In Barbulescu v Romania, the European Court of Human Rights has provided guidance on when an employer can monitor an employee’s work-related email account.
Facts
Mr Barbulescu was an engineer for a heating company and his employer (the Company) asked him to set up a Yahoo email account for the purpose of responding to client queries.
The Company had a policy which stated that employees were not permitted to use company computers and IT systems for personal use. The Company monitored Mr Barbulescu’s email communication from the Yahoo account for a period of eight days and discovered that he had been using it for personal communications, including to his fiancée and brother, during working hours.
The Company wrote to Mr Barbulescu and informed him that they had been monitoring his account and had found that he was not complying with the Company’s IT policy. When he wrote back asserting that his use of the account was for business purposes only, the Company provided him with a 45-page transcript of messages that he had sent to his fiancée and brother during the previous week.
Mr Barbulescu was subsequently dismissed on the ground that he had breached the Company IT policy by making personal use of the internet.
He brought a claim under Romanian law arguing that the Company’s decision was founded on information which was unlawfully obtained by his employer violating his right to privacy.
Decision
The Romanian courts dismissed the complaint and found that monitoring Mr Barbulescu’s emails was the only way that the Company could verify his claim that he only used the account for business.
Mr Barbulescu then took his complaint to the European Court of Human Rights (the Court), claiming a failure to protect his right to privacy and family life and his correspondence. The Court confirmed that Article 8, the right to privacy, was engaged because, on the face of it, emails sent from work were covered by the notions of ‘private life’ and ‘correspondence’.
The Court considered that, in the absence of a warning stating that an employee’s communications would or may be monitored, any search or interference would be an intrusion into an employee’s ‘private life’. However, on the facts of the case, the Court considered that Mr Barbulescu had no reasonable expectation of privacy. The reasons for this included the fact that Mr Barbulescu had set up the Yahoo account at the Company’s request and that he was on notice that the Company’s IT policy strictly prohibited personal use of the Company’s computers.
The Court added that it was reasonable for the Company to want to verify that employees were carrying out their designated tasks during working hours. It noted that the Company had accessed the account in the belief that it contained only business communications and had not relied on the content of the messages, only the fact that they were of a personal nature, in order to establish that he was using the Company computer systems for his personal use during business hours.
Accordingly, the Court concluded that the Company had acted both reasonably and proportionately in balancing the employee’s right to privacy with its own business interests.
Comment
The case is a useful reminder to employers that they should have a clear policy dealing with acceptable levels (if any) of personal use of IT equipment and the internet; employers should also tell employees of the extent (if any) to which it monitors communications.
However, it is worth noting that this case does not create blanket permission for employers to monitor employee communications. For example, it does not override the employer’s duty to consider the limitations imposed by the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000. While, in the absence of a complete ban on personal use, as in the Barbulescu case, it will be more difficult to establish that an employee’s right to privacy has not been breached, it may still be possible for an employer to discipline an employee who makes obviously excessive use of company IT.