The Grand Chamber of the European Court of Human Rights (ECtHR) has held that the monitoring of personal messages on a work-related internet messaging account did breach the Article 8 right to privacy.
We reported on the ECtHR's first decision in Bărbulescu v. Romania  ECHR 61 in Issue 1 of the UK Employment Law Round-up (see here). To recap, Article 8(1) of the European Convention on Human Rights (ECHR) states that "everyone has a right to respect for his private and family life, his home and his correspondence". Article 8(2) provides that a public authority shall not interfere with the exercise of the right to privacy "except such as is in accordance with the law and is necessary in a democratic society" in the interests of national security, public safety or the economic wellbeing of the country; for the prevention of disorder or crime; for the protection of health or morals; or for the protection of the rights and freedoms of others. The right to respect for correspondence under Article 8 protects the right to communicate and the confidentiality of private communications. This covers letters, email and telephone conversations at work.
The first decision of the ECtHR in Bărbulescu found that Mr Bărbulescu's right to respect for private life and correspondence had been engaged. However, since he was aware of his employer's rules prohibiting the use of the company's IT systems for personal purposes, his employer was entitled to dismiss him for the same. His employer was entitled to verify that he was working during working hours. Further, it had accessed his messaging account, in the belief that it contained only work-related communications.
Upon being heard by the Grand Chamber the ECtHR held the Romanian court had not adequately protected Mr Bărbulescu's right to respect for his private life and correspondence. It had failed to strike a fair balance between relevant competing interests.
The ECtHR held that "private life" should be defined broadly, to include professional activities, or activities taking place in a public context. "Correspondence" should also be construed broadly, and include internet messaging.
In this case, while the employer had strictly prohibited personal use of its IT equipment, and had a system for monitoring use to enforce the ban, Mr Bărbulescu was not informed in advance of the nature and extent of the monitoring, or the possibility the employer might have access to the content of his communications. There was therefore a reasonable expectation of privacy and Mr Bărbulescu's Article 8 rights were engaged and had been violated.
The ECtHR held the following factors were relevant in deciding if a fair balance was struck between the competing interests:
- Has unequivocal notification of monitoring been given in advance?
- What is the extent of the monitoring and the degree of intrusion into the employee's privacy?
- Has the employer provided legitimate reasons to justify monitoring the communications?
- Would it have been possible to establish a monitoring system based on less intrusive methods?
- What are the consequences of the monitoring for the employee and what use has the employer made of the results?
- Has the employee been provided with adequate safeguards?
What does this mean for employers?
This judgment has swung the pendulum back in support of the employee. But, as we advised in Issue 1, provided the monitoring of employees' use of the internet and their communications sent during work time is reasonable and proportionate, it is likely to remain permissible. Employers should also bear in mind the key factors that the ECtHR held were relevant in deciding if a fair balance was struck between the competing interests. These factors are likely to also be relevant if employees rely on the provisions of the Data Protection Act 1998 and / or the Regulation of Investigatory Powers Act 2000 to challenge monitoring by their employers, as may be more likely in the UK.