72: European Court of Human Rights holds that monitoring of employee’s personal messages on work-related account infringed his privacy rights

Under Article 8 of the European Convention on Human Rights, everyone has the right to respect for their private and family life, and correspondence.

In Barbulescu v Romania, the Grand Chamber of the European Court of Human Rights overturned the Court’s previous ruling and held that an employee’s Article 8 right had been breached when he was dismissed after his employer monitored his work-related messaging account and discovered that he had used it to send personal messages.

Mr Barbulescu was employed by a Romanian heating company as a sales engineer. At his employer’s request, he set up a Yahoo Messenger account to deal with client enquiries. The company’s policies prohibited personal use of all IT equipment, but did not refer expressly to the possibility that the content of employees’ communications would be monitored or intercepted. Whilst monitoring Mr Barbulescu’s messenger account for a week, the company found intimate messages sent to his fiancee and brother, and subsequently dismissed him for unauthorised personal use of the internet. Mr Barbulescu’s claim for breach of his right to respect for privacy and correspondence reached the appeal chamber of the European Court of Human Rights.

The Grand Chamber ruled that the Romanian courts had not adequately protected Mr Barbulescu’s right to respect for his private life and correspondence. The Court confirmed that the terms ‘private life’ and ‘correspondence’ should be defined broadly to include an individual’s professional life. Although in this case the employer had prohibited personal use of its IT equipment, Mr Barbulescu was not informed of the nature and extent of monitoring to enforce this ban, or of the possibility that the employer would access the content of his messages. The Court observed that employers cannot totally eliminate employees’ private social life in the workplace, and the right to respect for private life and correspondence therefore continues despite any restrictions in their IT policies.

The Court also held that when domestic courts are considering the proportionality of an employer’s monitoring of correspondence and other communications, the following factors are relevant:

• whether sufficient notification about monitoring has been given in advance;
• the extent of the monitoring and the degree of intrusion into the employee’s privacy. A distinction should be made between the monitoring of the flow of communications and of their content;
• whether the employer has provided legitimate reasons to justify monitoring communications and accessing their content;
• whether it would have been possible to monitor employees using less intrusive methods, for example, without accessing the content of messages;
• whether adequate safeguards were in place to protect employees; and
• the consequences of monitoring for employees.

Taking these factors into account, the Grand Chamber held that, by failing to uphold Mr Barbulescu’s unfair dismissal claim, the Romanian courts had failed to strike a fair balance between his Article 8 rights and his employer’s interests.

Only a few member states, including the UK, have implemented legislation regulating the power of employers to monitor employees’ private communications. The Employment Practices Code issued by the Information Commissioner under the Data Protection Act 1998 already recommends that employers consider the factors outlined by the Grand Chamber. As this case illustrates, it is vital that employers have well-drafted policies which specify very clearly what internet and social media communications are prohibited, and how usage will be monitored. Employers must also ensure that these policies balance their own business interests with the need to protect employees’ privacy.