The European Court of Human Rights has confirmed that employers may, in some circumstances, monitor employees’ personal communications in the workplace.

On 12 January 2016, the European Court of Human Rights (“ECtHR”) issued its judgment in the case of Bărbulescu v Romania (61496/08), in which it confirmed that employers are permitted to monitor employees’ personal communications in the workplace, in certain circumstances. The case comes at a time when it is increasingly common for employees to have access to company-owned networks and systems. Many employers wish to ensure that those networks and systems are being used properly, both in terms of security and employee productivity. This decision provides critical clarity on how to address these issues, although employers should bear in mind that this remains a complex topic in many European jurisdictions.

The Facts

Mr Bărbulescu, is a Romanian national. Between 2004 and 2007, he was employed by a private company in Romania in a sales role. At the request of his employer, he created a Yahoo Messenger account, in order to respond to enquiries from customers. The employer had implemented a policy that prohibited the use of company IT systems for personal purposes. In July 2007, the employer informed Mr Bărbulescu that it had monitored communications sent via his Yahoo Messenger account, and discovered that he had been using the account to send personal messages.

Mr Bărbulescu provided a written response, stating that he had only used the Yahoo Messenger account for professional purposes. The employer then provided a 45-page transcript of communications sent via the account, which contained correspondence between Mr Bărbulescu and his brother and fiancée, and included details of personal matters such as his health and sex life. The employer then terminated Mr Bărbulescu’s contract of employment, citing his breach of company policy.

The Issues

Mr Bărbulescu alleged that the employer’s monitoring of his Yahoo Messenger account amounted to a violation of his private correspondence, in breach of Romania’s Criminal Code. The Bucharest County Court rejected his claim. He appealed, ultimately to the ECtHR, on the grounds that, by monitoring his correspondence, his employer had violated his rights to ‘private life’ and ‘correspondence’, set out in Article 8 of the European Convention on Human Rights.

The ECtHR’s Decision

The ECtHR considered that Article 8 was engaged, on the basis that Mr Bărbulescu’s privacy and correspondence had clearly been affected by the employer’s monitoring of the Yahoo Messenger account. However, the ECtHR concluded that it was not unreasonable for the employer to monitor its systems for the purpose of ensuring that employees were fulfilling their professional duties during the working day. In particular, the ECtHR noted that the employer had initially accessed Mr Bărbulescu’s account on the understanding that it contained only professional communications, as required by the employer’s policy. The ECtHR therefore concluded that the Romanian courts had struck a fair balance between Mr Bărbulescu’s rights to private life and correspondence under Article 8, and his employer’s legitimate interests. Consequently, the ECtHR concluded that there had been no breach of Article 8.

This decision is interesting, not least because it materially differs from the earlier ECtHR decisions in cases such as Halford v UK (20605/92) and Copland v UK (62617/00). In those cases, employees successfully claimed that their respective employers had infringed their Article 8 rights by monitoring communications made using company IT systems. The key distinction is that, in those cases, the employer had permitted the use of company IT systems for personal purposes, whereas in Bărbulescu, the employer had explicitly forbidden all personal use of its IT systems.

How should employers react?

The decision in Bărbulescu does not give employers a green light to monitor their European employees. Rather, it confirms the existence of a qualified basis on which employees may be monitored, in certain circumstances. Employers should bear in mind that the monitoring of European employees can be a delicate issue, which sits at the intersection of human rights law, employment law and data protection law.

The first step an employer should take before monitoring its European employees is to ensure that appropriate notice has been provided. All affected employees should be given sufficient information to understand the ways in which their information may be collected and further processed, including:

  • why they are being monitored (e.g., to ensure security of company IT systems; to evaluate employee productivity; or to ensure compliance with company policies);
  • how they will be monitored (e.g., CCTV cameras; telephone monitoring; location tracking; or network monitoring);
  • where they will be monitored (e.g., whether the monitoring is limited to the workplace, or whether it also affects company cars, laptops or mobile devices); and
  • how any information gathered through monitoring may be used (including the fact that such information may be used as evidence in disciplinary proceedings; the categories of third parties to whom such information may be disclosed; and the duration for which such information may be retained).

Notice to employees should be provided in a format that is appropriate to the context of the monitoring (e.g., CCTV monitoring should be notified with highly visible signs in the locations in which cameras are used, whereas monitoring of IT systems should be notified using logon banners or other appropriate mechanisms).

Employers should also ensure that any monitoring activities are reasonable, and proportionate to the purposes notified to employees. In general, monitoring activities must only be as broad as necessary, and only last for as long as necessary, to achieve those specified purposes. Special care should be taken wherever an employer has reason to believe that its monitoring activities are likely to collect information relating to the private lives or correspondence of employees.

Lastly, it remains unclear at this stage whether the decision in Bărbulescu will be subject to review by the Grand Chamber of the ECtHR. Given that one of the judges in the ECtHR issued a strongly worded dissenting opinion, there appears to be a very real possibility that the decision could be reviewed and, perhaps, overturned. Employers that engage in monitoring activities in Europe should therefore keep these developments under review.