The European Court of Human Rights has confirmed that employers do not have the unfettered right to monitor their employees’ private communications whilst at work in the case of Barbulescu v Romania. Although the Court found in favour of the employee in this case, it does not mean that employee monitoring is unlawful altogether. Employers may still be able monitor workplace emails and internet usage provided that employee consent is obtained in advance. Note that the way in which consent is obtained will need to be reviewed given the impact the General Data Protection Regulation, which is due to come into force in May 2018, will have on this issue.
- An employer’s access to its employees’ electronic communications on the employer’s IT systems without first obtaining employee consent may be unlawful and amount to a breach of the Right to Privacy under Article 8 of the European Convention on Human Rights. Where employers intend to monitor employee communications in this way, they should ensure they have prior consent from employees to do so. Employment contracts should be reviewed to ensure they state that the employer may monitor electronic communications sent and/or received by the employee and to confirm that the employee consents to such monitoring..
- Employers should also have a clear internet, email and communications policy in place and are well-advised to ensure that the terms of this policy are brought specifically to employees’ attention (possibly during an induction programme or some other form of in-house training). The policy should set out the reasons why electronic communications are monitored and state that work emails/messages should not be used for personal purposes.
- Where an employer does allow personal use of its I.T. systems, employees should be clearly advised to mark any personal emails/messages as ‘private & confidential’.
- Employers should take legal advice before accessing an employee’s electronic communications which are marked as ‘private & confidential’.
Mr Barbulescu worked for a company in Romania as an engineer in charge of sales. At his employer’s request, he created a Yahoo Messenger account to respond to customer enquiries. The employer’s computer usage policy stated that employees could not use company computers and telephones for personal purposes.
In July 2007, the employer informed Mr Barbulescu that it had been monitoring his computer and telephone usage for around a week, during which time it had discovered that he had been using the internet and company telephones for personal purposes. In particular, he had been using the Yahoo Messenger account whilst at work to send and receive personal instant messages to family members, including his fiancée (some of which contained intimate content). As a result, Mr Barbulescu was dismissed for breaching his employer’s computer usage policy.
Mr Barbulescu challenged his dismissal in the Romanian courts, claiming that his employer had not only violated Romanian law, but also Article 8 of the European Convention on Human Rights - which protects the right to respect for private and family life. Mr Barbulescu argued that his employer should not have monitored his internet usage or accessed his Yahoo account, which was password protected, or reviewed sensitive personal emails without his knowledge or consent.
Having received no redress in the Romanian domestic courts (which all found that his employer had been entitled to access his electronic communications and to dismiss him), Mr Barbulescu took his case to the European Court of Human Rights which again dismissed it. The judges found that there had been no violation of his rights and that his employer had acted reasonably.
Mr Barbulescu appealed to the European Court of Human Rights’ Grand Chamber. In considering whether Mr Barbulescu had a reasonable expectation to privacy in the particular circumstances, the Grand Chamber overturned the Court’s previous decision and found in his favour, acknowledging that his privacy had been breached. It held that the manner in which the communications were monitored did not give adequate protection to Mr Barbulescu’s right to privacy and so was disproportionate and unlawful. The Grand Chamber also acknowledged that a fundamental problem with the employer’s approach to monitoring was that it had not informed the employee in advance that his communications could be monitored. This was despite the fact that it was beyond doubt that Mr Barbulescu knew that what he was doing was strictly prohibited by his employer’s computer usage policy.
Whilst UK judges are not bound by the European Court of Human Rights’ rulings, they are required to take them into account. Employers should therefore be alive to the risks that an unfettered approach to monitoring private communications sent and/or received by employees whilst at work could pose.