The European Court of Human Rights has ruled that, on the particular facts, the monitoring of an employee’s electronic communications amounted to a breach of his right to private life and correspondence
The case of Barbulescu v. Romania (application no. 61496/08) concerned the decision of a private company to dismiss an employee after monitoring his electronic communications and accessing their contents, and the alleged failure of the domestic courts to protect his right to respect for his private life and correspondence.
The Grand Chamber of the European Court of Human Rights has held, by eleven votes to six, that there had been a violation of Article 8 (right to respect for private and family life, the home and correspondence) of the ECHR. The Court concluded that the national authorities had not adequately protected Mr Barbulescu’s right to respect for his private life and correspondence. They had consequently failed to strike a fair balance between the interests at stake.
In particular, the national courts had failed to determine whether Mr Barbulescu had received prior notice from his employer of the possibility that his communications might be monitored; nor had they had regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or the degree of intrusion into his private life and correspondence. In addition, the national courts had failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into Mr Barbulescu’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge.
Bogdan Mihai Barbulescu is a Romanian national who was born in 1979 and lives in Bucharest. From 1 August 2004 until 6 August 2007 Mr Barbulescu was employed by a private company as an engineer in charge of sales. At his employers’ request, he created a Yahoo Messenger account for the purpose of responding to clients’ enquiries.
On 3 July 2007 the company circulated an information notice among its employees which stated that one employee had been dismissed on disciplinary grounds after she had privately used the internet, the telephone and the photocopier.
On 13 July 2007 Mr Barbulescu was summoned by his employer to give an explanation for his conduct. He was informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes. Mr Barbulescu replied in writing that he had only used the service for professional purposes. He was then presented with a transcript of 45 pages of his communications from 5 to 12 July 2007, consisting of messages he had exchanged with his brother and his fiancée relating to personal matters, some of the messages being of an intimate nature. On 1 August 2007 the employer terminated Mr Barbulescu’s employment contract for breach of the company’s internal regulations that prohibited the use of company resources for personal purposes.
Mr Barbulescu challenged his employer’s decision before the courts, complaining that the decision to terminate his contract was null and void as his employer had violated his right to correspondence in accessing his communications in breach of the Constitution and Criminal Code. His complaint was rejected by the Bucharest County Court in December 2007, on the grounds, in particular, that the employer had complied with the dismissal proceedings provided for by the Labour Code; that employers were entitled to set rules for the use of the internet, which was a tool made available to employees for professional use; and that Mr Barbulescu had been duly informed of the company’s regulations. The County Court noted that shortly before Mr Barbulescu’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes.
Mr Barbulescu appealed, contending that the court had not struck a fair balance between the interests at stake. In a final decision on 17 June 2008 the Court of Appeal dismissed his appeal. It essentially confirmed the lower court’s findings. Referring to European Union Directive 95/46/EC on data protection, it held that the employer’s conduct, after having warned Mr Barbulescu and his colleagues that company resources should not be used for personal purposes, had been reasonable and that the monitoring of Mr Barbulescu’s communications had been the only method of establishing whether there had been a disciplinary breach.
Relying in particular on Article 8 (right to respect for private and family life, the home and correspondence), Mr Barbulescu complained that his employer’s decision to terminate his contract after monitoring his electronic communications and accessing their contents was based on a breach of his privacy and that the domestic courts failed to protect his right to respect for his private life and correspondence.
The application was lodged with the European Court of Human Rights on 15 December 2008. In its Chamber judgment of 12 January 2016, the European Court of Human Rights held, by six votes to one, that there had been no violation of Article 8 of the Convention, finding that the domestic courts had struck a fair balance between Mr Barbulescu’s right to respect for his private life and correspondence under Article 8 and the interests of his employer. The Court noted, in particular, that Mr Barbulescu’s private life and correspondence had been engaged. However, his employer’s monitoring of his communications had been reasonable in the context of disciplinary proceedings. On 6 June 2016 the case was referred to the Grand Chamber at Mr Barbulescu’s request.
The Government of France and the European Trade Union Confederation (ETUC) were granted leave to intervene in the written proceedings as third parties.
