Contributors
The European Court of Human Rights has decided in Barbulescu –v- Romania [2017] EHCR 742 that monitoring an employee's emails was a breach of his right to respect for his private life and correspondence. The case concerned the dismissal of an employee for sending personal emails on work equipment in breach of the employer's policy, and the alleged failure of the Romanian courts to protect his right to respect for his private life and correspondence under Article 8 of the European Convention on Human Rights.
Background
Article 8 of the European Convention on Human Rights provides that everyone has the right to respect for his private and family life, his home and his correspondence. Such right can only be interfered with in limited circumstances.
The right to respect for correspondence amounts to a right to communicate without interception or screening by a third party and the European Court of Human Rights (ECHR) has previously held that it covers letters, email and telephone conversations, including at work.
The ECHR has, for example, found a breach when a police inspector's telephone calls were tapped after she had received an assurance that her calls would not be monitored (Halford –v- UK) and where there was no IT policy in the workplace and the employee was not told that they might be monitored (Copland –v- UK). In both cases, it was found that the employee had a reasonable expectation of privacy.
Facts
From 1 August 2004 to 6 August 2007, Mr Barbulescu was employed as a Sales Engineer in his employer's Bucharest office. At his employer’s request, he created an instant messaging account to respond to customers' enquiries, using Yahoo Messenger (an online chat service offering real-time text transmission over the internet). He already had another personal Yahoo Messenger account.
The employer's internal regulations prohibited the personal use of company resources, including the personal use of computers, but did not mention the possibility of the employer monitoring communications. Mr Barbulescu signed a copy of the regulations in December 2006.
On 3 July 2007, the Bucharest office received and circulated a note from the employer's head office. The note reminded employees that they should not use the company's computers for non-work related matters, referred to an employee who had been disciplined for breach and notified them that misconduct would be carefully monitored and punished. However, like the internal regulations, there was no express statement about the extent of the monitoring or that the content of communications would be monitored. This note, too, was signed by Mr Barbulescu.
Between 5 and 13 July, Mr Barbulescu's Yahoo Messenger communications were monitored. On 13 July, he was informed of the monitoring and that there was evidence that he had used the internet for personal purposes, in breach of the internal regulations. At that stage, he was not informed whether the monitoring of his communications had also concerned their content. His response was that he had only used Yahoo Messenger for work-related purposes.
The employer then provided him with a transcript of the messages which he had exchanged with his brother and his fiancée during the period when he had been monitored; the messages related to personal matters and some were of an intimate nature. The transcript also included five messages that Mr Barbulescu had exchanged with his fiancée using his personal Yahoo Messenger account; these messages did not contain any intimate information.
Mr Barbulescu's employment was terminated on 1 August 2007. He brought a claim in the Bucharest County Court.
Bucharest County Court decision
Relying on Copland v. the United Kingdom, Mr Barbulescu argued that an employee’s telephone and email communications from the workplace were covered by the notions of “private life” and “correspondence” and were therefore protected by Article 8 of the Convention. He also submitted that the decision to dismiss him was unlawful and that by monitoring his communications and accessing their contents his employer had infringed criminal law.
The County Court rejected his application and confirmed that his dismissal had been lawful. The monitoring of the Yahoo Messenger conversations could not undermine the validity of the disciplinary proceedings.
As Mr Barbulescu had maintained during the disciplinary investigation that he had not used Yahoo Messenger for personal purposes, an inspection of the content of his conversations was the only way in which the employer could ascertain the validity of his arguments. In a note, which Mr Barbulescu had signed, employees had been notified that another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes and had been warned that their activities were being monitored. The employer could not be accused of showing a lack of transparency and of failing to give its employees a clear warning that it was monitoring their computer use.
Mr Barbulescu appealed to the Bucharest Court of Appeal.
Bucharest Court of Appeal decision
Mr Barbulescu repeated his arguments before the County Court and also argued that that court had not struck a fair balance between his interests and his employer's interests. He further argued that neither the internal regulations nor the information notice had contained any indication that the employer could monitor employees’ communications.
The Court of Appeal dismissed the appeal. It acknowledged that there was a conflict between the employer's right to engage in monitoring and the employees’ right to protection of their privacy. However, it could not be said that the legitimate aim of ensuring the smooth running of the company could have been achieved by any other means than by breaching the secrecy of Mr Barbulescu's correspondence, or that a fair balance was not struck between the need to protect his privacy and the employer’s right to supervise the operation of its business. Mr Barbulescu appealed to the ECHR.
