European Rights Court Limits Monitoring of Employee Communications

European Rights Court Limits Monitoring of Employee Communications

In a landmark ruling on Tuesday, the European Court of Human Rights ruled in favor of a Romanian man who was fired in 2007 after his employer determined that he had violated its policy barring the use of company resources for personal matters. Bogdan Barbulescu had created a Yahoo Messenger account for work purposes, and was terminated after his managers looked at transcripts of his chats on the application and saw that he had used it for personal communications. Romanian courts had ruled against Barbulescu, and the EHCR had agreed with those courts in January 2016, finding that the employer was justified in reading his personal chat logs in order to enforce its policy.

According to the New York Times, the 2016 decision courted controversy in Europe, where privacy is seen as a fundamental right. On Tuesday, the ECHR’s highest appellate division, the Grand Chamber, reversed the court’s position and found that Barbulescu’s privacy had been violated as he had “not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer might have access to the actual contents of his messages”:

It said that only a few countries in Europe — Austria, Britain, Finland, Luxembourg, Portugal and Slovakia — have explicitly regulated the issue of workplace privacy through domestic legislation. Most countries in the region do, however, require employers to give prior notice of monitoring. In countries like Denmark, France, Germany, Italy and Sweden, employers may monitor emails marked by employees as “private,” but may not look at the content without permission.

The chamber ruled that countries should ensure that companies’ efforts to monitor employees’ communications, are “accompanied by adequate and sufficient safeguards against abuse.”

The court’s ruling is applicable in all 47 member states of the Council of Europe, including non-EU members Russia, Ukraine, and Turkey—in other words, every country on the European continent except Belarus and Kosovo. Following this decision, employers in the court’s jurisdiction are still allowed to monitor their employees’ digital communications, but not without limits, and not without making employees aware of that monitoring beforehand. TechCrunch’s Natasha Lomas outlines the criteria the court created for determining whether monitoring is valid:

  • whether the employee has been notified of the possibility that the employer might take measures to monitor correspondence and other communications, and the implementation of such measures — specifying that the notification should be clear about the nature of the monitoring and be given in advance
  • the extent of the monitoring by the employer and the degree of intrusion into the employee’s privacy; noting that a distinction should be made between monitoring of “the flow of communications and of their content” (i.e. metadata vs full content). And whether all communications or only part of them have been monitored; and whether monitoring was limited in time and the number of people who had access to the results;
  • whether the employer has provided legitimate reasons to justify monitoring the communications and accessing their actual content — noting the latter is a “distinctly more invasive method, it requires weightier justification”

“Still,” the Times adds, “the decision was not unanimous, and experts said the ruling left much open to interpretation”:

“This is a complicated case which will still leave employers confused as to how extensively they can monitor employee communications,” said Jonathan Chamberlain, an employment law expert at Gowling WLG, a British law firm. “The court itself seemed divided over how to balance employees’ privacy and employers’ security, and it is still not clear what exactly constitutes proportionality and fair warning.”

In a dissent, six judges wrote that the Romanian courts had not violated Mr. Barbulescu’s right to privacy. They argued that the Romanian authorities had carried out a “careful balancing exercise between the interests at stake, taking into account both the applicant’s right to respect for his private life and the employer’s right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.”

How organizations may handle their employees’ data is already governed by a number of laws and policies in the EU and individual European countries, including the “Privacy Shield” data protection agreement between the US and EU that went into effect last year. In the UK, employment lawyer Catrina Smith tells the BBC, the laws regarding employees’ data privacy are already fairly robust, so Tuesday’s ruling will probably not have a major impact on British privacy regulations:

“What it will do, for companies who thought they had a bit more leeway than they did, is confirm the fact that they don’t,” she said. “It will hopefully remind employers that they need to think about these issues and be very clear with employees about what is and isn’t permissible. Employees also need to be smarter about the way in which they use both personal and work devices.”

Ms Smith added that in the UK both the Data Protection Act and the Interception of Communications Act set out clear guidelines for employers regarding what they can monitor. “You have to make sure the employee understands that [monitoring] might happen and you have to have a good reason for doing so,” she said. “It’s all about having a dialogue and having an agreement about what is and isn’t personal.”

On the other hand, another employment lawyer tells People Management’s Hayley Kirton that he ruling could influence how UK courts approach matters of employee data privacy, as time will tell:

James Froud, partner in the employment group at Bird & Bird, said … it would be interesting to see if any similar cases were brought off the back of the ruling, and how the courts in the UK would react. “In truth, these cases will always turn on the specific facts, and therefore the decision is unlikely to result in a fundamental change in legal position. However, we may see a shift in emphasis, with courts requiring employers to clearly demonstrate the steps they have taken to address the issue of privacy in workplace, both in terms of granting employees ‘space’ to have a private life while clearly delineating the boundaries,” he said.