Monitoring personal communications on work systems

An employee’s right to respect for his private life was breached when his employer monitored and accessed personal communications he sent on a work-related Yahoo account.  

Speedread

An employee’s right to respect for his private life was breached when his employer monitored and accessed personal communications he sent on a work-related Yahoo account.  The employer did not appear to have informed him in advance of the nature and extent of the monitoring, nor that it would access the contents of his communications.  In addition, there had been insufficient consideration of whether the employer had legitimate reasons for monitoring and whether its aims could be achieved by less intrusive methods.   

Facts

At his employer’s request, Mr Bărbulescu created a Yahoo Messenger account to respond to client enquiries. Company rules stated that use of company computers for personal purposes was strictly forbidden.  The company circulated a notice reiterating this, indicating that misconduct would be carefully monitored and punished.  However, neither the rules nor the notice expressly stated the extent of the monitoring and that the content of communications would be monitored.   

Mr Bărbulescu was dismissed after his employer’s monitoring of his Yahoo communications revealed that he had used the internet for personal communications with his wife and brother in breach of company rules.  He challenged his dismissal in the Romanian courts but the courts dismissed his complaint, finding that his employer was entitled to monitor the use of work computers to check that he was doing his work properly and that he had been given adequate notice of his employer’s rules and of the fact that surveillance would be undertaken.

Mr Bărbulescu brought a claim against the Romanian Government in the European Court of Human Rights (ECHR), arguing that in finding his dismissal lawful the Romanian courts had failed to protect his right to respect for his private life and correspondence under Article 8 of the European Convention on Human Rights. The ECHR disagreed, ruling that whilst Article 8 was applicable, there was therefore nothing to indicate that the Romanian authorities had failed to strike a fair balance between the employer’s legitimate interests in monitoring and Mr Bărbulescu’s right to privacy.  

Mr Bărbulescu appealed to the Grand Chamber of the ECHR.

Decision

The Grand Chamber ruled that there had been a breach his Article 8 rights.  Employees have a right to privacy, even in the workplace.  Whilst an employer may restrict the right to a private life, insofar as it is necessary to do so, they cannot eliminate it entirely.   The courts must strike a fair balance between an employee’s right to a private life and an employer’s legitimate interests.   

In carrying out this exercise, the following factors are relevant:

• Prior notification of monitoring: Mr Bărbulescu’s employer did not appear to have informed him in advance of the extent and nature of its monitoring activities, nor of the possibility that it might access the content of his messages.
• Extent of the monitoring and the degree of intrusion into the employee’s privacy: a distinction should be drawn between monitoring the flow of communications (internet and email traffic usage) and their content. This had not been considered by the Romanian courts.
• Whether the employer has legitimate reasons to justify monitoring the communications and their actual content: monitoring the actual content requires weightier justification.  The Romanian courts had not made a sufficient assessment of this.  
• Whether it would have been possible to establish a monitoring system based on less intrusive methods: the courts had not considered whether the employer’s desired aim could have been achieved without accessing the full content of Mr Bărbulescu’s communications.  
• The consequences of the monitoring for the employee, and the use made by the employer of the result of the monitoring; in particular whether the results were used to achieve the employer’s desired aim. Insufficient consideration had been given to the seriousness of the consequences of the monitoring for Mr Bărbulescu (dismissal).

In the circumstances, the Romanian courts had not provided adequate protection for Mr Bărbulescu’s right to respect for his private life and had failed to strike a fair balance between his and his employer’s competing interests.  

Implications

In the UK we have long understood that employers should give prior notice to employees that their communications might be monitored. The ECHR warned that an employer should explicitly warn employees that communications may be monitored, about the extent of the monitoring (including whether the content of messages will be read) and when it may occur.  Employers must also have legitimate reasons to justify monitoring. In many cases, employers will only need to monitor internet/email traffic generally and will have no legitimate interest in the content of the messages themselves, in which case they should limit themselves to monitoring the former.  

Many UK employers’ policies warn employees that monitoring will occur, but do not go so far as to set out all of the matters discussed in the ECHR’s judgment.  Employers would be well-advised to review their policies and contractual terms to ensure that they are up-to-date and reflect these points.  Failing to do so might breach employees’ privacy.