There has been an important judgment in the area of employee privacy and monitoring at work. At the end of the summer, the Grand Chamber of the European Court of Human Rights (ECtHR) considered the judgment of the Fourth Section in Barbulescu v Romania (application 61496/08).

Mr Bogdan Mihai Barbulescu had been asked by his employer to sign up to the Yahoo! Messenger service to respond to customer enquiries. The employer’s internal regulations did not permit the personal use of computers, the Internet or telephones, and employees were informed that misconduct would be monitored. In 2007, the employer monitored the Yahoo! messaging service used by Mr Barbulescu and discovered that he had used it to communicate with his fiancé and his brother. He was dismissed.

Mr Barbulescu brought proceedings in his domestic courts and was unsuccessful. He applied to the ECtHR, where he argued that there had been a breach of the right to respect for his private life and correspondence. As the employer was a private company the question was whether or not the Romanian courts had properly considered Article 8. In January 2016, the Fourth Section of the ECtHR agreed that Article 8 was engaged in this case, but that there had been no violation by the courts.

The Grand Chamber reconsidered the question and concluded that there had been a failure by the domestic courts to apply Article 8. In particular, it found that the courts had not considered the scope of the monitoring, the degree of the intrusion into the applicant’s privacy, that he had not been told that the employer might have access to the actual content of messages, and that there had not been a sufficient assessment of whether the monitoring was justified.

This decision does not mean that it is never permissible to monitor employee’s communications. However, there are key factors that must be considered to ensure monitoring is compatible with Article 8 of the Convention. The factors highlighted in the judgment are:

1.     Whether the employee has been notified of the possibility that the employer might   take measures to monitor correspondence and other communications, and of the implementation of such measures.[1]

2.     Whether the notification is clear about the nature of the monitoring and is given in advance.[2]

3.     The extent of the monitoring by the employer and the degree of intrusion into the employee’s privacy. A distinction should be made between monitoring of the flow of communications and of their content.[3]

4.     Whether all communications, or only parts, have been monitored.[4]

5.     Whether the monitoring is limited in time.[5]

6.     The number of people who have access to the results of the monitoring.[6]

7.     Whether the employer has provided legitimate reasons to justify monitoring the communications and accessing their actual content.[7]

8.     Whether it would have been possible to establish less intrusive methods of monitoring other than direct access of the content of communications.[8]

9.     The consequences of the monitoring for the employee.[9]

10. Whether the employee had been provided with adequate safeguards, especially when the employer’s monitoring operations are of an intrusive nature.[10]

If you are interested in any further information or advice, please contact my clerks on 020 3179 2023 or privacylawbarrister@proton.me

[1] paragraph 121(i) of the judgment.
[2] Ibid.
[3] paragraph 121(ii) of the judgment.
[4] Ibid.
[5] Ibid.
[6] Ibid.
[7] paragraph 121(iii) of the judgment.
[8] paragraph 121(iv) of the judgment.
[9] paragraph 121(v) of the judgment.
[10] paragraph 121(vi) of the judgment.