The decision of the Grand Chamber of the Court of Human Rights handed down last week in Bărbulescu v Romania ([2017] ECHR 754) is a surprising one that acts as a warning to employers. The Court held that the Article 8 rights of an employee breached when his employer monitored his personal communications on Yahoo Messenger.

This was despite the fact that the company regulations prohibited the use of computers for personal purposes. The dissenting opinions from seven judges demonstrate the controversial nature of the decision: six of the judges thought it went too far and that, while Article 8 was engaged, it had not been breached on the facts of the case; Judge Karakas on the other hand thought it did not go far enough and that the employee was entitled to an award of damages as the finding of a violation alone was insufficient to afford him just satisfaction.

The Facts

The applicant, Mr Bărbulescu, was an engineer in charge of sales and had set up a Yahoo Messenger account – at his employer’s request – for the purpose of responding to customers’ enquiries. The employer’s internal regulations, which had been signed by Mr Bărbulescu on 20 December 2006, prohibited the use of company resources by employees for private purposes, although these internal regulations did not contain any reference to the employer monitoring employees’ communications.

On 3 July 2007 the employer circulated an information notice to all its employees which it asked they read and sign. This explained again that time at work should not be spent on personal matters and that “The employer has a duty to supervise and monitor employees’ work and to take punitive measures against anyone at fault” [15]. The evidence was that Mr Bărbulescu had signed at this document some point between 3 and 13 July 2007 (the precise date and time being apparently unknown).

On 13 July 2007 Mr Bărbulescu was informed that his Yahoo messenger communications had been monitored and that there was evidence that he had been using the Internet for personal purposes. He was not told whether the monitoring involved reading the contents of his messages.

Mr Bărbulescu denied that he had used it for personal purposes and saying that he had used Yahoo messenger for work-related purposes only. In response his employer sent him a transcript comprising of 45 pages of messages that he had exchanged with his brother and with his fiancée, some of which were of “an intimate nature”.

Mr Bărbulescu’s response was to notify his employer in writing that in his view it had committed a criminal offence by breaching the secrecy of correspondence. Mr Bărbulescu’s employment was subsequently terminated on 1 August 2007 for breach of the company’s internal regulations which forbid the use of “computers, photocopiers, telephones, telex and fax machines for personal purposes” (see [8] of Chamber Decision dated 12 January 2016).

Mr Bărbulescu brought a complaint against his dismissal which was rejected by the Bucharest county court. His appeal against that decision was dismissed.

Mr Bărbulescu then made an application to Strasbourg complaining of a breach of his Article 8 rights, claiming that his dismissal had been based on a breach of his right to respect for his private life and correspondence and that, by not revoking that measure, the domestic courts had failed to comply with their obligations to protect his Article 8 rights ([55] and [61]).

In January 2016 the Fourth Section of the ECHR held that while his article 8 rights were engaged, there was no violation as a fair balance had been struck between the respect for his private life and correspondence and his employee’s interests (see here for that decision). The Chamber took into account the fact that Mr Bărbulescu had been able to bring a complaint in the courts and that they had found that he had committed a disciplinary offence by using the internet for personal purposes during working hours. They also took into account the fact that the employer had only accessed the contents of Mr Bărbulescu’s communications after he had stated that he had only used Yahoo Messenger for work-related purposes (see [58] of Grand Chamber decision).

Judgment

On 6 June 2016 the case was referred to the Grand Chamber at Mr Bărbulescu’s request. A hearing took place on 30 November 2016 and the decision was handed down on 5 September 2017.

The majority judgment noted that the notion of “private life” may include professional activities and that it is in the course of their working lives that the majority of people have a significant, if not the greatest, opportunity to develop relationships with the outside world [71].  Furthermore the notion of “correspondence” is not qualified by any adjective unlike the term “life” and the Court had already held that no such qualification should be made in the context of correspondence by means of telephone calls. Telephone calls are covered by the notions of “private life” and “correspondence” within the meaning of Article 8.  In principle this is also true when they are made or received at work.

The same reasoning also applies to emails and information obtained about a person’s internet use [72].  The Court held on the facts of the case that Mr Bărbulescu’s communications were covered by the concepts of “private life” and “correspondence” [81].

