Commenting on the European Court of Human Rights’ case decision in Bărbulescu v. Romania, which confirmed employer access to private messages sent using a corporate messaging system was not a breach of Article 8 HRC Right to Privacy, Paula Barrett, head of data privacy at law firm Eversheds, says:
"This decision provides a very timely reminder of the importance of clear communication to staff about permitted use of corporate systems and devices, and the access to and monitoring of those tools which may occur. Here, the employer had issued a clear statement that private use was not permitted. Few employers do that. In fact, a lot are silent on topic or, following the historic example of corporate telephones, permit some private use.
“The time has come for employers to reconsider carefully whether they still allow corporate systems and devices to be used for private purposes. When the workforce concerned is highly likely to have their own mobile devices through which to conduct private communications, the perceived benefit is becoming far outweighed by the legal risks and burdens the employer takes on under data protection and other laws.
“It may come as a surprise to some employers that there was any question about whether access was lawful. In reality access to and monitoring of employee communications is now fraught with the complexities of balancing the corporate employers’ needs with employees’ rights under data protection, human rights, communication and other laws. These all impact not only the ability to lawfully access, but also the ability to use the data concerned in proceedings.
“In this case the context was disciplinary. However, a lot of businesses are also currently seeking to deploy tools (often internationally) to protect their information assets and increase security, and hit similar issues on compliance with data protection and communication laws that are only made more difficult where there is potential personal use of corporate systems. This does impact on the ability to roll out the tools lawfully, as well as the businesses’ ability to use the data obtained.
“With forthcoming changes in data protection law likely to strengthen the protection afforded to employee data and increase the compliance burden, it’s a good time for employers to consider whether to continue to permit private use and, in any event, to provide clear notice about access and monitoring of staff communications and the potential use that may be made of that data."
Mark Fletcher, employment law expert at law firm Eversheds, adds:
“The key factor from an international employment law perspective is that the Romanian employer had issued a clear policy statement restricting the use of the messaging service for company use. Global employers should take the time to review all communications policies to check they include clear usage statements, which comply with local laws. Unfortunately, employers cannot necessarily assume that restricting all employees’ private use from corporate systems and devices will be permitted in all jurisdictions. Employers also need to ensure that they take all necessary steps to implement the policies and, where relevant, engage with employee representative bodies to ensure such policies can be enforced against employees.
“Interestingly, the courts ruled in this case that it was permissible for the employer to submit transcripts of the employee’s communications to defend the dismissal. Employers need to tread carefully if using evidence obtained through monitoring when defending unlawful dismissal cases, because in some countries the courts may decide that evidence is inadmissible if it has been obtained through unlawful employee monitoring.”