Case update (3): Human rights and monitoring at work

Summary: Is the right to respect for private and family life breached if employers monitor employees’ personal communications at work?

No, subject to reasonableness/proportionality, says the European Court of Human Rights (ECHR) in Bărbulescu v Romania available here.

Facts: The employee, Mr Bărbulescu, worked for a private company in Romania as a sales engineer. At his employer’s request, Mr Bărbulescu set up a Yahoo Messenger account so that he could respond to clients’ enquiries. Company rules made it clear that using computers for personal purposes was not permitted.

About three years later the employer told Mr Bărbulescu that his Yahoo account had been monitored for a period of just over a week and that the records showed that he had used it for personal purposes on the company’s computer during working hours. Mr Bărbulescu denied this in writing. When presented with a print-out of his personal messages, Mr Bărbulescu alleged that the employer had breached the:

• Romanian Criminal Code, which provides that any unlawful interception or opening of someone else’s communications shall render the perpetrator liable to imprisonment; and

• Romanian Labour Code on disciplinary proceedings, which states that an employer has the right to monitor the manner in which their employees completed their professional tasks, but at the same time the employer has a duty to guarantee the confidentiality of an employee’s personal data.
  

In any event the employer dismissed Mr Bărbulescu for breach of policy. Mr Bărbulescu challenged his dismissal as void on the basis that the employer’s decision was based on information obtained unlawfully.

After courts in Romania decided that there had been no breach of the Romanian Criminal Code or the Romanian Labour Code on disciplinary proceedings, the case went to the ECHR to decide whether the employee’s right to respect for private life and correspondence under Article 8 of the ECHR had been infringed.

The ECHR decided that there was no violation of Article 8. Romanian law struck a fair balance between employees’ rights and employers’ interests. It was not unreasonable for an employer to verify that employees were completing their professional tasks during working hours and the employer had accessed the account thinking that it contained client-related communications only. The employer looked at the content only in response to the employee’s challenge.

Implications: This case confirms that there is no blanket right to complete privacy in the workplace. The key issue in respect of human rights is often whether, on the facts, the employee has a reasonable expectation of privacy. If an employer puts their employees on notice that privacy may be restricted (with reference to specific policies or employer actions), this is generally enough to restrict an employee’s Article 8 rights.

This case is also a useful reminder and affirmation of the legal position in the UK which is that monitoring is not permitted unless there is an objective justification for doing so. Further that any monitoring carried out must be proportionate and legitimate.

In terms of monitoring generally, the Data Protection Act rules (which are reflected in the Information Commissioner’s Employment Practices Code), covering issues such as ensuring proportionality; impact assessments; limiting employer access; and informing staff, must always be considered. Clear internet usage policies are essential and any multi-national employers also need to bear in mind that the legal restrictions on employee monitoring may vary quite considerably across different jurisdictions.