The claimant in Barbulescu v Romania worked for a private company in Romania as a sales engineer. At his employer’s request, he set up a Yahoo Messenger account so that he could respond to clients’ enquiries. Company rules made it clear that using computers for personal purposes was not permitted. About three years later the employer told him that his Yahoo account had been monitored for a period of just over a week and that the records showed that he had used it for personal purposes on the company's computer during working hours. When the claimant challenged this, he was presented with a transcript of messages (some of which were very personal). He was dismissed for breach of the company’s regulations.

After courts in Romania decided that there had been no breach of the Romanian Labour Code on disciplinary proceedings, the case went to the European Court of Human Rights to decide whether the employee's right to respect for private life and correspondence under Article 8 of the European Convention on Human Rights had been infringed.

The European Court decided that there was no violation of Article 8.  Romanian law struck a fair balance between employees' rights and employers' interests. It was not unreasonable for an employer to verify that employees were completing their professional tasks during working hours and the employer had accessed the account thinking that it contained client-related communications only. The employer looked at the content only in response to the employee's challenge. 

In the UK, courts and tribunals have to interpret legislation in line with the Human Rights Act, which includes the Article 8 right.   This means it is relevant to unfair dismissal, for example. The EAT in Atkinson v Community Gateway Association in 2014, a case with facts not dissimilar to Barbulescu, decided that emails that had been discovered during the employer's disciplinary investigations did not amount to an unjustified interference with the employee's private life. The key issue is often whether, on the facts, the employee has a reasonable expectation of privacy.

In terms of monitoring generally, the Data Protection Act rules (which are reflected in the Information Commissioner's Employment Practices Code), covering issues such as ensuring proportionality; impact assessments; limiting employer access; and informing staff, must also be considered. Clear internet usage policies are essential and multi-national employers also need to bear in mind that the legal restrictions on employee monitoring may vary quite considerably across different jurisdictions.