The decision of the Fourth Section of the ECHR
Mr Barbulescu submitted that his dismissal had been based on a breach of his right to respect for his private life and correspondence and that, by not finding that his dismissal was unlawful, the Romanian courts had failed to comply with their obligation to protect that right.
The Chamber which heard the appeal found there was no breach of Article 8:
- As regards a reasonable expectation of privacy, it found that the circumstances differed from Copland and Halford as Mr Barbulescu's employer strictly prohibited employees from using company computers and resources for personal purposes.
- The courts had found that he had committed a disciplinary offence by using the internet for personal purposes during working hours and the employer had accessed the contents of Mr Barbulescu's communications only after he had declared that he had used Yahoo Messenger for work-related purposes.
- The employer’s monitoring activities had been limited to his use of Yahoo Messenger.
Mr Barbulescu appealed to the Grand Chamber of the ECHR.
The Grand Chamber's decision
The Grand Chamber upheld the appeal by 11 votes to 6.
The concept of a "private life" in Article 8 should be construed broadly and could include professional activities. The importance of an individual's working life in constructing his or her social identity by developing relationships with others was noted.
"Correspondence" was not qualified by any adjective in the wording of Article 8 and covered telephone calls, whether such calls are made from or received on business premises, emails sent from the workplace and information derived from the monitoring of a person’s internet use. The Yahoo Messenger service was just one of the forms of communication enabling individuals to lead a private social life.
States should ensure that the introduction by an employer of measures to monitor correspondence and other communications, irrespective of the extent and duration of such measures, is accompanied by adequate and sufficient safeguards against abuse.
The Grand Chamber identified the following factors as relevant:
- Whether the employee has been notified that the employer might monitor correspondence and other communications. Such notification should normally be clear about the nature of the monitoring and be given in advance;
- The extent of the monitoring and the degree of intrusion into the employee’s privacy. For example, did it include the content of communications? Which communications were monitored? What was the duration of monitoring? How many people had access to the results?;
- Whether the employer has provided legitimate reasons to justify monitoring the communications and accessing their actual content. As monitoring the content of communications is more invasive, it requires weightier justification;
- Whether it would have been possible to establish a monitoring system based on less intrusive methods and measures than directly accessing the content of the employee’s communications;
- The consequences of the monitoring for the employee subjected to it and the use made by the employer of the results of the monitoring operation; and
- Whether the employee had been provided with adequate safeguards, especially when the employer’s monitoring operations were of an intrusive nature.
Applying the above factors, the Grand Chamber found that the conclusion reached by the Fourth Section of the ECHR was questionable:
- Mr Barbulescu did not appear to have been informed in advance of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual content of his messages. To qualify as prior notice, the warning from the employer must be given before the monitoring activities are initiated;
- The scope of the monitoring and the degree of intrusion into Mr Barbulescu's privacy was not examined by the Romanian courts;
- The Romanian courts did not appear to have carried out a sufficient assessment of whether there were legitimate reasons to justify monitoring the communications.
- The Romanian courts did not sufficiently examine whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the actual contents of the communications;
- The Romanian courts did not consider the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings. Here it was dismissal, the most severe disciplinary sanction; and
- The Romanian courts did not determine whether, when the employer summoned Mr Barbulescu to explain his use of the internet, it had in fact already accessed the contents of the communications in issue.
However, although the Grand Chamber found that there was a breach of Article 8, there was no causal link between that breach and the loss claimed as a result of the dismissal and accordingly no damages were awarded. It also considered that the finding of a violation was a sufficient outcome for any non-financial damage that may have been sustained by Mr Barbulescu.
Comment
In the UK, there are already limitations placed on employers' powers to monitor private communications (eg the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000) which employees may find more effective than attempting to rely directly on Article 8.
It is worth noting that the factors to be taken into account when conducting an impact assessment in respect of monitoring communications (as recommended in the Information Commissioner's Employment Practices Code) reflect the factors the Grand Chamber considered to be relevant in the context of protecting individuals' Article 8 rights.
Employers should therefore review their policies and procedures to ensure that they are sufficiently clear about the nature and extent of any monitoring to be carried out (before such monitoring takes place) and the implications for employees of breach of any restrictions. Employers should also consider whether they have legitimate aims for monitoring (and not, as the Grand Chamber noted, some hypothetical aim) and that the monitoring is not unnecessarily intrusive. Further, employers should bear in mind that, if they are monitoring employees, the rules will be much more stringent when the EU General Data Protection Regulation (GDPR) comes into force on 25 May 2018.
Finally, the Grand Chamber's comment that an employer’s instructions cannot reduce private social life in the workplace to zero is also of interest. We will have to wait and see how this may be interpreted and clarified in future cases.
