A recent European Court of Human Rights ruling provides that employers must notify their employees in advance if their professional email accounts are to be monitored. The case Barbulescu v Romania concerned a Romanian man who was made redundant after it was found that he had used his work email address for personal correspondence. A full copy of the decision is worth a read and is available to view here.The employee challenged his employer’s decision to terminate his contract as he argued it was based on a breach of his right to respect for his private life and correspondence as enshrined in Article 8 of the Convention and that the domestic courts had failed to comply with their obligation to protect that right.Background
From 1 August 2004 to 6 August 2007 the employee was employed by a Romanian private company (“the employer”), as a sales engineer. At his employer’s request, for the purpose of responding to customers’ enquiries, he created an instant messaging account using Yahoo Messenger, an online chat service offering real-time text transmission over the internet. He already had another personal Yahoo Messenger account. The employer’s internal regulations prohibited inter alia….”personal use of computers, photocopiers, telephones or telex or fax machines“. The regulations did not contain any reference to the possibility for the employer to monitor employee communications. The employee signed copies of the Regulations in the workplace.
From 5 to 13 July 2007, the employer recorded the applicant’s Yahoo Messenger communications in real time and he was subsequently summoned by his employer to give an explanation. In the relevant notice he was informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes, in breach of the internal regulations. He informed his employer that he used Yahoo Messenger for work purposes only. He was subsequently called to another meeting whereby he was asked about his activity on 12 July 2007 in respect of using the company site for private purposes and produced forty five pages of private messages. It also contained some messages from his private yahoo messenger account whereby he had been communicating with his fiancee. The employee informed his employer that he felt they were breaching the secrecy of his correspondence and he was subsequently dismissed. The employee challenged his dismissal in the domestic courts which held his dismissal was lawful. The court of appeal affirmed the same.DecisionThe ECJ held by eleven votes to six that there had been a violation of Article 8 of the Convention. It provided inter alia:
133. “As to whether the applicant had received prior notification from his employer, the Court observes that it has already concluded that he did not appear to have been informed in advance of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual content of his messages……….With regard to the possibility of monitoring, it notes that the County Court simply observed that “the employees’ attention had been drawn to the fact that, shortly before the applicant’s disciplinary sanction, another employee had been dismissed” ………and that the Court of Appeal found that the applicant had been warned that he should not use company resources for personal purposes…….. Accordingly, the domestic courts omitted to determine whether the applicant had been notified in advance of the possibility that the employer might introduce monitoring measures, and of the scope and nature of such measures. The Court considers that to qualify as prior notice, the warning from the employer must be given before the monitoring activities are initiated, especially where they also entail accessing the contents of employees’ communications. International and European standards point in this direction, requiring the data subject to be informed before any monitoring activities are carried out………
134. As regards the scope of the monitoring and the degree of intrusion into the applicant’s privacy, the Court observes that this question was not examined by either the County Court or the Court of Appeal…….even though it appears that the employer recorded all the applicant’s communications during the monitoring period in real time, accessed them and printed out their contents……
135. Nor does it appear that the domestic courts carried out a sufficient assessment of whether there were legitimate reasons to justify monitoring the applicant’s communications. The Court is compelled to observe that the Court of Appeal did not identify what specific aim in the present case could have justified such strict monitoring. Admittedly, this question had been touched upon by the County Court, which had mentioned the need to avoid the company’s IT systems being damaged, liability being incurred by the company in the event of illegal activities in cyberspace, and the company’s trade secrets being discloseD……. However, in the Court’s view, these examples can only be seen as theoretical, since there was no suggestion that the applicant had actually exposed the company to any of those risks. Furthermore, the Court of Appeal did not address this question at all.
136. In addition, neither the County Court nor the Court of Appeal sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the actual contents of the applicant’s communications.
137. Moreover, neither court considered the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings. In this respect the Court notes that the applicant had received the most severe disciplinary sanction, namely dismissal.
138. Lastly, the Court observes that the domestic courts did not determine whether, when the employer summoned the applicant to give an explanation for his use of company resources, in particular the internet……., it had in fact already accessed the contents of the communications in issue. It notes that the national authorities did not establish at what point during the disciplinary proceedings the employer had accessed the relevant content. In the Court’s view, accepting that the content of communications may be accessed at any stage of the disciplinary proceedings runs counter to the principle of transparency……..
139. Having regard to the foregoing, the Court finds that the Court of Appeal’s conclusion that a fair balance was struck between the interests at stake……. is questionable. Such an assertion appears somewhat formal and theoretical. The Court of Appeal did not explain the specific reasons linked to the particular circumstances of the applicant and his employer that led it to reach that finding.
140. That being so, it appears that the domestic courts failed to determine, in particular, whether the applicant had received prior notice from his employer of the possibility that his communications on Yahoo Messenger might be monitored; nor did they have regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or to the degree of intrusion into his private life and correspondence. In addition, they failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into the applicant’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge……..
141. Having regard to all the above considerations, and notwithstanding the respondent State’s margin of appreciation, the Court considers that the domestic authorities did not afford adequate protection of the applicant’s right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake. There has therefore been a violation of Article 8 of the Convention.
