What does this cover?
In Bărbulescu v Romania (61496/08  ECHR 61) the European Court of Human Rights (ECtHR) considered whether an employee's right to respect for his private life and correspondence under Article 8 of the European convention on Human Rights (ECHR) had been breached by his employer's monitoring of a Yahoo Messenger account which had been set up for professional purposes. The ECtHR has confirmed that employers can monitor their employees' activities provided appropriate steps are taken to limit their expectation to privacy.
Mr Bărbulescu created a Yahoo account to respond to client queries at his employer's request. The employer's internal regulations prohibited any personal use of the Account, along with all other IT facilities. In July 2007 the employer informed Mr Bărbulescu that his communications had been monitored, and that the employer was aware that he had been using the Account for personal purposes, contrary to the internal regulations. In response Mr Bărbulescu denied any personal use and asserted that the Account had been used for professional purposes only. Mr Bărbulescu was subsequently presented with a 45 page transcript containing details of messages which he had exchanged with his fiancée and brother over an eight day period which were clearly of a personal nature. The transcript also contained details of five particular messages Mr Bărbulescu had exchanged with his fiancée using a personal Yahoo Messenger account. Mr Bărbulescu's employment was terminated on the basis of his breach of the internal regulations. He challenged his termination before the Romanian courts, however he was unsuccessful.
The ECtHR's decision
The ECtHR's remit was to consider whether the Romanian courts had had proper regard for Mr Bărbulescu's right to respect for his private life under Article 8 of the ECHR. The ECtHR noted that in its previous decisions it had consistently held that employees had a reasonable expectation of privacy in their communications unless they had been warned about the possibility of monitoring. In the current case, it was disputed between the parties as to whether Mr Bărbulescu had been warned about potential monitoring. In any event, the ECtHR focussed on whether Mr Bărbulescu could have a reasonable expectation of privacy when he was specifically on notice that personal use of the IT systems was prohibited. In reaching its decision the ECtHR was persuaded by the fact that the domestic courts had assessed employer's monitoring as legitimate as it had been conducted in the belief that the Account was being used for professional purposes. Overall the ECtHR concluded that the courts had struck a fair balance between the employee's right to respect for his private life under Article 8 and his employer's interests.
The ECtHR's decision is unsurprising and follows a line of cases which establish the limitations on an employee's expectation of privacy in the workplace. In the UK, the Data Protection Act 1998 (as expounded through Part 3 of the Information Commissioner's Employment Practices Code) and the Regulation of Investigatory Powers Act 2000 provide a framework for legitimate employer monitoring, and surveillance of some form is commonplace, particularly among regulated employers. The more interesting aspect of this case was the employer's monitoring of the employee's personal Yahoo account; the boundaries of how far monitoring can extend to an employee's activity using personal accounts are currently unclear. Regrettably, this aspect did not feature in any detail in the ECtHR's decision.
What action could be taken to manage risks that may arise from this development?
If organisations are carrying out employee monitoring, employers should ensure that appropriate steps are taken to limit employees' expectation to privacy. Employers should take special care with regards to the monitoring of personal accounts due to the lack of clarity in this area.