Court of Human Rights rules snooping on employee emails breaches the right to private life

The Grand Chamber of the European Court of Human Rights today published its judgment in Bărbulescu v Romania, a case concerning an employee fired by his employer for sending personal messages using his workplace instant messenger.

Overturning an earlier judgment by the lower Chamber, the Grand Chamber held that the failure of Romanian domestic authorities to adequately protect Mr Bărbulescu (B) from the monitoring of his workplace communications by his employer was in violation of his right to respect for private and family life under Article 8 of the Convention.

The facts

• B created a Yahoo Messenger account at his employer’s request to respond to clients.
• B was aware that his employer had strict internal policies in place, which prohibited the personal use of company resources.
• B’s employment was terminated after his employer monitored the content of his Yahoo chats and found messages of a personal nature sent to B’s brother and fiancée.
• B lost various court battles in Romania contesting his dismissal.
• The lower Chamber of the ECtHR eventually determined that Article 8 had been engaged but not violated by B’s employer.

Findings of the Grand Chamber – the balance of interests

The Grand Chamber emphasised the importance of having regard to the principles set forth in Directive 95/46/EC. Collection and processing of ‘personal data’ should be necessary for specified and legitimate purposes, and should be transparent and proportionate.

The domestic authorities ought to have performed a balancing exercise between B’s Article 8 right and his employer’s legitimate interests, taking into account the following factors:

• whether B had been given clear advance notification of the possibility that his correspondence might be monitored;
• the extent of monitoring and degree of intrusion;
• whether the employer had legitimate reasons to justify monitoring;
• whether a less intrusive form of monitoring might have been appropriate;
• the consequences of monitoring for the employee; and
• whether the employee had been provided with adequate safeguards.

B did not appear to have been informed in advance of the extent and nature of his employer’s monitoring activities, and would arguably have had a reasonable expectation of privacy given that his messages were sent from a private password-protected account. The monitoring in question was also of an intrusive nature (observing not just flow but also content of communications), and did not seem to be justified by legitimate reasons. The domestic court had not sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods, and whether the employer had already accessed the contents of the messages in issue before giving B the chance to provide an explanation. As a result of the monitoring, B had received the severest possible sanction – dismissal.

This judgment may affect the way in which UK courts consider employee privacy and monitoring going forwards. Although this case related to the protections afforded by the Romanian authorities (including the labour courts), the factors set out above will be relevant for employers to consider when determining the extent to which they monitor employee communications at work.