Monitoring employees’ emails at work
Tue 17 Oct 2017
The decision of the Grand Chamber of the European Court of Human Rights (ECtHR) in Barbulescu v Romania highlights the need for employers to carefully consider the way in which they monitor employees’ emails, and their reasons for doing so.
Mr Barbulescu worked as an engineer at a heating company. At his employer’s request, he set up a personal email account to deal with client queries. The company’s Handbook and a notice that was later sent to employees prohibited using its IT equipment for personal emails. However, neither document expressly stated that the content of personal emails would be monitored.
In July 2007, the employer discovered that Mr Barbulescu had been sending personal emails at work. When he contested this, the company produced a 45 page transcript of his emails, including messages with his brother and fiancée.
He was ultimately dismissed for unauthorised use of the company’s IT systems. He challenged his dismissal in the Romanian courts which rejected his claim, ruling that the employer was entitled to check that work was being done properly, and that Mr Barbulescu was given adequate notice of the prohibition on using IT for personal emails, and of the fact that monitoring would be carried out.
Mr Barbulescu brought a claim against the Romanian Government in the ECtHR, arguing that the Romanian courts had failed to protect his Article 8 right to privacy. The Fourth Section of the ECtHR disagreed, holding that, whilst Article 8 was applicable, the monitoring of Mr Barbulescu’s emails was a proportionate interference with this right.
Mr Barbulescu appealed to the Grand Chamber of the ECtHR which overturned this decision, finding that the Romanian courts had failed to uphold his Article 8 rights.
The ECtHR considered the following factors in reaching this conclusion:
· Notification about monitoring. An employer must give unequivocal notification of its intention to monitor communications in advance. In this case, the employer had not informed Mr Barbulescu of the extent and nature of the monitoring (in particular, that it might access the content of personal messages). The Romanian courts had not considered this.
· The extent of monitoring. A distinction should be drawn between monitoring the flow of emails (e.g. email usage) and examining the content of emails (as was the case here). The Romanian courts had not done this.
· Whether legitimate reasons have been given to justify the degree of monitoring. Monitoring the actual content of emails requires a high degree of justification. The Romanian courts had not examined the employer’s reasons for monitoring content.
· Whether less intrusive monitoring was possible. The court should have considered whether the employer’s aims could have been achieved by less intrusive means.
· The consequences of monitoring for the employee. The Romanian courts did not consider whether the sanction of dismissal was a proportionate means of meeting the employer’s business aims.
· Finally, the court should have considered whether the employer had put in place adequate safeguards in circumstances where the monitoring was intrusive.
Lessons for employers
In the UK, legislation exists which regulates employers’ conduct in relation to employee monitoring. In that regard, the Information Commissioner’s Employment Practices Code (issued under the Data Protection Act 1998) recommends that employers undertake an impact assessment before implementing monitoring of employee communications. The factors that should be considered during such an assessment reflect those listed by the ECtHR above, and so this case serves as a useful reminder for employers.