Decision of the Court
The Court confirmed that Article 8 was applicable in Mr Barbulescu’s case, concluding that his communications in the workplace had been covered by the concepts of ‘private life’ and ‘correspondence’. It noted in particular that, although it was questionable whether Mr Barbulescu could have had a reasonable expectation of privacy in view of his employer’s restrictive regulations on internet use, of which he had been informed, an employer’s instructions could not reduce private social life in the workplace to zero. The right to respect for private life and for the privacy of correspondence continued to exist, even if these might be restricted in so far as necessary.
While the measure complained of, namely the monitoring of Mr Barbulescu’s communications which resulted in his dismissal, had been taken by a private company, it had been accepted by the national courts. The Court therefore considered that the complaint was to be examined from the standpoint of the State’s positive obligations. The national authorities had been required to carry out a balancing exercise between the competing interests at stake, namely Mr Barbulescu’s right to respect for his private life, on the one hand, and his employer’s right to take measures in order to ensure the smooth running of the company, on the other. As to the resulting question of whether the national authorities had struck a fair balance between those interests, the Court first observed that the national courts had expressly referred to Mr Barbulescu’s right to respect for his private life and to the applicable legal principles. Notably the Court of Appeal had made reference to EU Directive 95/46/EC (the Data Protection Directive) and the principles set forth in it, namely necessity, purpose specification, transparency, legitimacy, proportionality and security. The national courts had also examined whether the disciplinary proceedings had been conducted in an adversarial manner and whether Mr Barbulescu had been given the opportunity to put forward his arguments. However, the national courts had omitted to determine whether Mr Barbulescu had been notified in advance of the possibility that his employer might introduce monitoring measures, and of the nature of such measures. The County Court had simply observed that employees' attention had been drawn to the fact that, shortly before Mr Barbulescu’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes. The Court of Appeal had found that he had been warned that he should not use company resources for personal purposes.
The Grand Chamber considered, following international and European standards (especially the ILO Code of Practice on the Protection of Workers‘ Personal Data of 1997 and EU Recommendation CM/Rec (2015)5 on the processing of personal data in the context of employment), that to qualify as prior notice, the warning from an employer had to be given before the monitoring was initiated, especially where it entailed accessing the contents of employees’ communications. The Court concluded, from the material in the case file, that Mr Barbulescu had not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer might have access to the actual contents of his messages.
As to the scope of the monitoring and the degree of intrusion into Mr Barbulescu’s privacy, this question had not been examined by either of the national courts, even though the employer had recorded all communications of Mr Barbulescu during the monitoring period in real time and had printed out their contents. Nor had the national courts carried out a sufficient assessment of whether there had been legitimate reasons to justify monitoring Mr Barbulescu’s communications. The County Court had referred, in particular, to the need to avoid the company’s IT systems being damaged or liability being incurred by the company in the event of illegal activities online. However, these examples could only be seen as theoretical, since there was no suggestion that Mr Barbulescu had actually exposed the company to any of those risks. Furthermore, neither of the national courts had sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the contents of Mr Barbulescu’s communications. Moreover, neither court had considered the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings, namely the fact that – being dismissed – he had received the most severe disciplinary sanction. Finally, the courts had not established at what point during the disciplinary proceedings the employer had accessed the relevant content, in particular whether he had accessed the content at the time he summoned Mr Barbulescu to give an explanation for his use of company resources.
Having regard to those considerations, the Court concluded that the national authorities had not adequately protected Mr Barbulescu’s right to respect for his private life and correspondence and that they had consequently failed to strike a fair balance between the interests at stake. There had therefore been a violation of Article 8.
Just satisfaction (Article 41)
The Court held that the finding of a violation constituted in itself sufficient just satisfaction for the non-pecuniary damage sustained by Mr Barbulescu.
Judge Karakas expressed a partly dissenting opinion. Judges Raimondi, Dedov, Kjølbro, Mits, Mourou-Vikström and Eicke expressed a joint dissenting opinion. These opinions are annexed to the judgment.
The full judgment in English, including some interesting material in the dissenting opinions, is available here.
Laurence Eastham writes:
One cannot help but feel that this is a judgment pertaining to facts arising in another age. The idea that an employee might not use the internet for personal purposes during working hours is a tricky one to get your head round in 2017. Monitoring for illegal use of the internet is though still a live issue and the judgment remains important.
There are basic principles here: employers must make sure their policies are clear and give clear notice to employees before monitoring. Employers must also limit monitoring to what is necessary to guard against improper use.
This is a message that has been sent out to employers in the UK for some time. Whether they have all listened is another matter.