Alja Poler De Zwart and Miriam H. Wugmeister
Privacy + Data Security
On January 12, 2016, the European Court of Human Rights in Strasbourg (“Court”) (note that this is not the European Court of Justice (ECJ) in Luxembourg) held by six votes to one in the case of Bărbulescu v. Romania (ECHR 013 (2016)) that there had been no breach of Article 8 of the European Convention on Human Rights (ECHR) (i.e., right to respect for private and family life, the home, and correspondence) in a case concerning dismissal of a Romanian employee for using company Internet for private purposes during working hours in breach of internal company regulations. The Court found that monitoring of the employee’s communication had been reasonable in the context of the disciplinary proceedings at hand because a fair balance had been struck between the employee’s right to respect his private life and correspondence and his employer’s interests.
In the recent days, many media outlets reported that the judgement provides employers with carte blanche to monitor employee communication without limitations and that employees now have no right to privacy in the workplace. This is incorrect. The Court actually confirmed (as in many of its previous judgements) that employees have a reasonable expectation of privacy in workplace communications and that valid monitoring of employees may only take place under specific conditions, as provided by applicable law. Most importantly, if a company has a clear and comprehensive policy on what its employees may and may not do while using company resources, and the policy has been appropriately communicated to the employees, the company can access and review employee communication based on legitimate suspicion of misconduct, but only to the extent that such access is reasonable, proportionate, and all other safeguards to protect employee’s rights (as provided by applicable law) are put in place.
This judgement is a product of the facts of this specific case (as described below) and will therefore not fundamentally change the manner in which competent European regulators approach employee monitoring. Relevant European and local laws of individual EU Member States apply as before, as furthermore evidenced by the Slovenian and Italian data protection authorities’ (“DPA”) official reactions to this case:
Companies contemplating monitoring of their European employees are therefore advised to continue complying with all relevant local legal requirements (see below).
Note that this judgment was issued by the Court’s Chamber of seven judges. Mr. Bărbulescu (the applicant in this case) therefore has an option to request referral of the case to the Grand Chamber of the Court (17 judges) for fresh consideration. This judgement may, therefore, still be reconsidered and overturned. Also note that the Court in this case did not specifically consider the EU Data Protection Directive or Romanian data protection laws; It only focused on assessing whether the Romanian authorities have managed to strike a fair balance between the employee’s right under Article 8 ECHR and his employer’s legitimate interests.
Facts of the Case
Mr. Bărbulescu created an email account for work purposes at his employer’s request. The company had a policy that contained an absolute ban on company email/Internet use for private purposes. In 2007, his employer informed Mr. Bărbulescu that his email account communication had been monitored and that the records showed he had used the company Internet for private purposes in breach of the company’s internal regulations that prohibit private use of company resources. When Mr. Bărbulescu denied such private usage, he was presented with a 45-page transcript of his communication, including transcripts of messages he had exchanged with his brother and his fiancée relating to sensitive personal matters pertaining to his health and sex life. The employer subsequently terminated Mr. Bărbulescu’s employment contract for breach of the internal regulations.
Mr. Bărbulescu challenged the contract termination before the Romanian court as being null and void because his employer had violated his right to private correspondence afforded to him under the Romanian Constitution and Criminal Code. The court dismissed the claim on the grounds that the employer had complied with the dismissal proceedings provided for by the Romanian Labor Code. Mr. Bărbulescu’s appeal (that his email was protected by Article 8 ECHR) was dismissed on the grounds that (also under the European Data Protection Directive) the employer’s conduct had been reasonable and (in view of Mr. Bărbulescu’s denial of private use) this had been the only method of establishing whether there had been a disciplinary breach.
The scope of the Court’s examination was limited to assessing whether the State of Romania (in the context of its positive obligation under Article 8 ECHR to ensure protection of human rights in private relationships) struck a fair balance between (i) the employee’s right to respect his private life under Article 8 ECHR, and (ii) his employer’s legitimate interests. The Court found that the State of Romania did not violate Article 8 ECHR. The employee was able to raise all of his arguments before the Romanian courts. After duly examining the case, the courts found that the employer had acted in the context of its disciplinary powers provided for by the Romanian Labor Code. There was no doubt that the employee breached company regulations, and termination was thus acceptable.
The Court did not consider Romanian Data Protection laws or the Article 29 Working Party opinion on employee monitoring in great detail, apart from briefly noting their existence and relevance. The Court only observed in general that it is not unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours. It then went on to consider that in this particular case:
Having regard to the foregoing, the Court concluded that there is nothing to indicate that the domestic authorities failed to strike a fair balance, within their margin of appreciation, between Mr. Bărbulescu’s right under Article 8 ECHR and his employer’s interests.
This case shows that under the right conditions, EU Member State laws may allow monitoring of employee (private) communication, provided that companies comply with all relevant local privacy, data protection, and labor legislation. In general, the main conditions for valid employee monitoring will consist of the following:
Contact our world-class privacy and data security lawyers.
Cyber Crime Firm of the Year
©1996-2019 Morrison & Foerster LLP. All rights reserved.