On 22 February 2018, the European Court of Human Rights (ECHR) decided a case concerning the alleged violation of Article 8 of the European Convention on Human Rights (the Convention) in the context of controlling an employee’s personal files stored on the hard drive of his work computer. The judgment of the ECHR (in French) can be accessed here and the press release (in English) can be accessed here.
The applicant, Eric Libert, is a French national who had been working at the French railway company SNCF. In 2007, Mr Libert had been temporarily suspended from his duties because his employer found that Mr. Libert’s work computer contained, inter alia, address change certificates drawn up for third persons and bearing the official Surveillance unit logo, and a large number of files containing pornographic images and films. He was dismissed from his post on 17 July 2008. After being unsuccessful before the national courts, Mr. Libert lodged an application with the ECHR against the French Government while primarily relying on Article 8 (right to respect for private and family life) of the Convention.
Firstly, the ECHR noted that the SNCF allowed its staff to occasionally use the computer facilities placed at their disposal for private purposes and that, hence, certain data stored in the work computer might be deemed “private”.
Secondly, the ECHR pointed out that the French Government did not dispute the interference with Mr. Libert’s right to respect for his private life. Since SNCF is a public-law entity supervised by the State, the ECHR conferred upon it the status of a public authority within the meaning of Article 8 of the Convention. Therefore, the case at hand is distinct from the case of Barbulescu v. Romania [GC], no. 61496/08 of 5 September 2017, in which a private-sector employer had infringed the right to respect for private life and private correspondence.
Thirdly, according to the ECHR, positive law at the material time allowed for employers to open files contained in employees’ work computers unless such files had been identified as personal. Furthermore, employers had the right to open files identified as personal in case there was a serious risk or in exceptional circumstances in which case such files could only be opened in the presence of the employee concerned or after the latter had been duly informed. The ECHR stated that the domestic courts had applied that principle since the files had not been duly identified as being private.
In the case at hand, the pornographic images and films had been found in a file stored in a hard drive under the default name “D:/données” which had been titled on Mr. Libert’s computer as “D:/données personelles”. The ECHR stated that the French court of appeal was right in considering that an employee could not have used a whole hard drive, which was supposed to record professional data, for private use and that the generic term “personal data” could have referred to work files being processed personally by the employee and might therefore not have explicitly designated elements related to private life. Furthermore, according to the ECHR, the French court of appeal was right in pointing out the fact that the User’s Charter laid down that private information should be clearly identified as such (“private” option in the Outlook criteria).
The ECHR concluded that the domestic authorities had not overstepped the margin of appreciation available to them, and there had therefore been no violation of Article 8 of the Convention.