A landmark decision was issued yesterday (Judgement Bărbulescu v. Romania), a source of debate in the media, in which the European Court of Human Rights clarified the restrictions on monitoring employees in the workplace.

In a nutshell, employers need to be aware of the following:

  • It is not sufficient to have a general policy (such as an internal regulation) whereby (a) there is blanket ban on personal use of company resources and (b) employees are generally notified of (potential) monitoring of e-mail correspondence and other communication;  
  • The relevant notification and/or policy set up at company level should be specific and clear about the nature of the monitoring, in the sense that it should detail, in advance:  
    • if there is monitoring of the correspondence or of the content, as well;  
    • if all communication or only part is monitored;  
    • if the monitoring is limited in time and who the people are who will have access to such communication;  
    • the consequences of this monitoring for the employees;  
    • the use made by the employer of the results of this monitoring.  
  • The employer should be able to justify and provide a legitimate reason/interest for the monitoring. The Court underlines that the monitoring of the content of communications requires weightier justifications from the employer.  
  • A theoretical reason/interest such as the general need to avoid the company's IT systems being damaged, or potential liability being incurred by the company in the event of illegal activities, does not amount, in the Court's view, to an actual reason/interest.  
  • Employers should be mindful that a general advance notification about monitoring, included in an internal policy, does not appear to satisfy the requirement of an actual, specific interest/reason. Thus, employers are likely required to run the test of the legitimate interest/reason and will need to check the prior notification requirement before engaging in a monitoring session of its employees' communications.  
  • The employer should assess, in light of the particular circumstances of each case, whether the pursued aim can be achieved without directly accessing the full contents of an employee's communications.

The decision ruled by the European Court of Human Rights is available here.