BRACHER RAWLINS | Employees beware: Big Brother is watching you

Using email at work may not be as private as you think.

In the recent landmark case of Bărbulescu v Romania, the European Court of Human Rights (ECHR) ruled that employers were entitled to monitor the private messages sent by their employees during work time and such monitoring did not violate the employees’ right to privacy.

This case is in contrast to earlier rulings by the ECHR in relation to employees’ rights to privacy. The ECHR has stated previously that an employee has a reasonable expectation of privacy with respect to personal phone calls and emails that are sent whilst at work.

Details of the case

The Bărbulescu case was brought by a Romanian engineer who, at his employers’ request, created a Yahoo Messenger account for the purpose of responding to clients’ enquiries. In 2007, he was questioned by his employer about whether he had been using the account for personal reasons. The engineer denied that he had been doing so but the employer later presented a 45-page transcript of his communication with his brother and fiancée relating to personal matters such as his health and sex life.

The employer’s disciplinary policy prohibited the use of email for personal conversations and his employment was terminated for misconduct on this basis. Having lost the case in Romania, the employee applied to the ECHR contending that the employer’s conduct had infringed his rights under Article 8 of the European Convention of Human Rights (Right to private and family life, home and correspondence).

The ECHR ruled that there was no violation of his rights to privacy because it was not unreasonable for an employer to verify that employees were completing the tasks of their day-to-day jobs during working hours. The employer had accessed the account on the assumption that the information in question was related to professional activities. The employee was in breach of the employer’s policy, which prohibited personal use of public accounts.

Decision is in line with UK law

Contrary to what has been stated in some press articles, the ECHR’s decision is in line with existing UK law. The Human Rights Act 1998 incorporates Article 8 into UK domestic law and therefore gives employees an expectation of privacy at work. However, this expectation is not absolute and employers are able to justify monitoring of personal communications if it is deemed reasonable and proportionate in the circumstances to do so.

Electronic methods of workplace surveillance involve the processing of personal data and are, therefore, also regulated by the Data Protection Act 1998. This means that employers need to provide detailed information to their employees about the monitoring that is being undertaken. An employer may have legitimate grounds for the monitoring, but it needs to avoid unjustifiable intrusions into their employees’ private lives.

Importance of employer’s policies

The ECHR in the Bărbulescu case highlights that unjustifiable snooping on employees would not be acceptable. In order to avoid falling foul of the law, employers ought to have a clear policy setting out what information they intended to collect and by what method.

From the individual’s perspective, the upshot of the Bărbulescu decision is that if an employee is using work IT systems to send and receive personal communications, the employee should not expect those communications to be private. Employees should check their employer’s policies and operate within the stipulated guidelines. Nowadays, many, but not all, employers allow reasonable personal use of company systems.

Employers should review their policies on IT monitoring to ensure that they go no further that is necessary to protect the needs of the business. They should also explore whether alternative, less intrusive, checks could be carried out in order to strike a balance between respecting an employee’s right to privacy and the employer’s legitimate business needs.

It is worth noting that the ECHR also said: “If the employer’s internet monitoring breaches the internal data protection policy or the relevant law or collective agreement, it may entitle the employee to terminate his or her employment and claim constructive dismissal, in addition to pecuniary and non-pecuniary damages.”

Therefore, if employers want to minimise the risk of becoming embroiled in employment tribunal litigation, they need to ensure that they have a robust policy on IT monitoring (which is consistent with the standards set by the ECHR) and that follow their own policies and procedures.

If you have any questions in relation to your employee communications policies, please contact Lee Gabbie at lee.gabbie@bracherrawlins.co.uk.

To download a PDF version of this article, please click here.