The manner in which an employee's personal messages on a work-related internet messaging account were monitored was a violation of an individual's right to privacy, according to a recent judgment issued by the Grand Chamber of the European Court of Human Rights (ECtHR).

In ruling that the Romanian courts had failed to adequately protect the employee's privacy rights enshrined in Article 8 of the European Convention on Human Rights (i.e. the right to respect for private and family life, the home and correspondence), the ECtHR overturned an earlier decision that the monitoring was proportionate to safeguarding the interest of the employer.

The judgment shows that well-communicated policies need to be in place providing a clear indication of what kind of internet communications are permitted in the workplace and of the measures that the employer can take to ensure compliance with such policies.

Bărbulescu v Romania: facts of the case

The case concerned Mr Bărbulescu, who was employed by a Romanian heating company as an engineer in charge of sales. Following his employer's request, Mr Bărbulescu set up a Yahoo messenger account (intended for professional use) to deal with client enquiries and was subsequently notified of the company's policies which prohibited the use of the company's IT equipment for personal purposes. The company's internal policies did not contain any reference to the possibility that employees' communications would be monitored.

The employer informed Mr Bărbulescu that it had monitored the content of his Yahoo Messenger communications and that it considered that the account had been used for personal messages. When Mr Bărbulescu replied in writing that the account had been used for professional purposes, the employer showed him a 45-page transcript of his personal communication with his brother and fiancée exchanged during that time. Mr Bărbulescu was subsequently dismissed for unauthorised personal use of the company’s internet.

Having exhausted the avenues of redress in Romania, Mr Bărbulescu brought a claim against the Romanian government in the Lower Chamber of the ECtHR which dismissed his claim holding that the Romanian courts had struck a fair balance between Mr Bărbulescu's Article 8 privacy rights and the business interests of the employer.

The Grand Chamber's decision

Mr Bărbulescu took the case to the Grand Chamber of the ECtHR which concluded that the domestic courts did not give adequate protection to Mr Bărbulescu's right to privacy and so they failed to strike a fair balance between the competing interests at stake. There had therefore been a violation of Mr Bărbulescu's Article 8 privacy rights.

In delivering its judgment, the court considered that when domestic courts are dealing with the issue of the proportionality of employer monitoring of communications, the factors to take into account include (amongst others):

  • Notification about the monitoring of communications: The ECtHR considered that it was clear that Mr Bărbulescu had been informed of the company's policy which prohibited the use of the workplace messenger service for private communications and that other had been dismissed for contravening that policy. However, Mr Bărbulescu did not appear to have been given advance notice of the nature and extent of the monitoring activities and of the fact that the employer may access the actual content of the messages.
  • The extent of the monitoring and the degree of intrusion into the employee's privacy: The ECtHR stated that the Romanian courts failed to make a distinction between the monitoring of the flow of the employee's communications (i.e. internet and email traffic or usage) and the monitoring of their actual content.
  • Examining whether the employer has provided legitimate reasons for the monitoring of the employee's communications: To the ECtHR's view, there had been no sufficient assessment of whether the monitoring of the content of the employee's communications could be justified. The reasons provided by the company (such as the need to avoid damage to IT systems) were only theoretical and there was no evidence that Mr Bărbulescu exposed the company to risk.
  • The possibility of carrying out employee monitoring activities by using less intrusive methods: The question of whether the employer's internal regulations and policies could be adhered to without the need to access the full content of the employee's communications had not been considered by the national courts.
  • The consequences of the monitoring of the employee's communications and the manner the monitoring is used by the employer: The domestic courts had not given sufficient consideration to the seriousness of the consequences of the monitoring of Mr Bărbulescu's communications (i.e. Mr Bărbulescu's dismissal).

Remedy

The court also considered Mr Bărbulescu's application for pecuniary damages and found that there was no causal link between the violation found and the alleged damage suffered (i.e. the wages Mr Bărbulescu would have been entitled to had the dismissal never occurred). Mr Bărbulescu's claim for non-pecuniary damages was also rejected with the court holding that the finding of a violation was sufficient to satisfy any non-pecuniary damage suffered by Mr Bărbulescu.

Comments

This decision reaffirms the importance of having clear and comprehensive company policies in place setting out the circumstances in which the monitoring of employees' communications is permitted and the extent to which such monitoring is allowed. These must be brought to the attention of employees to ensure that they have read and understood the same.

It also shows the need for company policies and internal regulations to explain the measures the employer can take to enable the monitoring of employees' communications. One of the reasons why Mr Bărbulescu's arguments succeeded was the fact that he was not made aware of the nature and extent of the monitoring of his personal communications prior to the commencement of the monitoring. It was therefore open to question whether Mr Bărbulescu was left with a reasonable expectation that his privacy would be respected and protected as a result of the manner in which the monitoring was carried out by the employer.