Employer breached right to privacy by monitoring messages 

The European Court of Human Rights’ (ECtHR) has held that a Romanian employer acted in breach of an employee’s right to privacy under article 8 of the European Convention on Human Rights (“the Convention”) by monitoring his messages on a work-related messaging account.

The Law

Article 8 of the Convention provides that everyone has the right to respect for his private and family life, his home and his correspondence. There are some exceptions to the right to privacy, such as where interference with the right is “in accordance with the law” and “necessary for the protection of the rights and freedoms of others”. All member states of the European Union are required to interpret national law in accordance with the Convention, hence why this case is of importance.

In an employment context, article 8 is often cited by employees, particularly in cases involving an employer’s monitoring of communication systems. In many of these cases, employees have struggled to establish an expectation of privacy in their use of their employer’s IT systems. However, where a right to privacy is made out, domestic courts have to perform a balancing exercise between the employee’s right to respect for their private life and the employer’s interests.

The Facts

Mr Barbulescu was employed by a Romanian company as a sales engineer. At his employer’s request, he created a Yahoo messenger account for the purpose of responding to clients’ enquiries. His employer’s rules stated that it was strictly forbidden to use computers for personal purposes, that employees could not use the internet or phones for private purposes and misconduct would be carefully monitored and punished.

In July 2007, Mr Barbulescu was called into a meeting and accused of using the yahoo messenger account for private purposes. Unbeknown to Mr Barnulescu, his employer had been recording his messenger communications in real time. Mr Barbulescu denied using the messenger account for private purposes, following which his employer produced a transcript of every message Mr Barbulescu had sent, including intimate exchanges with his fiancée. Mr Barbulescu was dismissed for breach of the employer’s rules. He challenged his dismissal in the Romanian courts, claiming that his right to privacy under Article 8 of the Convention had been breached because his employer had monitored his communications via the Yahoo Messenger accounts and used their contents in the subsequent disciplinary proceedings against him.

The Romanian courts ruled against Mr Barbulescu, finding that article 8 had not been breached. Mr Barbulescu took his claim to the ECtHR.

The Chamber of the ECtHR found that Mr Barbulescu’s private life and correspondence were affected, having regard to the personal nature of his communications and the fact that a transcript of them had been produced. It went on to find, however, that a fair balance had been struck under Romanian national law between Mr Barbulescu’s right to respect for his private life and his employer’s interests. The Chamber held that the employer legitimately accessed the employee’s email account because it assumed that the emails only related to work activities and it was reasonable for the employer to want to check Mr Barbulescu was doing his work. The Chamber found that Mr Barbulescu had committed a disciplinary offence by using the internet for personal purposes during working hours and considered that the employer’s monitoring was proportionate because it was limited to Mr Barbulescu’s use of Yahoo messenger. It was held that there had been no violation of Article 8.

Mr Barbulescu appealed to the Grand Chamber of the ECtHR.

The Decision

The Grand Chamber overruled the earlier decision and held that Mr Barbulescu’s right to privacy under Article 8 had been violated. In particular, the Court held that the national courts:

– failed to determine whether Mr Barbulescu had received prior notice from his employer that his communications on Yahoo messenger might be monitored;
– failed to have regard to the fact Mr Barbulescu had not been informed of the nature or the extent of the monitoring (including that the employer may have access to the actual content of the messages) or the degree of intrusion into his private life;
– had not determined the specific reasons justifying the introduction of the monitoring measures;
– did not consider whether the employer could have used less intrusive measures than accessing the contents of Mr Barbulescu’s private correspondence; and
– failed to decide whether the communications might have been accessed without his knowledge.

Points to note

Perhaps of most concern to employers from this judgment is the Court’s statement that “an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.”

No doubt, as an employer you will be wondering if this decision means you can no longer monitor your employees’ activities. Your IT communications policy will probably say that employees should have no expectation of privacy in their use of IT communication systems at work. Yet, Mr Barbulescu was held to have an expectation of privacy in his yahoo messenger communications, despite the fact his employer’s policies prohibited private use of work computers and said that misconduct would be monitored.

The answer is that you can continue to monitor your employees’ use of your communications systems provided you have a clear and detailed monitoring policy in place. Even if an employee can establish a right to privacy, there must still be a balancing exercise between the employee’s right to private life and the employer’s interests and the Court specifically acknowledged that employers have a legitimate interest in ensuring the smooth running of the organisation and to engage in monitoring in order to achieve this.

Action Points

1.Make sure you have an IT communications policy in place at work that makes it clear whether personal use of IT systems is permitted and that it sets clear parameters for personal use.

2. Review your monitoring policy, taking into account the guidance given by the Court, to make sure any monitoring operation will stand up to rigorous scrutiny by the courts;

o Notify your employees IN ADVANCE that you may monitor communications and tell them why, where and how you intend to do this and how that information may be used;
o If you wish to monitor the actual content of communications, expressly warn employees in advance of this;
o Make sure you have legitimate reasons to justify monitoring the communications, bearing in mind the more intrusive the monitoring (e.g. reading the content of emails), the more compelling your reasons must be;
o Consider the scope of your monitoring operations and whether you actually need to access the content of communications – can you achieve the same aims through less intrusive methods?

At Real Employment Law Advice, we can prepare an IT communications policy that is tailor made to your requirements and advise you on the best ways to ensure compliance.

This article was written and researched by Miranda Amos, Solicitor at our Salisbury office

 Don’t forget getting advice from a Solicitor does not have to be complicated or costly!

Contact us on: 01983 897003, 0238 982006 or 01722 653001