In September 2017, the European Court of Human Rights (the ECHR) overturned a January 2016 decision of its lower court regarding employee privacy in the workplace. The case, Barbulescu, concerned the monitoring of employee communications in the workplace and if the monitoring was excessive in light of the employee’s expectation of privacy. The impact of this reversal could prove significant in the context of employers’ obligations to safeguard employee privacy rights.
Mr Barbulescu was employed as an engineer. He was asked by his employer to set up an instant messenger account for work purposes. The employer subsequently monitored Mr. Barbulescu’s messenger usage and observed that Mr. Barbulescu was contacting his brother and fiancée for personal reasons. Mr. Barbulescu denied the allegations. The employer then provided a transcript of the personal messages to Mr. Barbulescu. Following this, he was dismissed for using the employer’s resources for personal purposes. The employer cited his actions as a “violation of the company’s internal regulations”.
Mr. Barbulescu alleged that this was a breach of his right to privacy, as protected under Article 8 of the European Convention on Human Rights (the Convention). Mr. Barbulescu was unsuccessful in his applications to the domestic courts and subsequently referred the matter to the ECHR.
The Chamber of the ECHR issued its judgment in January 2016, acknowledging, as a preliminary point, that employees can have a reasonable expectation of privacy in the workplace.
Significantly, the Chamber distinguished Barbulescu’s case from previous case law namely the Copland and Halford cases. In those cases, the employer was explicit about the prohibition on using company resources for personal purposes.
The Chamber engaged in a balancing exercise between the privacy rights of the individual and the legitimate interests of the company to prove an alleged breach of discipline.
The Chamber held that the Romanian courts had struck a fair balance between the competing rights of the employee and employer. Its reasoning was that Mr. Barbulescu had assured his employer that the use of the messenger service was solely for professional purposes and the employer, when accessing the messages, would have anticipated the messages to only contain work-related information.
The Chamber held that the domestic courts had maintained an appropriate balance between the privacy rights provided for under Article 8 of the Convention and the interests of the employer.
Appeal by the Grand Chamber
On appeal, the Grand Chamber of the ECHR overturned the earlier decision of the Chamber.
In an 11-to-6 decision, the Grand Chamber largely agreed with the earlier reasoning that:
- the Article 8 right to privacy was at issue
- A balance needed to be struck between the competing rights
However, the Grand Chamber held that the earlier courts had failed to include a number of key considerations in striking the correct balance.
The Grand Chamber took the opportunity to develop the law in this case between privacy and employment rights. In particular, the Grand Chamber decided that the following factors must be considered in determining if an employee’s right to privacy prevails over an employer’s legitimate interests in monitoring communications:
- If an employee received prior notice about any monitoring activity. The method of notice is not prescribed but the notice must be clear regarding the nature of the monitoring and must be in advance.
- Consideration should be given to the breadth and depth of the monitoring. In determining a breach of privacy, a distinction should be drawn between an employer monitoring the flow of communications against actually reading the content of personal communications. It is also necessary to consider whether there was a restriction on the individuals who could conduct the monitoring and also whether the monitoring was limited in terms of categories and time.
- If an employer has provided legitimate reasons justifying monitoring the employee’s communications and content. According to the Grand Chamber, a greater degree of justification will be required where the employer proposes to actually read or intercept the content of any communications.
- If a less intrusive method achieving the same result could be used. This is in line with general data protection rules that processing should be adequate, relevant and not excessive.
- The consequences and impact that monitoring will have on the employee and the use to which the result may be put. For example, where an employee could be dismissed as a result of the findings of monitoring, then a higher standard of privacy may be needed to be afforded to the employee or the consequences need to be very clearly explained to an employee.
- If an employee has been provided with adequate safeguards, particularly where the monitoring activity is deemed to be intrusive. On this point, the Grand Chamber noted that the employer cannot access the actual content of the communications concerned unless the employee has been notified in advance of the employer’s intent to do so.
Employers should examine pre-existing privacy laws in the workplace on monitoring employees’ communications. Given this decision, employers should not have an unrestricted monitoring policy. The relevant policy must not unnecessarily impinge on privacy rights and must explain to the employee:
- the scope and type of monitoring engaged in, for example, does the employer monitor the flow of communications or does it also monitor the content of these communications
- the reasons why the monitoring is deemed necessary, for example, for potential disciplinary procedures or for cybersecurity purposes
- the possible consequences of using the results of the monitoring, for example, if that data can be used in a disciplinary procedure resulting in dismissal
Although the decision of the ECHR is not binding, it may provide a guide to the Irish courts in future and, if followed, could strengthen the privacy rights of employees.