Privacy at work: Limits on employers' ability to monitor private communications

The Grand Chamber of the European Court of Human Rights' (ECtHR) ruling in Barbulescu v Romania (61496/08) is a timely reminder of the limits of employers' ability to monitor their employees' private activity on work IT systems. Although the decision does not substantively alter UK law on employees' privacy at work, it is notable for:

• finding that the right to respect for private life under Article 8 of the European Convention on Human Rights applies to communications made from the workplace even when it is questionable whether the employee had a reasonable expectation of privacy; and
• giving guidance on the factors that domestic courts should consider when deciding whether Article 8 has been breached (involving a balancing of the employee's right to respect for his private life and the employer's interests) in cases where private communications have been monitored.

This ruling highlights the broad interpretation that the ECtHR gives to the term "private life" when applying Article 8 to communications. It appears that the content of communications is more important than the context in which they are made. Thus, the fact that a platform is explicitly reserved by an employer for professional communications only does not mean that private communications made on it lose their private status; accessing such communications is a potential breach of employees' human rights. This was held to be so even when the employee insisted that he had only engaged in professional communications on the employer's system.

The ECtHR's guidance to domestic courts is also instructive for employers as to how such monitoring will be viewed by the courts. The ECtHR made it clear that without clear and advance notice warning of the operation of monitoring and detailing its extent and nature, the monitoring is likely to be unlawful. The guidance also indicates that extreme caution should be used when accessing and using the content of employees' private communications, and that it should be avoided if at all possible.

Whilst decisions of the ECtHR do not automatically become law in the UK, they are (at the moment) required to be taken into account by the domestic courts. Data monitoring activities are, however, already regulated by domestic legislation such as the Data Protection Act 1998 (DPA 1998) (on which the Information Commissioner has published guidance covering the monitoring of employees) and the Regulation of Investigatory Powers Act 2000 and these will remain the primary sources of UK employers' legal duties in this area.

Alan Watts, Sara Scott and Anna Henderson outline the decision in more detail below.

Background

Mr Barbulescu (the applicant) was employed in a sales position by a private company. On the employer's instructions, he set up a Yahoo Messenger account in order to communicate with clients. The employer had in place a strict policy which prohibited any personal use of its IT equipment. In 2007, during the course of investigation into the applicant's high level of internet usage, the employer checked the content of the applicant's Yahoo Messenger communications, discovered personal messages with intimate details and presented this evidence to him. The applicant alleged to the employer that its actions in accessing his communications amounted to a criminal offence. Shortly after this the applicant was dismissed from his job.

The applicant challenged his dismissal on the basis that the employer's conduct was unlawful. The Romanian courts rejected the applicant's claim and upheld the employer's right to supervise its employees' work by monitoring their communications. The applicant applied to the ECtHR for a declaration that his Article 8 rights had been violated.

It is important to note that the main issue before the ECtHR at both stages of the case was whether the Romanian courts had given sufficient consideration to the applicant's rights as opposed to those of his employer. The ECtHR did not have jurisdiction to rule on the substantive issue of whether the employer's monitoring of communications was lawful, as the employer was a private company, not a public body.

Initial decision

The Chamber of the ECtHR held that the Romanian courts had not violated the applicant's Article 8 rights in its consideration of his case. This decision led to a slew of inaccurate media headlines claiming that the ECtHR had given blanket permission to employers to monitor employees' private communications. This was misinformed because, as stated above, the ECtHR was not considering the employer's substantive right to monitor communications, but rather the state courts' treatment of the claim arising from it. Further, the media's suggestion that the Chamber had given employers carte blanche to monitor employees' private communications was also inaccurate: the ruling hinged on the finding the employer had imposed an absolute prohibition on personal use, which had been made clear to employees, and did not give a green light to monitor where employees had not been clearly prohibited from personal use.

Nevertheless, the attitude of the majority of the Chamber to such monitoring was significant. The majority did not require domestic courts to consider whether notice of a monitoring policy had been given when ruling whether such surveillance violates an applicant's Article 8 rights (although it did consider this in the context of whether Article 8 was engaged at all). It also sided with the Romanian courts' in their sympathy for the employer's enforcement of its internal regulations and disciplinary procedures, and for this reason did not consider the employee's rights in detail.

For more detail, please refer to our employment note on the initial decision.

Decision of the Grand Chamber

The Grand Chamber overturned the decision of the Chamber, finding that the Romanian courts had violated the applicant's Article 8 rights by failing to strike a fair balance between the applicant's rights and that of his employer to supervise its employees at work.

Reasonable expectation

In this case, the employer's absolute prohibition of personal use made it, by the ECtHR's admission, questionable whether the applicant had a reasonable expectation of privacy.

The leading authorities on Article 8 and monitoring of communications until this case (Halford v UK (1997) and Copland v UK (2007)) had held that whether an applicant had a reasonable expectation of privacy in relation to the monitored communications was material in deciding whether their Article 8 rights were engaged. In those cases, the communications were made on systems that were permitted to be used for private purposes.

Notwithstanding this distinction, the ECtHR stated that "an employer’s instructions cannot reduce private social life in the workplace to zero" and the fact that "the applicant’s communications in the workplace were covered by the concepts of 'private life' and 'correspondence'" alone was enough to engage Article 8.

Guidance on monitoring of communications

The Grand Chamber imposed a greater duty than the lower Chamber had on domestic courts to consider whether the monitoring of communications is lawful. In particular, it instructed that the following factors are relevant:

• notice – was the employee notified clearly in advance of the possibility that his/her correspondence and communications may be monitored, the nature of such measures and that such measures were implemented;
• extent and intrusiveness – including the number of communications monitored, the temporal and spatial limits of monitoring, and the number of people with access to the information; the ECtHR distinguished between monitoring of the flow of communications and their content;
• legitimate reasons – does the employer have legitimate reasons to justify such monitoring and accessing of content; in the case of content, the justification must be weightier;
• other means – was it possible in the circumstances to use less intrusive means than accessing the content of the employee’s communications in order to meet the employer's aims;
• consequences – what were the consequences for the employee of such monitoring, and whether the results were used to achieve the employer's aims;
• safeguards – were there adequate safeguards for employees, including in particular that the employer could not access the actual content of communications unless the employee had been notified in advance?

The ECtHR found that the domestic courts had not sufficiently considered these factors in their judgments. It appears that the absence of adequate notice to the applicant was particularly significant. It is notable that, in this case, the applicant had been provided with a copy of the employer's internal regulations which referred in very general terms to the employer's policy of monitoring employees' work and conduct. Such a general warning was held to be inadequate.

Conclusion

Despite the media's portrayal of the case, Barbulescu has not substantially changed the position on monitoring of communications under UK law (largely contained in the UK Information Commissioner's Code of Practice on workplace monitoring).

Employers cannot rely on their prohibition of private use of technology alone to justify monitoring employees' private communications.

If employers feel that they may need to monitor employees' communications, this must be clearly communicated in advance with full details of what such monitoring entails; in the absence of such notice, monitoring is likely to be unlawful. Even in cases where employees have been notified of a monitoring program, the implementation of such a program must be considered carefully. Monitoring should occur only when strictly necessary and to a proportionate extent. Accessing the content of communications is more intrusive than mere monitoring of flow, and the test for whether this is lawful is commensurately stricter.

In addition to complying with data protection and interception laws, these steps will be important to avoid an employee claiming constructive unfair dismissal on the ground that the employer's monitoring breached the implied duty of trust and confidence. They will also maximise the prospects of the employer being able to adduce the evidence obtained from monitoring at tribunal should a claim be brought.