“Private Messages at work can be read by EU Employers” – To what extent does the recent ECtHR ruling effect employers and employees in the UK?
The European Court of Human Rights (“ECtHR”) recently published its judgment in the case of Bărbulescu v Romania (61496/08) confirming that, in certain circumstances, employers are permitted to monitor employees’ personal communications in the workplace.
Since then, the media have created a lot of hype in relation to the judgment with headlines such as “Big Brother or Big Boss?”, “Bosses free to spy on emails”, and “Right to spy on an employee’s private messages”. So does this case really mean that employers now have free reign to access their employees’ private messages? In short, no. So what does the ruling actually say and what effect will it have, if any, on employers and employees in the UK?
Mr Bărbulescu was asked by his employer to set up a Yahoo Messenger account. The company’s IT policy made it clear that employees were forbidden to use company equipment, including computers, for personal purposes and the Yahoo account was to be used for business purposes only. However, during a weeklong period of monitoring, the employer uncovered personal use of the account. Mr Bărbulescu was subsequently informed and although he initially denied in writing that he had been using the account for personal purposes, during his disciplinary process, he was presented with a 45 page transcript of the communications, which included exchanges with his family concerning personal matters, and as a result, he was dismissed.
Mr Bărbulescu claimed that the monitoring of his Yahoo Messenger account amounted to a breach of Romania’s Criminal Code. His claim was rejected by the Court on the grounds that his employer had complied with the dismissal process provided for by the Labour Code and that he had been appropriately informed of the company’s IT policy. Mr Bărbulescu appealed the decision, claiming that his employer had violated his rights to a private life and correspondence under Article 8 of the European Convention on Human Rights and his appeal went all the way to the ECtHR.
The ECtHR’s Decision
Even though the ECtHR considered that Article 8 was engaged on the basis that Mr Bărbulescu’s privacy and correspondence had clearly been affected, the ECtHR determined that it was not unreasonable for his employer to monitor it’s systems for the purpose of ensuring that employees were fulfilling their professional duties. It was concluded that the Romanian courts had struck a fair balance between Mr Bărbulescu’s rights under Article 8 and his employer’s interests and as a result, the ECtHR ruled that there had been no breach of Article 8.
What does this mean for UK employers and employees?
Contrary to the recent press reports, this judgment does not set a precedent for employers to monitor employees’ private messages on social media or other messaging forums with complete freedom, or seize an employee’s personal smart phone and go through its contents. Rather, it reflects the current UK data protection law, which already takes into consideration the proportionality of monitoring as well as the employee’s personal rights: there is no overarching right to privacy which allows employees to do what they like at work when using an employer’s IT systems, provided the use is private, but in order for any such communications to be monitored the judgment underlines the importance of having appropriate and properly considered policies in place. As such, when formulating any such policy, employers should consider what types of monitoring are or could be carried out? Who has authority to carry out the monitoring? For what purposes can monitoring be carried out? Further, any such policy should be properly communicated to all employees. Employees should be given sufficient information in relation to how their information may be collected and the ways in which it may be further processed, such as when information about their email use will be obtained; why it is being obtained; how this information will be used; and to whom it will be disclosed.
Employees must ensure that they review, understand and act in accordance with their employer’s policies on the use of electronic systems and monitoring. As illustrated by the dissenting judge in this case, it is important that a balance is struck which allows employees to manage their work and home lives concurrently but within reason. Employers should recognise that policies should allow for a reasonable amount of flexibility and recognise that a blanket ban on personal internet usage at work is unlikely to be practical, particularly in roles where employees are expected to work long hours. It is also important to note that while Mr Bărbulescu’s summary dismissal was fair under Romanian law, it does not necessarily follow that a UK employment tribunal would conclude that his breach of the company’s IT policy was sufficiently serious to justify termination of employment without notice.
It is unclear at this stage whether the decision will be subject to review by the Grand Chamber of the ECtHR. Nevertheless, as it stands, the ruling tells us nothing more than we already knew. The judgment is helpful insofar as it confirms that employee communications may be monitored where employees do not have a reasonable expectation of privacy. It does not mean, however, that employers have free reign to review employees’ personal internet usage or emails.