In the recent case of Brake & Anor v Guy & Ors [2022] EWCA Civ 235, the Court of Appeal has considered whether an employer could make use of personal emails that an employee had sent from a work email address. This issue is very fact-specific and so will depend on the circumstances of each case.
The background facts to this case were complicated involving a series of court proceedings, but one issue was that the employer had given an employee’s personal emails to their lawyers, a press agent and the employee’s trustee in bankruptcy as evidence to show that she had hidden assets from them.
The employee sought an injunction restraining use of the emails. She claimed that, by sharing the emails, the employer was misusing her private information and was in breach of confidence. She failed to prove either claim, both at first instance and on appeal.
Misuse of private information
Under article 8 of the Human Rights Act 1998, everyone has the right to respect for their private and family life, home and correspondence. A breach of that right gives rise to a misuse of private information claim.
The employee needed to prove that there was a reasonable expectation of privacy in respect of the emails. If she could prove that, then the court would go on to consider whether the interference with this right was justified in this case.
The test for whether there is a reasonable expectation of privacy is what a reasonable person of ordinary sensibilities would feel if they were placed in the same position as the claimant and faced with the same publicity. The courts will, as a general rule, treat certain types of personal information as private, such as information about a person’s health, private finances and personal communications, but there is no legal presumption to this effect, so claimants still have to prove that there was an objectively reasonable expectation of privacy in the information.
Cases from the European Court of Human Rights have confirmed that an employee making a private communication from business premises or using business facilities may have a reasonable expectation of privacy (Halford v United Kingdom [1997] IRLR 471, Copland v United Kingdom (2007) 45 EHRR 37, and Barbulescu v Romania (Application no. 61496/08) [2017] IRLR 1032), even where there is an express ban on using company resources for personal purposes (an employer "cannot reduce private social life in the workplace to zero" – Barbulescu).
However, whether there was a reasonable expectation of privacy will turn on a careful and detailed analysis of all the facts and circumstances of each case. Here, the employee could not prove she had such an expectation. She had claimed that 3,149 emails were private, but she had only produced two to the judge, and he was simply not prepared to accept on the basis of those two emails alone that there was a reasonable expectation of privacy in them all. Also the work email address she used was a general enquiries one, designed to receive enquiries from customers or potential customers about the company's services. She was the principal user of it, but two other employees had some access and would reply to business emails. Her personal emails were not stored separately or marked as personal or private. Although only the employee and the IT provider knew the password to the account, the purpose of the password was to protect the company’s secrets, not hers.
Breach of confidence claim
A breach of confidence claim covers information that is sensitive or secret but, unlike the privacy claim, it does not have to be of a personal nature.
For a breach of confidence claim to succeed, the information itself must have the necessary quality of confidence about it, it must have been imparted in circumstances importing an obligation of confidence, and there must be an unauthorised use of that information to the detriment of the party communicating it.
In this case, the first instance judge held that the personal information in the enquiries account was not "imparted in circumstances imparting an obligation of confidence" for the same reasons that he found that she had failed to prove a reasonable expectation of privacy.
The Court of Appeal confirmed this decision, saying that the employee had not put forward any argument which persuaded it that the judge was wrong in this conclusion. Again, the fact that the courts have reached different conclusions in other cases did not help the employee. So although in Imerman v Tchenguiz [2010] EWCA Civ 908, [2011] Fam 116, the husband in a divorce case was granted an injunction restraining his wife’s brother (with whom he shared an office) from disclosing information obtained from the husband’s computer because he feared the husband might conceal assets from the wife, this decision was based on different circumstances and facts.
Comment
There is a rather unusual set of facts in this case which meant that the employee’s private emails were not protected. It is generally the case that employees have a legitimate expectation that they can keep their personal lives private and that they are also entitled to a degree of privacy in the work environment.
There are a multitude of issues that arise when an employer monitors or uses private emails on its work systems in the UK. Clearly, the UK GDPR is relevant. There is likely to be personal data or even special category data such as health data within personal emails. Employers should therefore ensure they have a lawful basis on which to process that data.
As this case shows, employees may have a reasonable expectation of privacy in private emails sent from work. Even with a blanket ban on use of work email for private purposes, it is clear that employees still retain the right to bring a misuse of private information claim. In addition, they can bring a breach of confidence claim if the information is sensitive or secret.
Frances Rollin
Laura Beagrie