European court says workplace surveillance must not violate workers’ privacy

European companies must strike a fair balance between workplace surveillance and their employees’ right to privacy, the European Court of Human Rights (ECHR) has ruled.

Delivery of the decision

Circumstances of the case

The decision, made by the court’s Grand Chamber, is final: the unnamed private Romanian company that dismissed Bogdan Barbulescu after discovering he used his work Yahoo IM account for private communication violated his right to privacy.

Barbulescu opened the IM account at the employer’s request, and has claimed to have used it only for professional correspondence. But the company had been monitoring it, and showed him transcripts of the messages he had exchanged with his brother and his fiancée via this account and his personal Yahoo IM account. Barbulescu was dismissed soon after, and decided to sue his former employer for infringing on his right to private correspondence.

The decision reverses a previous ruling by a Chamber of the Court, as well as overrides initial rulings by Romanian courts.

“The Grand Chamber held, by eleven votes to six, that there had been a violation of Article 8 of the [European Convention on Human Rights], finding that the Romanian authorities had not adequately protected the applicant’s right to respect for his private life and correspondence,” the court stated.

“They had consequently failed to strike a fair balance between the interests at stake. In particular, the national courts had failed to determine whether the applicant had received prior notice from his employer of the possibility that his communications might be monitored; nor had they had regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or the degree of intrusion into his private life and correspondence. In addition, the national courts had failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into the applicant’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge.”

Workplace privacy

In the EU, only Austria, Finland, Luxembourg, Portugal, Slovakia and the UK have have explicitly regulated the issue of workplace privacy. 34 out of 47 states that are members of the Council of Europe require employers to give employees prior notice of at-work monitoring, and employers in many of the countries can monitor emails marked marked by employees as “private”, but are not permitted to access the content of these private communications.

This ruling “does not mean that employers cannot, under any circumstances, monitor employees’ communications or that they cannot dismiss employees for using the internet at work for private purposes. However, the Court considers that States should ensure that, when an employer takes measures to monitor employees’ communications, these measures are accompanied by adequate and sufficient safeguards against abuse,” the court pointed out.

This is the first time that the Court examined a case concerning the monitoring of an employee’s electronic communication by a private employer. Previous rulings were tied to electronic surveillance by state authorities.