The majority considered that the State had a positive obligation to ensure respect for private life and correspondence in an employment context. It noted that Contracting States must be granted a wide margin of appreciation in assessing the need to establish a legal framework governing conditions in which an employer may regulate electronic or other communications of a non-professional nature by its employees in the workplace [119].

However it then went on to say that this discretion “cannot be unlimited” and that domestic authorities should ensure that any introduction of measures to monitor communications should be accompanied by adequate and sufficient “safeguards against abuse” [120].

It listed the following six factors in [121] which it stated were relevant:

  • Notification of the monitoring: this should normally be clear about the nature of the monitoring and be given in advance;
  • Extent of the monitoring: a distinction should be made between monitoring the flow of communication and their content; whether all or only part of communications were monitored; the duration of the monitoring; and the number of people who had access to the resulting information;
  • Justification for monitoring: whether the employer had legitimate reasons for the monitoring. Monitoring the content of communications is more invasive and requires a weightier justification;
  • Necessity of methods and measures deployed: whether the aim of the employer could have been achieved by less intrusive measures and methods (e.g. without directly accessing the full contents of the employee’s communications);
  • Consequences for the employee: the use made of the monitoring and whether the results used to achieve the declared aim of the measure; and
  • Whether there were adequate safeguards: these should ensure that the employer cannot access the actual content of communications unless the employee has been notified in advance.

In Mr Bărbulescu’s case the interests at stake were his “right to respect for his private life and correspondence” and the employer’s “right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company” [132]. The majority referred to the following when finding that there had been a breach of Article 8:

  • It did not appear that Mr Bărbulescu had prior notice of the possibility that his communications on Yahoo Messenger might be monitored [133] & [140];
  • It did not appear that he had been informed of the extent and nature of the monitoring activities or that the content of his messages would be accessed [133].
  • Neither the county court nor the court of appeal had considered the scope and degree of intrusion into Mr Bărbulescu’s private life and that it appeared that all his communications had been monitored in real time, accessed and printed out [134];
  • Neither of the domestic courts had sufficiently considered whether there was any proper justification for such intrusive monitoring and the aim of the monitoring [135];
  • Nor did they consider whether this could have been achieved by less intrusive measures than accessing the content of the messages [136];
  • Nor whether the communications might have been accessed without Mr Bărbulescu’s knowledge [140];
  • The consequence for Mr Bărbulescu was that he received the most severe disciplinary sanction and was dismissed.

Consequently, the Court considered that the domestic authorities had failed to afford adequate protection to Mr Bărbulescu’s right to respect for his private life and correspondence and failed to strike a fair balance between the interests at stake [141].

Comment

There will be many who will be perplexed by the conclusion reached by the majority of the Grand Chamber on the facts and think that it is unduly harsh on the employer:  Mr Bărbulescu had known all along that use of Yahoo Messenger for personal purposes was prohibited, he had lied to his employers about his use of it and they had accessed the contents of his messages over a limited period of time to challenge this denial.  Others will no doubt argue that it would have been possible to challenge Mr Bărbulescu’s denial – initially at least – by less intrusive means, for example, accessing one personal message and simply informing him of its content rather than accessing such a large number and printing them all out.

However, the decision is not all bad news for employers as the Court has provided clear and useful guidance on how to monitor employees’ use of work communication systems. This in line with other recent decisions of the Court on how to balance Article 8 against other conflicting interests, such as Axel Springer AG v. Germany [GC], no. 39954/08, which sets out factors to take into account when dealing with the balance between Articles 8 and 10.

The guidelines set out by the Court conform with the relevant United Nations and Council of Europe standards and EU legislation.  Moreover, these are generally the same standards that will apply under the General Data Protection Regulation (“GDPR”). The Government has confirmed that the UK’s decision to leave the EU will not affect the commencement of the GDPR on 25 May 2018.   Employers should therefore act now, if they have not done so already, to put in place policies that comply with these guidelines and take steps to avoid the unfortunate pitfalls that beset Mr Barbulescu’s employers.

Sara Mansoori is a barrister at Matrix Chambers practising in Media and Information Law.