is not a blank cheque. Luxembourg law requires employers to explain the purpose and operation of workplace surveillance in advance.
CNPD guidance also says that monitoring should be gradual: Employers should begin with occasional, non-personal checks and identify an individual employee only if those checks reveal grounds for suspicion.
Reading a message is more intrusive than seeing when an application was used or how many emails were sent. The greater the intrusion, the stronger the employer's reason should be.
Work emails are generally presumed to be professional unless something identifies them as private.
An employer may therefore be able to open a professional email for a legitimate reason. If an urgent client file is trapped in the inbox of someone beginning a two-week holiday, the company does not have to spend the fortnight mourning its absence.
That does not give a manager permission to read the entire inbox out of curiosity.
The CNPD recommends making private material visibly private. Personal emails can be identified in the subject line or placed in a folder marked "personal". Even a subject line such as "Holiday booking" may show that the message has nothing to do with work.
According to the CNPD, an employer may not open emails that are identifiable as personal. Doing so may violate the secrecy of correspondence and constitute a criminal offence.
This protection may still apply if the employer has prohibited personal use of company equipment.
The practical problem is timing. A message needs to look private before somebody opens it, not after its contents have become inconvenient.
That helps explain the outcome of the WhatsApp case. The account may have been personal, but the application was open on a work computer, the messages were immediately visible, and nothing specifically identified them as private. There was no password from which the employer might have inferred that they belonged to the employee's private life.
The employee knew that the conversation was personal. The employer did not encounter a visible boundary saying so.
The name of the platform will not decide everything.
A conversation with a client through a company Teams account will usually appear professional. A private exchange with a friend through a personal account has a much stronger claim to privacy.
The surrounding circumstances still matter. Was the account open on a work computer? Were the messages immediately visible? Was anything marked as personal? Why did the employer access the device?
An employer may also be able to see that an employee visited a website or used a particular service without having the right to read the contents of their conversations.
Privacy law can limit what employers do. It cannot stop a private message from appearing on an unlocked screen at precisely the wrong moment.
For anything truly sensitive, a personal account on a personal device always remains the safer choice.
Start by checking the company's IT policy, privacy notice, internal regulations, and any applicable collective agreement. You can ask what information is being collected, why it is needed, who receives it and how long it is kept.
The General Data Protection Regulation (GDPR) also allows employees to ask whether their employer is processing personal data concerning them and to request access to it. The employer should generally respond within one month.
The staff delegation can help if a new monitoring measure is being introduced or an existing system seems excessive. Employees who believe that their data-protection rights have been infringed may also lodge a complaint with the CNPD.
Anyone whose messages are already being used in disciplinary proceedings should seek individual advice quickly. At that stage, the question is no longer only whether the employer read the messages, but whether they were entitled to use what they found.
The law places limits on employers, but employees should not make those limits harder to see.
Your employer may own the laptop. That does not mean they own every conversation on it.
It does mean you should close WhatsApp.
