In the age of social media, the recent decision of the European Court of Human Rights in the case of Barbulescu v Romania attracted considerable press attention. Various publications suggested that it gave employers free reign to rifle through an employee’s personal communications.
According to a report in the Guardian, a spokesman for the Council of Europe felt compelled to issue a statement regarding the “inaccurate scare stories” which had “set something of a new benchmark” in terms of the reporting of human rights cases.
Contrary to the headlines, the case does not create a new right for employers to “snoop” on their employee’s personal communications. It remains necessary to explore whether an employee had a reasonable expectation of privacy in their communications and whether any interference with the right to privacy is proportionate.
Background
Mr Barbulescu was employed by a private company as an engineer with responsibility for sales. He was asked to create a Yahoo Messenger account to respond to client enquiries. His employer informed him that his communications had been monitored over an eight-day period and suggested that he had used the internet for personal reasons, contrary to internal regulations.
Mr Barbulescu responded that he had only used the Yahoo Messenger account for professional purposes. His employer presented him with a 45-page transcript of his communications on Yahoo Messenger. This contained personal communications with his fiancée and his brother. The transcript also included short messages between Mr Barbulescu and his fiancée using a personal Yahoo Messenger Account.
Mr Barbulescu was dismissed for breaching his employer’s internal regulations which outlawed the use of their “computers, photocopiers, telephones, telex and fax machines for personal purposes.”
Mr Barbulescu challenged his dismissal on the grounds that his employer had violated his right to correspondence enshrined by the Romanian Constitution and the Criminal Code. After his case was dismissed by the County Court and the Bucharest Court of Appeal, he complained that the domestic courts had failed to protect his Article 8 right to privacy.
The European Court of Human Rights was asked to examine whether the state had failed to protect his right to privacy. The court decided by a majority that although the right to privacy was engaged, the level of interference was proportionate.
Right to privacy
The court acknowledged that “the notion of private life” is a broad concept which may encompass communications in the workplace. It referred to earlier case law which held that in the absence of a warning that an employer may monitor electronic communications an employee would have a reasonable expectation of privacy in their telephone calls, emails and internet usage. Mr Barbulescu’s case was unusual in that his employer expressly prohibited any personal usage of their computer systems.
The court explored whether Mr Barbulescu retained a reasonable expectation of privacy, notwithstanding his employer’s internal regulations which outlawed any personal use of the computer systems.
There was a dispute as to whether the possibility of monitoring had been drawn to Mr Barbulescu’s attention and whether the relevant notice was sufficiently clear. The court also considered the fact that transcripts of Mr Barbulescu’s communications, which contained details of his health and sex life, had been used to justify his dismissal.
Although the domestic courts did not refer to the precise content of those communications in their findings, the court was satisfied that the right to privacy was engaged.
Proportionate interference
The court then moved to consider whether a fair balance had been struck in domestic law between Mr Barbulescu’s right to privacy and his employer’s legitimate interests. It noted that the monitoring took place in the context of disciplinary proceedings and had occurred in order to establish whether the employee was using his employer’s systems for personal reasons. Mr Barbulescu had maintained that he had only used the Yahoo messenger account for professional purposes.
The transcripts were produced as evidence before the domestic courts to prove that he was using his employer’s systems for personal reasons. The precise content of the communications was “not a decisive element in the domestic courts’ findings.”
The court found that it was not unreasonable for the employer to want to check that Mr Barbulescu was completing professional tasks during working hours and that the level of interference was proportionate as the monitoring was limited in scope and other data and documents stored on his computer were not examined.
There was “nothing to indicate that the domestic authorities failed to strike a fair balance, within their margin of appreciation, between the applicant’s right to respect for his private life under Article 8 and his employer’s interests.”
Relevance to UK employers
The Barbulescu case therefore confirms key principles in relation to monitoring of which employers will already be aware. Employees have a reasonable expectation of privacy in their communications in the workplace. In order to reduce that expectation of privacy, employers must explain to employees that their communications may be monitored. The policy must be notified to the employee and clear in its scope and application.
In the court’s minority dissenting judgment in Barbulescu, concern was expressed as to the “extremely vague character” of the notice and whether the employee was made aware of it before monitoring occurred. The comments in the dissenting judgment, albeit not binding, are instructive.
The employer was criticised for failing to identify “the minimum elements of an internet usage and surveillance policy, including the specific misconduct being monitored, the technical means of surveillance and the employee’s rights regarding the monitored materials.”
Employers who undertake monitoring of electronic communications must ensure their employees are informed of the extent to which the privacy of their communications at work is curtailed. Even if employees are aware of such monitoring, it must be carried out for a legitimate purpose and proportionate to the employer’s objective.
The Information Commissioner’s Employment Practices Code contains detailed guidance as to how systematic and occasional monitoring should be carried out and emphasises the importance of carrying out an impact assessment whereby an employer will balance its monitoring objectives against the impact on the employee with a view to adopting the least intrusive approach. UK employers would also need to have regard to legislation governing the interception of communications in the course of transmission.
Employers cannot embark on a trawl of an employee’s electronic workplace communications without restraint and without purpose. The court’s decision in Barbulescu was focused on whether the State, rather than the employer, had safeguarded the employee’s privacy rights in connection with Mr Barbulescu’s attempts to challenge the legality of his dismissal.
It remains unclear why his employer had accessed his personal Yahoo account as well as the professional account. There was some suggestion on both sides that the relationship had broken down before the disciplinary process. Transcripts of sensitive communications had also fallen into the hands of his colleagues. These matters were highlighted in the dissenting judgment but not explored fully in the majority decision.
While the case helpfully confirms the importance of qualifying an employee’s expectation of privacy and adopting a proportionate approach to any monitoring, it cannot be seen as a template that employers should follow without running the risk of claims.
Barbulescu v Romania