In November I will be Chairing a panel on Data Rights and the Rule of Law at the Information Law and Policy Centre’s Annual Conference at the Institute of Advanced Legal Studies. This got me thinking about data protection, privacy and the Rule of Law more generally.

It is therefore rather fortuitous that the Grand Chamber of the European Court of Human Rights (ECtHR), in the recent case of Lopez Ribalda v Spain [2019] ECHR 752, has handed down an important judgment in relation to the surveillance of employees in the workplace, and their right to privacy pursuant to Article 8 of the European Convention on Human Rights that, in my view, complements the Court’s earlier decision in Bărbulescu v Romania [2016] App. no. 61496/08.

Bărbulescu v Romania

On 3 July 2007 Mr Bărbulescu’s employer sent a notice to all employees prohibiting personal use of the Internet whilst at work. The notice also told employees that their work would be monitored. Not long after the notice was sent, Mr Bărbulescu’s employer began to monitor his Internet use, including how and when he used a Yahoo instant messenger (IM) account he had created at his employer’s request to deal with customer enquiries. On the 13th of July Mr Bărbulescu’s employer presented him with 45 pages of private IM messages he had sent using the work account he had created, and he was subsequently dismissed. This dismissal resulted in the litigation that ended up in the ECtHR, with Mr Bărbulescu claiming that his telephone, email and IM communications made whilst at work were subject to protection pursuant to Article.

As a general rule, to determine whether Article 8 has been engaged, the court involved would consider whether the individual had a reasonable expectation of privacy. An employer’s policy (for instance) would tell an employee whether the employee has an expectation of privacy and what this looks like. However, the Court’s decision in this case caused a stir. In finding that Mr Bărbulescu’s Article 8 rights had been violated by his employer it stated: ‘…an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.’  Therefore, for the first time, we had an unequivocal statement from the ECtHR that, regardless of what an employer says, employees are subject to an irreducible minimum right to private social life whilst at work.

However, what the judgment definitely did not mean was that monitoring in the workplace by employers became illegal, a principle which, as I discuss below, was applied by the Grand Chamber in Lopez. To the contrary, it recognised that employers have a qualified right to monitor their employees’ communications. The ECtHR acknowledged, on the behalf of employers, a ‘…right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.’  Thus, it determined that in cases concerning a conflict between an employee’s right to privacy and the employer’s right to ensure the smooth running of the company (by monitoring employees communications and/or Internet use), a balance must be struck using the test of proportionality. Ultimately, if monitoring measures are challenged, then the domestic court will need to consider the consequences of the monitoring process for the employee as against the consequences for the employer. What domestic courts should consider when attempting to find this balance was set out by the court, as follows:

  1. Employees should be told in advance that their employer may monitor their communications, and the way in which this will be done, including the ‘nature’ of the monitoring.
  2. Prior to monitoring their employees, employers should assess the extent of the monitoring they intend to carry out and its intrusion into employees’ privacy. In doing so, they should consider the following questions:
    • Can they limit the monitoring to the flow of communications, or does content also need to be monitored?
    • Do all communications need to be monitored, or will monitoring some communications suffice?
    • Can the monitoring be subject to a time limit?
    • Can physical limits to monitoring be imposed?
    • Can the number of people who have access to the results of the monitoring be limited?
  1. Legitimate reasons must be established for monitoring of the flow of communications. Due to its invasiveness, the monitoring of content will require even clearer reasons.
  2. Employers should assess whether a less intrusive monitoring system could be set up. In respect of monitoring content the employer must assess whether they could meet the legitimate reasons (see point 3) without directly accessing the full content of the communication(s).
  3. The monitoring process should be constantly reviewed by the employer, including the use of the results of the operation, the consequences for employees and whether the results achieve the identified ‘legitimate reasons’.

Lopez Ribalda v Spain

Lopez concerned five employees who worked as cashiers at a supermarket chain. The employer noticed stock discrepancies and, as part of their investigation, they installed CCTV cameras. These included visible cameras, which customers and staff were made aware of, and hidden cameras at the checkouts, which employees were not aware of. These covert cameras provided evidence that certain employees were stealing and, as a consequence, they were dismissed. They claimed unfair dismissal on the basis that the covert surveillance had been unlawful as it had breached their Article 8 right to privacy.

The High Court in Spain accepted that the employer’s covert monitoring of its employees had been justified by the employer’s reasonable suspicion of theft, and that it had been appropriate for the legitimate aim of detecting theft. However, the ECtHR originally overturned the decision of the Spanish Court. In applying the test of proportionality it held that the domestic court had failed to strike a balance between the rights of the employer to protect its property and the employees’ Article 8 right. The case was eventually referred to the Grand Chamber which, in overturning the previous decision by a majority of 14 to 3, found that there had not been a breach of the employees’ right to privacy. In applying the Bărbulescu criteria set out above it held that:

  • The employer had a legitimate reason for the surveillance being the suspicion of theft due to the significant losses it had incurred.
  • The extent of the monitoring had been limited to what was necessary in relation to both the area and the employees being monitored. The surveillance took place in an area that was open to the public. Therefore, the employees’ expectation of privacy was lower than in places that were private.
  • The duration of the surveillance had not been excessive.
  • The surveillance had only been viewed by certain individuals before the employees had been informed (the Manager, the employer’s legal representative and a trade union representative).
  • Although the consequences of the monitoring for the applicants had been significant in that they had been dismissed, the surveillance had not been used for any purposes other than to investigate the thefts and to take the disciplinary measures against those responsible.
  • There had been no other means by which to fulfil the legitimate aim.

Does Lopez change things for employees and employers?

The short answer to this is no, it does not change anything. Rather, to my mind, it complements, and even reaffirms, what was said in Bărbulescu. Although in the former case the Court found in favour of Mr Bărbulescu, and in doing so made it clear that employees are subject to an irreducible minimum right to private social life whilst at work, the Court also made clear that the judgment did not make employee monitoring illegal in certain situations in which specific conditions are met; a decision which, it is submitted, corresponds with the Information Commissioner’s guidance on monitoring staff at work. Lopez presents an example of such a situation.

Whereas Bărbulescu related to an employee ‘merely’ using a messaging application to send private messages whilst at work, Lopez concerned the use of covert CCTV to uncover criminal activity in the workplace. In my view, the combination of these judgments will come as a relief to employees and employers: on the one hand employees know that they are able to avail themselves of a minimum right to private life whilst at work, whilst on the other hand, this right is not absolute, as employers are able to monitor employees in certain situations that require it, such as to uncover illegal activity.

Peter Coe, Barrister and Lecturer in Law, University of Reading; Research Associate, Information Law and Policy Centre, Institute of Advanced Legal Studies, University of London; Editor-in-chief of Communications Law.

This post will appear in the February issue of Communications Law and is published here with kind permission.