The Grand Chamber of the European Court of Human Rights has decided that an employee’s human rights were breached when his employer monitored and viewed his personal messages to his brother and fiancé on his work Yahoo messenger account during working time and dismissed him as a result.
Facts
Mr Bărbulescu was employed in Romania by a heating company as an engineer in charge of sales. At his employer’s request, he set up a Yahoo Messenger account to deal with client enquiries. The company’s policies strictly prohibited any personal use of its IT equipment and the company circulated a notice reiterating this. The notice included the following statement:
“Come to work to deal with company and professional matters, and not your own personal problems! Don’t spend your time using the internet, the phone or fax machine for matters unconnected to work or your duties. …The employer has a duty to supervise and monitor employees’ work and to take punitive measures against anyone at fault! Your misconduct will be carefully monitored and punished!”
However, neither the policy nor this notice stated expressly that the content of communications would be monitored or intercepted.
The employer later informed Mr Bărbulescu that it had monitored his Yahoo Messenger communications over the course of a week and that it considered he had used it for personal purposes in contravention of the employer’s IT usage policy. Mr Bărbulescu replied in writing that he had only used it for professional purposes. The employer then produced a 45-page transcript of his Messenger communications over the week in question, which included the text of the messages he had exchanged with his brother and his fiancée during that time, containing intimate personal information about his health and sex life. It also contained the text of five short messages exchanged with his fiancée using his personal (non-work-related) Yahoo Messenger account. The employer dismissed Mr Bărbulescu for unauthorised personal use of the internet.
Mr Bărbulescu brought a claim against the Romanian government in the European Court of Human Rights (ECtHR), arguing that it had failed to protect his rights to privacy and correspondence.
Article 8(1) of the European Convention on Human Rights (ECHR) states that “everyone has a right to respect for his private and family life, his home and his correspondence”.
The ECtHR decided that while Article 8 was applicable, the monitoring of Mr Bărbulescu’s internet usage and the use of the Yahoo Messenger communications in disciplinary proceedings was a proportionate interference with his rights.
Mr Bărbulescu appealed to the Grand Chamber of the ECtHR.
Decision
The Grand Chamber upheld the appeal and found that Mr Bărbulescu’s Article 8 rights had been infringed.
As for whether there was a reasonable expectation of privacy in this case, the court noted that the employer had strictly prohibited personal use of its IT equipment, and to enforce this ban, it had set up a system for monitoring employee’s internet use, as well as the content of communications. While Mr Bărbulescu was informed of the prohibition on personal use of equipment, it does not appear that he was informed in advance of the nature and extent of the monitoring, or the possibility that the employer might have access to the content of his communications.
What does this mean for employers?
The introduction by an employer of measures to monitor correspondence and other communications should be accompanied by sufficient safeguards against abuse. The following factors are relevant:
- Notification about monitoring of communications. In order to comply with Article 8, unequivocal notification should be given in advance. In this case, Mr Bărbulescu did not appear to have been informed in advance of the extent and nature of the monitoring activities, or of the possibility that the employer may access the actual content of the messages.
- The extent of the monitoring and the degree of intrusion into the employee’s privacy. A distinction should be made between monitoring the flow of communications (that is, internet and email traffic or usage) and of their content.
- Whether the employer has provided legitimate reasons to justify monitoring the communications and their actual content. Monitoring actual content requires weightier justification.
- Whether it would have been possible to establish a monitoring system based on less intrusive methods. In other words, could the employer’s desired aim be achieved without accessing the full content of the employee’s communications.
- The consequences of the monitoring for the employee, and the use made by the employer of the result of the monitoring; in particular, whether the results were used to achieve the employer’s desired aim.
- Whether the employee had been provided with adequate safeguards, especially where the monitoring was intrusive in nature.
Comment
There is likely to be much interest in this case, as the ECtHR’s original decision in the case was seen by many as an employer-friendly decision which allowed a degree of snooping on employees’ personal emails. The reality was somewhat different. Ultimately, the Grand Chamber decided that the Romanian courts had fallen short of their positive obligation to protect the employee’s Article 8 rights. The employee’s reasonable expectation of privacy was not clear cut, because he had been informed of the employer’s strict internet usage policy, and had even signed a copy of the company notice reiterating the policy, shortly before the disciplinary proceedings. Crucially, however, the employee had not been told expressly that the content of his personal communications on work IT equipment could be monitored at any time. It was this failure to notify the employee which was one of the key factors influencing the Grand Chamber’s decision.
In the UK, this decision is of limited relevance because this area is already heavily regulated by existing legislation, including the Data Protection Act 1998 (DPA 1998) and the Regulation of Investigatory Powers Act 2000. In addition, the Information Commissioner’s Employment Practices Code, recommends that, before embarking on monitoring of communications, employers carry out an impact assessment to demonstrate that they have achieved the correct balance between protecting workers’ privacy and the interests of the business. Generally, it is much more likely that workers would be held to have a reasonable expectation of privacy when accessing a personal email account, even where they are using the employer’s equipment to do so.
