The European Court of Human Rights (ECHR) delivered its most recent determination on the issue of employee privacy and email monitoring in the case of Barbulescu v Romania (Case 61496/08). The Grand Chamber of the ECHR held that there had been a violation of Article 8 of the European Convention on Human Rights (the Convention) where an employer monitored and accessed personal emails sent by an employee during business hours from his Yahoo Messenger account, using company property without notifying the employee in advance that monitoring would take place.
A 2016 ruling from a lower division of the ECHR held that there had been no violation of article 8 of the Convention.
The Grand Chamber of the ECHR overturned this decision holding that there had been a violation of article 8. In reaching its decision the court noted a number of key issues the domestic courts had failed to determine: whether the claimant had received prior notice; whether there were legitimate reasons to justify the monitoring; if there were such reasons, whether the employer could have used measures entailing less intrusion into the employee's personal life and correspondence; and, whether the emails might have been accessed without his knowledge.
The court raised the question of whether the claimant could have a reasonable expectation of privacy in light of his employer's restrictive regulations on internet use (of which he had been informed) but ultimately felt that an employer's instructions could not reduce private social life in the workplace to zero. The right to respect for private life and for the privacy of correspondence continued to exist, even if these may be restricted in so far as necessary.
Taking all of the above into consideration the court felt that an appropriate balance had not been struck between the competing interests of the employer and the employee and that the employee's right to respect for private life had not been adequately protected
Tips for employers
The case is a timely reminder of the importance for employers of having a clear telephone, email, internet usage policy in place. Given the ECHR decision, as a matter of best practice such a policy should, at a minimum inform employees:
- of the extent and nature of the employer's monitoring or the possibility that the employer might have access to the actual content of his messages;
- of the nature and purpose of any monitoring;
- that any monitoring is necessary, proportionate and not excessive; and
- that monitoring is carried out in the least intrusive manner possible ( i.e. the traffic of data is monitored as opposed to the content of it).