Employers often wish to monitor how their employees use work computing facilities during office hours. In a recent judgment (Barbulescu v Romania application 61496/08, 12 January, 2016), the European Court of Human Rights ("ECHR") illuminates the circumstances that may justify employers monitoring employees' communication.
This legal insight provides a summary of the ECHR's decision and an overview of its consequences for the jurisdictions of Austria, Bulgaria, Croatia, Czech Republic, Hungary, Poland, Romania, Serbia, Slovakia, Slovenia and Turkey.
Case background and the ECHR's decision:
The employee created a Yahoo Messenger account at his employer's request, for the purpose of responding to client inquiries using this Yahoo Messenger account. The employer's policies prohibited the use of work accounts for personal purposes. The employer suspected misuse of the employee's messenger account, and accordingly started monitoring the employee's messages without the employee's knowledge, for a period during July 2007. The employer informed the employee that his Yahoo Messenger communications had been monitored and that the records revealed personal use of the messenger, including communication exchanged with his fiancée and brother. On 1 August 2007 the employer terminated the employment agreement for breach of the company's internal regulations. The employee challenged the termination before the courts arguing that by accessing and using personal messages, his employer had violated his right to private life under Article 8 ECHR, and that this invalidated his termination. The ECHR agreed with the employee that, notwithstanding his employer’s prohibition on private use of company accounts, his rights under Article 8 ECHR had been interfered with when his account and its contents were accessed by the employer. The Court decided, however, that the employer’s actions were justified: inter alia, the Court considered it reasonable for an employer to want to verify that employees are completing their professional tasks during working hours. Further, the Court found that the employer’s monitoring was limited in scope and proportionate considering that other than the Yahoo Messenger communications, no other data and documents were examined. In addition, the Court stated that the employee had not convincingly explained why he had used the Yahoo messenger account for personal purposes.
The decision triggered mass media coverage across European countries and raised issues particularly related to personal data protection. Legal perspectives and peculiarities of eleven different jurisdictions are concisely presented below. Most jurisdictions agree that ECHR's judgment does not imply a general and unconditional right of employers to monitor private online communication of employees, but is rather subject to a case-by-case consideration under national-specific rules and (yet to be established) practices. To avoid any unjustified invasion of privacy, employers are generally advised to define surveillance methods and related procedures in their internal acts and/or individual employment agreements.
Austria: The question of whether an employer may monitor an employee's communication without the employee's consent, depends on whether private use of work computing facilities is generally allowed by the employer or not. If private use is prohibited, the employer may legitimately expect only business related content in the employee’s emails or chat protocols. If private use is allowed, monitoring without the employees' prior consent is only allowed in exceptional cases for duly justified reasons (eg when a criminal act or other severe breach to the detriment of the employer is specifically suspected). Summarizing, the ruling does not have a significant impact on the current legal situation in Austria.
Bulgaria: If the case was brought before the Bulgarian courts, they would most likely adjudicate similarly to the ECHR, ie, that the assessment of the lawfulness of the dismissal should be made based only on relevant employment law, and that claims for breaches of the right to privacy and personal data protection should be referred to the criminal courts and to the Personal Data Protection Commission.
Croatia: The lawfulness of the dismissal would have to be considered (only) based on Croatian employment law, while the alleged violation of the employee's privacy would have to be referred to in separate proceedings.
Czech Republic: Pursuant to the Czech Labour Code, employees may not use the employer's business facilities and equipment for personal purposes without the employer's consent, as a result the employer is entitled to inspect such usage in an appropriate way. In case of breach of the employee's right to privacy, the employee would be entitled to defend his personal data protection and privacy rights (only) in separate proceedings.
Hungary: Similar to the Romanian court ruling, if the employee violates the (banned) private use of certain IT equipment at the workplace, such violation may constitute valid grounds for dismissal. With respect to the potential surveillance of employees' communication, Hungarian labour law allows employers to proportionally monitor their employees. If the employer violates data protection rights and/or the constitutional right to privacy, the employees may initiate separate civil and/or criminal proceedings protect their rights.
Poland: According to views expressed in Polish legal journals/writings, employers may inter alia monitor employees' business e-mails without their consent if the applied methods of monitoring are adequate and proportionate to the purpose of gathering information (eg protection of trade secrets). However, despite not being entitled to retrieve the content of the employees' personal e-mails, the employer may still verify the number of private emails sent during work time to supervise the employee's working time.
Romania: Despite the judgment of ECHR in Barbulescu, the potential infringement of the data privacy of employees' communications should still be assessed on a case-by-case basis - employers should not disregard their obligations provided under the Romanian data protection act, including informing employees on monitoring of their communication (and notifying the data protection regulator).
Serbia: The lawfulness of the dismissal would be based solely on the provisions of the Labour Act and internal rules of the employer. The issue of possible violation of the right to privacy would be the subject of separate proceedings from a data protection, criminal law and constitutional law aspect. Pursuant to unofficial opinions of the Serbian data protection authority, employers cannot review private correspondence of their employees made on their personal accounts, even if such account is also used for business purposes, unless in exceptional cases where employee have given their consent, in the event of a court order, or for the purposes of criminal proceedings or national security protection.
Slovakia: The Slovakian court would assess the lawfulness and validity of the dismissal in civil proceedings, whereas it remains questionable if the transcript of communication could be used as evidence. Allowed intrusion upon the privacy of an employee in the workplace by monitoring is limited under Slovak law. Provided the monitoring is non-compliant with Slovak law, the employee could protect its rights in separate civil and criminal proceedings, or by making a complaint to the Slovak Data Protection Authority.
Slovenia: While Slovenian courts have not yet dealt with the respective issue, the Slovenian Information Commissioner ("IC") has already issued numerous opinions referring to the permitted control over the electronic communication of employees. In its opinion, IC sets a clear distinction between (i) the actual content of the e-mails and (ii) the so called e-mail traffic data. As underlined by the IC, the employer lacks the legal basis to access either of the two. Whereas the supervision of employees' e-mail traffic data should occur only in exceptional instances, and has to be justified by the particular needs arising from the employment relationship, the content of communication may only be lawfully retrieved based on a consent given voluntarily.
Turkey: If a similar case was brought before Turkish courts, the court would probably find the dismissal to be unjust and award the employee all the pertaining payments. According to established case law, employers are not entitled to monitor an employee's work computers and e-mails. However, the content of the e-mails must be assessed to determine the justified grounds for the dismissal. If the content lacks any defamatory language and the like, the dismissal cannot be deemed justifiable.