Member Article

European Court of Human Rights Considers an Employer's Right to Monitor Employees

In its recent judgment Bărbulescu v. Romania, the European Court of Human Rights ("ECHR") considered an employer's right to monitor an employee's work computer and an employee's right to privacy. Although the ECHR ruled in the case that Article 8 of the European Convention of Human Rights ("Convention") which provides for the right to privacy was not breached, the judgment should not be interpreted broadly as grounds for surveillance of employees in all situations, as was recently stressed by Slovenian Information Commissioner. The Slovenian Information Commission further reiterated that the right to privacy in Slovenia is a strict one since Article 37 of the Slovenian Constitution states that only the law may prescribe the suspension of the right to the protection of the privacy of correspondence and other means of communication for a set time on the basis of a court order.

The facts in Bărbulescu v. Romania were somewhat different than in previous privacy cases heard by the ECHR which held that Article 8 of the Convention was breached through the monitoring of employee communications at work. In the case of Bărbulescu v. Romania, the employer banned any use of a work computer for private purposes. When the employer suspected that Bărbulescu was not complying with this policy and informed him of its suspicion, Bărbulescu denied the breach of the policy. Only after that did the employer obtain and present Bărbulescu with a transcript of his Yahoo Messenger communications, from which it was evident that Bărbulescu had used his Yahoo Messenger account for private purposes, although the employee had to use the services on his work computer for communicating with clients. The employer argued that Bărbulescu violated the workplace prohibition on the use of work equipment for private purposes as well as his contractual employment obligations. The ECHR agreed with the finding of the domestic court that the surveillance was legitimate as the employer acted within its disciplinary powers in accessing the Yahoo Messenger account, on the assumption that it was being used for professional purposes only. Furthermore, the use of the transcript was limited since the identification of the people involved was kept confidential. The ECHR also decided that monitoring of Bărbulescu's communications was limited in scope and proportionate as only communications on Yahoo Messenger were examined, while other data and documents, stored on Bărbulescu's computer were not subject to the surveillance. It was also clear that Bărbulescu did not have any reason to use Yahoo Messenger for private purposes at work.

The ECHR did not assess the employer's actions and whether they were justified, but it did address Romania's positive obligation to protect an employee's right to privacy. The ECHR ruled that Bărbulescu's right to privacy was sufficiently protected since the content of the transcript was not disclosed and the names of the people involved in the private conversations were not revealed. Furthermore, the ECHR did not address at what point in time Bărbulescu should have been informed of the surveillance – either before or after the surveillance took place, although this was an issue between the employer and Bărbulescu.

The Bărbulescu v. Romania judgment has not fully addressed all relevant issues in relation to surveillance of an employee's data and communications leaving several questions open. In light of this decision, we recommend that any surveillance of an employees' communications be limited to the minimum extent necessary, under the condition that consent of the employee is obtained up-front and that internal rules governing such surveillance are put in place in order to mitigate the risks of a potential breach of privacy rights.

 

Link to article