The right to privacy at work
In September, the Grand Chamber of the European Court of Human Rights handed down a major ruling involving the protection of employees’ personal data and the right to confidentiality of correspondence at the workplace, in the case of Bărbulescu v. Romania.
Bogdan Bărbulescu was hired under an employment contract as a sales engineer for a private company in Romania. His employer instructed him to create an instant messaging account with the Yahoo Messenger service. He was supposed to use the account only as a working tool for contacting his clients. But apart from work-related discussions, the employee also used the Yahoo Messenger account for private conversations with his family, and for exchanging intimate messages with his fiancée. The employer conducted an audit of staff correspondence based on an internal workplace policy which permitted the employer to audit the contents of the message service. The audit turned up Bărbulescu’s private correspondence. Confronted by the employer, Bărbulescu made a written denial that he had used the message service for private purposes, notwithstanding evidence to the contrary gathered by the employer, in the form of printouts of his discussions. Consequently, the employer fired Bărbulescu for misconduct.
Bărbulescu’s case reached the court in Strasbourg after making its way through the Romanian court system: an unsuccessful complaint filed with the county court challenging the employer’s decision to fire Bărbulescu, followed by denial of his appeal by the Bucharest Court of Appeal. Bărbulescu alleged that the decision to fire him for misconduct was wrongful and violated the Romanian Constitution as well as Art. 8 of the European Convention on Human Rights. The Romanian courts found that the employer had properly informed the employee of its practice of monitoring the employee’s work, and was entitled to fire the employee for making private use of business tools.
Bărbulescu claimed that the employer had violated his right to the privacy of correspondence guaranteed by the Romanian Constitution and the European Convention on Human Rights. Bărbulescu thus decided to sue Romania under Art. 34 of the convention. The initial ruling in the case was issued by the lower chamber of the ECHR on January 12, 2016. There it was found that Romania had not violated its obligation to respect the employee’s private life and correspondence under the convention. The court also found that the employer had a right to monitor the employee’s use of the business-related online message service to determine whether the employee was spending his working hours performing his employment duties.
The case was then referred to the ECHR’s Grand Chamber, which issued a judgment on September 5, 2017, reaching a different conclusion than the lower chamber. The Grand Chamber held that the disciplinary firing of an employee who had used company communications channels for private purposes violated his right to respect for private life and correspondence.
Employer monitoring
The most important lesson in the court’s ruling is the obligation of national labor courts to ensure adequate protection of employees’ right to privacy and confidentiality of their correspondence. According to the court, there are numerous conditions that must be met by an employer conducting monitoring of its employees. In determining whether protected personal data of the employee are violated, the court points to the employer’s obligation to notify the employee of the monitoring. This information must be provided with reasonable advance notice, in any form understandable to the employee. It must also be explicit, and indicate the categories of monitored communications and the types of content to be monitored by the employer.
It is also essential to notify the employee of the nature of the monitoring, whether it is to be conducted in an ongoing manner or incidentally, which channels of communications are involved, and who is authorized to conduct the monitoring for the employee and access the results. Nor can the employer conduct monitoring of employees without a valid reason, and on each occasion it must consider whether the intended method of monitoring is the least invasive method possible. If these conditions are not met, the monitoring may violate the staff ’s right to respect for their private life and correspondence, thus violating Art. 8 of the convention.
The ruling also indicates the duties of member states of the convention to ensure that employees undergoing monitoring have legal measures available to them enabling review of the employer’s actions for compliance with ECHR case law as well as national law before they are undertaken.
Some conclusions
The ECHR recognizes that an employer has the right to exercise oversight of employees at the workplace by monitoring all official channels of communications used at the workplace for business purposes, and permits restrictions or a complete ban on the use of company means of communications, including email, for private purposes. But according to the court’s ruling in Bărbulescu, use of communications devices for private purposes during working hours cannot be sufficient grounds in itself to terminate the employee.
Practical consequences
The Bărbulescu ruling will have an impact not only on Romanian law, which lacks regulations expressly defining the employer’s rights and obligations connected with operation of official work-related correspondence and permissible forms of monitoring of such correspondence by the employer. The ruling will also have a tangible impact on the legal systems of other European countries.
In Poland there are also no express regulations in force governing monitoring of employees’ business correspondence. The Ombudsman tried to launch a debate 10 years ago on amending Poland’s labor laws in this respect. In a statement to the Minister of Labor and Social Policy at that time, the Ombudsman stressed the importance of introducing an obligation for employers to warn employees of the possible monitoring of work emails and recording conversations on work phones. The minister replied that under existing regulations, “the employer can monitor the content of an employee’s work email, read the employee’s official correspondence, and provide the employee’s official correspondence to other employees for their review.” Nonetheless, this issue has yet to be expressly regulated, and continues to generate major doubts in interpretation.
Perhaps the Bărbulescu case will spur lawmakers to resolve these doubts through legislative means and introduce relevant provisions into Polish labor law defining a clear legal framework for monitoring of employee correspondence by employers.
Miejsce publikacji: American Investor, Fall 2017