The European Court of Human Rights (ECHR) recently handed down a decision on Article 8 privacy rights concerning an employer monitoring an employee’s work-related Yahoo Messenger account.
The case of Bărbulesca v Romania received a high level of media coverage, which may have given the impression that it gave employers a green light to snoop on employees’ personal emails. It does not, however, overrule previous case law on an employee’s reasonable expectation of privacy and the requirement that any interference must be proportionate. Nor does it override existing English law, which also places constraints on an employer’s ability to monitor employees’ private communications.
The story
Mr B worked for a heating company and was requested by his employer to set up a Yahoo Messenger account to deal with client enquiries. Subsequently, the employer informed him that they had monitored his Yahoo Messenger account for over a week and believed he had used the account for personal use, which was strictly against company policy.
Mr B explained that he had only used the internet and the account for professional purposes. However, the employer produced a 45-page transcript of various messages (over that week), which included messages to his brother and fiancée and contained intimate personal details about his sex life. The employer disciplined Mr B and dismissed him for unauthorised personal use of the internet.
Mr B brought an action in the Romanian courts to challenge his dismissal, but his claim failed. The court endorsed the employer’s right to ensure work was properly undertaken and that Mr B received adequate notice, both in terms of the policy against the personal use of company resources and that surveillance would be undertaken.
The Romanian court noted that as Mr B claimed he had only used the account for professional purposes, monitoring his messages was the only way his employer could verify this.
Unsuccessful, Mr B then brought a claim against the Romanian government, arguing that it had failed to protect his rights to correspondence and privacy.
The ECHR maintained his dismissal and held that monitoring his internet use and use of Yahoo Messenger in disciplinary proceedings was a proportionate interference.
Decisions, decisions…
In previous cases, telephone calls, emails and internet use at work were covered by the notions of “private life” and “correspondence”; in the absence of a warning, an employee had a reasonable expectation of privacy. However, in this case, the company forbade internet use for personal purposes.
There was no clear-cut answer as to whether Mr B had a reasonable expectation of privacy, as it was unclear from the evidence whether the employer had given notice that they would monitor his internet use.
However, the court found that because his employer had accessed his work Yahoo Messenger account (containing some personal messages) and his personal Yahoo account, and the transcript were used in court, Mr B’s privacy rights were engaged.
Did the State balance the employer’s interests and respect for Mr B’s privacy?
In our view, yes. First, Mr B raised his argument in the Romanian courts, which upheld his dismissal as lawful because of his breach of company policy.
Secondly, Mr B brought his complaint under labour law, which provided for other remedies for breach of privacy, like unlawful interception of communications under the Romanian Criminal Code or a claim for reparations under data protection law. The courts:
- attached particular importance to the fact that the employer had accessed Mr B’s Yahoo Messenger account in the belief that it contained professional messages only (and as Mr B had claimed);
- did not attach any particular weight to the content of the messages except that they proved personal use.
The court held that it was reasonable for an employer to verify that employees are working during working hours – even when the employee’s actions have not caused any actual damage.
Although the employer, in this case, had examined the Yahoo messages, it had not looked at any other data or documents on the employee’s computer. Therefore, the court concluded that the monitoring was limited and proportionate.
When rejecting his complaint, there was nothing to suggest that the Romanian authorities had failed to strike a fair balance between the employer’s interests and respect for Mr B’s private life.
The long and the short of it
This case is unusual as far as the UK is concerned. Most UK employers would tolerate some personal internet and telephone use at work, and therefore, Mr B’s scenario is less likely to occur. Further, there is a growing body of unfair dismissal case law highlighting the need for employers to put clear policies in place.
What shape are your policies in?
Every employer should ensure that they have a privacy policy and/or acceptable use policy (including social media) dealing with messages sent from mobile devices as well as traditional office desktops in the workplace. The policy should include:
- a clear statement of an employee’s accountability in terms of their workplace communications;
- clear examples of unacceptable use (such as sending emails containing obscene, racist, sexist, or defamatory content);
- a statement making it plain that any breach of the employer’s policy may result in disciplinary action, including dismissal; and
- an unambiguous explanation of when, how and why workplace emails will be monitored.
Any policy implemented by an employer should be openly communicated to staff to ensure that employees are aware of what’s expected of them and the potential consequences of any breach. Practically, a written version of the policy should be included in the staff handbook and brought to the attention of new employees as part of their induction process.
Employers should be alert to any changes that may be required to be made to the policy (especially in this rapidly evolving area), communicate any updates to employees, and provide regular training on the acceptable use guidelines and their practical effect. Employers need to remember that monitoring should not unnecessarily intrude on an employee’s privacy and should be proportionate.
The need to regulate email use is ever-increasing. What constitutes ‘acceptable’ usage in an era of mobile devices and online social interaction in the workplace is a key area for employers to consider.
Call Alex Deal today for information and guidance on your policies and procedures.
Bărbulescu v Romania: Article 8, European Convention on Human Rights
Note: This article is not legal advice; it provides information of general interest about current legal issues.