In Bărbelescu v Romania, the European Court of Human Rights ruled that companies have a right to monitor their employees’ internet usage during working hours. What does this ruling mean for employers, and under what circumstances can employers lawfully monitor their employees' private messages?

Introduction

In Bărbelescu v Romania, the European Court of Human Rights (ECtHR) ruled that companies have a right to monitor their employees’ internet usage during working hours. In this case, an employee had been fired for using an instant messaging service for personal use, in breach of internal policy. 

The media has sparked outrage by suggesting that employers now have carte blanche to access their employees' private messages. This is not correct. 

So what does this ruling mean for employers, and under what circumstances can employers lawfully monitor their employees' private messages?

The facts

  • A Romanian national, B, created a Yahoo Messenger account at his employer’s request so he could respond to clients’ enquiries.
  • The employer monitored B’s Yahoo Messenger chats over a week long period and saw that he had used the account for personal purposes (for example, exchanging messages with his brother and fiancée), contrary to the employer’s internal policy.
  • B denied that he had used Yahoo Messenger for anything other than professional purposes.
  • The employer terminated B’s employment for breach of the internal policy.
  • There were various court battles in Romania. Ultimately, the ECtHR was asked to determine whether the employer’s actions were in breach of B’s right to respect for his private life and correspondence under Article 8(1) of the European Convention of Human Rights (Article 8).
  • Although there was some dispute, the courts found that the employer had given prior notice of the internal policy prohibiting private use of the Yahoo Messenger account to B.

The decision

The ECtHR decided that: 

  • Article 8 was engaged – so in looking at the Yahoo Messenger chats, the employer needed to act proportionately; and
  • there was no violation of Article 8 in this case; it was not unreasonable for an employer to want to verify that employees are completing their professional tasks during working hours.

Importantly, the ECtHR found that B’s employer had only accessed his account in the belief, based on what B had told the employer, that it contained client-related communications only.

Does this ruling give employers the green light to read their employees' emails and instant messages?

No. This ruling tells us what we already knew: workplace monitoring should only take place where the employer has previously told the employees what their policy is and that communications may be monitored, and taking into account whether monitoring is proportionate (eg limited to relevant time periods). 

In addition, this ruling does not directly affect more onerous data privacy and related restrictions on monitoring. In countries like Germany, for example, the monitoring of electronic communications may in certain circumstances also be subject to stricter telecoms secrecy obligations.

Do companies need to change the way they monitor their employees or investigate allegations of misconduct?

This depends on what your policies currently say. The key is to manage your employees’ expectations. You should check that your internal policies:

  • are made available to employees when they join the business;
  • make it clear what restrictions apply to the use of electronic systems (e.g. no personal use vs. some limited personal use);
  • say that the employer may access and read employees’ communications (and the circumstances in which they might do so); and
  • say that disciplinary action may be taken against employees who do not comply with the policy.

If the employer intends to review an employee’s emails or communications, it should prepare a detailed note (an impact assessment) in advance, setting out the basis for, and limitations to, the review. This is useful evidence if the employee were ever to challenge the employer’s actions on the basis of Article 8 or through a data privacy-related complaint. 

After Bărbelescu v Romania, it is clearer that the right to private life and correspondence will almost always be engaged in the context of workplace communications and that unregulated and disproportionate monitoring of employee communications will take employers to the wrong side of the line. 

If you do not comply with your own internal policies on data protection and employee monitoring, your employees may be able to resign and claim constructive dismissal.

What can employees do to protect themselves?

  • Use their own device when sending private messages or using social media. Use 3G or 4G, rather than the employer's WiFi, as WiFi is part of a company’s internal systems, over which the employer will have control.
  • Mark personal emails or communications as private.
  • Review and understand their employer’s policy on the use of electronic systems and monitoring.