Employee monitoring versus privacy rights is back in the spotlight due to today’s decision by the Grand Chamber of the European Court of Human Rights (ECHR) in Bărbulescu v. Romania. The Grand Chamber held there had been a violation of Article 8 of the European Convention on Human Rights, where an employer monitored and accessed personal emails sent by an employee during work hours from his Yahoo Messenger account, using a company computer, without notifying the employee in advance of such monitoring.
On 12 January 2016, the Chamber of the ECHR held, by six votes to one, that there had been no violation of Article 8, finding that the domestic courts had struck a fair balance between Mr Bărbulescu’s right to respect for his private life and correspondence under Article 8 and the interests of his employer. Whilst Mr Bărbulescu’s right to private life and correspondence had been engaged, his employer’s monitoring of his emails had been reasonable in the context of disciplinary proceedings (discussed further here – Monitoring employees’ emails – how far is too far-Davinia Brennan (Privacy Data Protection)).
Today, the Grand Chamber, by eleven votes to six, overturned the Chamber’s judgment, finding there had been a violation of Article 8. The Grand Chamber held that the domestic courts had failed to determine whether Mr Bărbulescu had received prior notice from his employer of the possibility that his communications might be monitored, or the nature or the extent of the monitoring. In addition, the Grand Chamber found that the domestic courts had failed to determine whether there had been legitimate reasons to justify the monitoring measures; whether the employer could have used measures entailing less intrusion into the employee’s private life and correspondence; and whether the emails might have been accessed without his knowledge.
The Grand Chamber noted that although it was questionable whether Mr Bărbulescu could have had a reasonable expectation of privacy in view of the company’s internal regulations prohibiting personal use of company equipment, of which he had been informed, an employer’s instructions could not reduce private social life in the workplace to zero. The right to respect for private life and for the privacy of correspondence continued to exist, even if these might be restricted in so far as necessary. The Grand Chamber specified the criteria to be applied by domestic courts when assessing whether employee monitoring is proportionate to the aim pursued by an employer and whether the employee concerned is protected against arbitrariness (paragraph 121 of the judgment).
Having regard to those considerations, the Grand Chamber concluded that the domestic courts had failed to strike a fair balance between the interests at stake, and had not adequately protected Mr Bărbulescu’s right to respect for his private life and correspondence.
The decision serves as a reminder to employers of the importance of having a clear phone, email and internet usage/monitoring policy in place, which gives employees advance notice of any monitoring of their communications, as well as the purpose of such monitoring, and sets out the extent (if any) to which company equipment can be used for personal purposes. Ideally, employees should receive a copy of this policy as part of their induction training, and give their written acknowledgement that they have read and understand it. It should also be readily accessible at all times on a company’s intranet or employee handbook.
It’s worth noting that the Grand Chamber’s decision was wholly concerned with how the domestic courts had dealt with Mr Bărbulescu’s complaint of an infringement by his employer of his right to respect for private life and correspondence in an employment context, and whether there was a violation of Article 8 of the Convention. The Court did not consider whether there was a breach of EU data protection law, which also restricts the ability of employers to carry out monitoring of employees.
Whilst employers have the right to monitor employees’ communications in the workplace, they should approach such monitoring with caution. In order to comply with both the ECHR and data protection laws, all employee monitoring should be transparent, fair, necessary, proportionate and not excessive, and carried out in the least intrusive manner possible (e.g. monitoring traffic data rather than content of data). Excessive monitoring, where an employer acts as a mistrustful big brother, is also likely to cultivate mistrust and a hostile working environment.