The recent case of Barbulescu v Romania has been trumpeted by some in the press as giving the green light to employers wishing to monitor employees’ private emails etc. The Daily Mail has called this a “right to spy” on employees’ private messages.
This case relates to a Romanian engineer whose employer asked him to set up a Yahoo Messenger account to liaise with business contacts for work purposes. The company had in place a disciplinary rule which stated that “it is strictly forbidden… to use computers… for personal purposes.”. In July 2007, the company accessed the Yahoo Messenger account for monitoring purposes but found that, in addition to work-related activities, Mr B was in fact using Yahoo Messenger in work time to exchange private messages including with his fiancée and brother about his health and sex life. This was a breach of Mr B’s employment contract and the company’s internal rules. Managers advised him that, over the course of a week’s monitoring, he had been shown using the account for personal purposes. When he denied it, disciplinary proceedings followed in which managers presented Mr B with a 45 page transcript of the private messages. He was dismissed a month later for using the company’s internet during working hours for personal purposes.
Mr B brought a claim in the Romanian Courts in connection with his dismissal and, after he lost his case and appealed unsuccessfully, he referred a case to the European Court of Human Rights (ECHR) alleging that the evidence of personal communications should have been disregarded by the Courts on grounds that its use infringed his right to respect for private and family life, the home and correspondence (Article 8 of the European Convention on Human Rights).
The ECHR ruled that Article 8 was engaged but that the Romanian courts were entitled to examine these private communications in order to determine whether Mr B’s dismissal was justified. They were satisfied that the Court and employer had used the transcripts only for as far as was necessary to establish Mr B’s disciplinary breach and disprove his contention that he only used Messenger for professional communications. Further, in not disclosing the specific content of the personal messages during court proceedings, the ECHR concluded that an appropriate balance had been struck between Mr B’s right to privacy and the employer’s right to verify whether its employee was breaching its company rules.
So does this give employers a right to spy on staff private messages? Well, no.
As the ECHR said in its judgment, it is “not unreasonable for an employer to want to verify that employees are completing their professional tasks during work hours” but employers do not now have the right to carry out unregulated surveillance on employees’ private messages. Ultimately looking at private messages was in this case the only way of checking Mr B’s contention that he had only used Messenger for professional purposes and it was crucial in this case that the employer had in place a clear and total prohibition on employees using its IT systems for personal matters, that they had accessed the account because it had been intended as a work related account. As the Bucharest County Court summarised it: “The employer’s right to monitor their employees’ use of the company’s computers in the workplace falls within the broad scope of the right to check the manner in which professional tasks are completed.” It was crucial that the employee’s attention had been drawn to the fact that another colleague had recently been dismissed for having used the Internet, the telephone and the photocopiers for personal purposes and the employee had been warned that their activity was under surveillance.
Contractual provisions and an IT policy which specifies what (if any) personal use is acceptable and clearly sets out what monitoring could be carried out and for what purpose (i.e. what is the business case for monitoring) will be essential to ensure that employees have no reasonable expectation of privacy. This could legitimately extend to work emails, Messenger or even Linkedin accounts depending on the circumstances but, despite some lurid headlines, is unlikely to extend to personal smartphones or other equipment not provided by the employer. UK employers will also need to bear in mind their obligations under domestic legislation to protect employees’ personal data and only use it for specified purposes, and to operate in a fair and reasonable manner in disciplining and ultimately dismissing any employee. And, of course the monitoring will need to remain proportionate to the business interest to be protected. As with so many things, it all comes down to reasonableness.