EU: ECJ privacy ruling not a green light for employer snooping despite media headlines

A recent ruling of the European Court of Human Rights should be viewed as a reminder to employers to exercise caution before monitoring their employees' use of internet and messaging services whilst at work. Media headlines framing the ruling as a green light for employers to snoop on their employees are misleading. In fact, the Court has confirmed that the right to privacy is engaged in relation to employees' personal activities on work devices, and therefore interference with this right must be justified and proportionate. Whether this is so will depend on whether private use is clearly prohibited; whether employees have been properly warned of the nature, scope and effect of monitoring; whether the employer accessed data more extensively than necessary; and whether its use was reasonable.

The case of Barbulescu v Romania concerned an employee's personal use of a Yahoo Messenger account set up at the employer's request to be used purely for work messages, and in contravention of an absolute rule prohibiting personal use. The Romanian court found the employee's dismissal for breach of workplace rules to be fair, concluding that the employer was entitled to check whether its workplace rules had been breached and to admit in evidence a transcript of personal messages sent by the employee.

The European Court ruled that the Romanian court had not violated the employee's Convention rights in so doing, given that the transcript had only been used to establish the employee's breach because the employee had denied the personal use. Significantly, the majority accepted that the workplace rule was an absolute prohibition and had been made clear to employees. The position would presumably have been different had the employee acknowledged his breach, if some personal use had been permitted under the workplace rules, or if the employer had failed to make the rule known. It was also relevant that instant messaging does not provide for a subject line which can be used to tag messages as "personal"– there would have been no need for the employer to access emails tagged as personal in the subject line to establish breach of the prohibition on personal use.

The ruling does not change the position under UK law: an employee may be able to claim constructive dismissal if there is a reasonable expectation of privacy and the employer's interference with personal communications is not justified. The position will depend on the employer's workplace policy on personal use, the extent to which it has made the policy and the scope and nature of any monitoring known to the workforce, and whether the monitoring has gone further than necessary to achieve a business need (eg, by accessing content of messages where monitoring traffic or recipients would be sufficient). Employers must also bear data protection law in mind, in particular Part 3 of the Data Protection Practices Code sets out guidance for employers considering monitoring employee communications. Steps should also be taken to ensure data obtained through monitoring is used appropriately, for example it should not be disclosed more widely than necessary.

Multinational employers should also bear in mind that data protection laws, and the extent to which monitoring may be permitted, will vary considerably between jurisdictions.