The Right to Privacy and the Workplace

In the long-running case of Bărbulescu v Romania, the European Court of Human Rights (ECHR) looked at an employer's right to examine an employee's use of office computers for sending personal communications during working hours, in breach of the employer's internal regulations, and ruled that the monitoring of the electronic communications was reasonable and an acceptable means of ensuring compliance with the rules. That decision has now been overturned by the Grand Chamber of the ECHR.

The case concerned a Romanian man, Mr Bărbulescu, who was employed by a private company as an engineer in charge of sales and, at his employer's request, had created a Yahoo! Messenger account for the sole purpose of responding to clients' enquiries. He was aware of his employer's policy forbidding the use of any office equipment for personal communications and employees had been warned that use of company resources for personal purposes was prohibited after the dismissal of a colleague for breaching the rule.

On 13 July 2007, Mr Bărbulescu was informed that his Yahoo! Messenger account had been monitored and the discovery made that it had been used for private correspondence. He replied in writing that he had only used the account for professional purposes.

His employer then presented him with a 45-page transcript of messages he had sent and received between 5 and 13 July, including all those he had exchanged with his fiancée and brother. Mr Bărbulescu was subsequently dismissed.

He argued without success before the courts in Romania that the monitoring of the account breached domestic law and amounted to a breach of his right to respect for privacy, enshrined in Article 8 of the European Convention on Human Rights.

In rejecting his arguments on appeal, the ECHR found that it was not unreasonable for an employer to verify that workers were devoting themselves to their professional tasks during working hours. Monitoring the account was, in practice, the only means of ensuring Mr Bărbulescu's compliance with the employer's explicit policy. No mention had been made during the proceedings of any of the contents of the personal communications, nor was the identity of the recipients made known.

In the ECHR's view, the level of monitoring was limited in scope and proportionate, and there was nothing to indicate that the Romanian courts had failed to strike a fair balance between Mr Bărbulescu's right to respect for his private life and his employer's interests.

Mr Bărbulescu appealed to the Grand Chamber of the ECHR, where the matter was considered by 17 judges, which held by a majority of 11 to six that there had been a violation of Article 8 of the Convention.

The Grand Chamber observed that the domestic courts had failed to determine, in particular, whether Mr Bărbulescu had received prior notice from his employer of the possibility that his communications might be monitored. Nor was account taken of the fact that he had not been told of the extent or the nature of the monitoring, or of the degree of intrusion into his private life and correspondence. Furthermore, they had failed to determine if there were specific reasons to justify the introduction of the monitoring, whether Mr Bărbulescu's employer could have used measures that involved less intrusion into his private life and correspondence or whether there were safeguards in place to ensure that his communications could not be accessed by his employer without him being notified in advance of that eventuality.

In the light of these findings, the Grand Chamber found that the Romanian courts had failed to protect Mr Bărbulescu's right to respect for his private life and correspondence and had consequently failed to strike a fair balance between his interests and those of his employer.

Guidance published by the Information Commissioner's Office, 'The Employment Practices Code', contains specific advice on compliance with UK legislation on monitoring electronic communications.

Video Surveillance at Work

Two further decisions of the European Court of Human Rights (ECHR) have looked at a worker's right to privacy under Article 8. In such cases, the ECHR must examine whether the member state concerned has struck a fair balance between workers' rights and those of the employer.

The first case (Antović and Mirković v Montenegro) concerned a complaint of invasion of privacy made by two professors at the University of Montenegro's School of Mathematics following the installation of video surveillance in the auditoriums where classes were held. The data collected was to be stored for a year. The decision to install the cameras specified that the purpose of the measure was to 'ensure the safety of property and people, including students, and the surveillance of teaching'. However, the professors disputed that the measures would improve safety and there were in any case other ways of achieving those aims. They also argued that they had not been notified in writing before the surveillance commenced. Following an investigation, the Personal Data Protection Agency ordered the University to remove the cameras from the auditoriums on the basis that the surveillance was not in accordance with the Personal Data Protection Act.

The professors then sought compensation, submitting that they had no control over the information collected by the surveillance and it constituted an interference in their private lives, contrary to Article 8, which was not provided for by any piece of legislation and was therefore illegal. Their claims were rejected by the domestic courts on the ground that the auditoriums where they taught were public areas and so the right to privacy was not at issue. However, the ECHR noted that it had previously found that private life might include professional activities and held, by four votes to three, that Article 8 had been violated in this instance.

The second case (Lόpez Ribalda and Others v Spain) concerned covert surveillance of workers in a Spanish supermarket. This was carried out in order to investigate possible theft after the store manager noticed discrepancies between stock levels and sales. The employer had installed both visible and hidden cameras, but the workers were only told about the ones they could see. Five members of staff were dismissed after they were caught on camera stealing and helping customers and other members of staff to steal. They claimed that the covert surveillance was a breach of their right to privacy, but the domestic courts found that interference with an employee's right to privacy was justified as being an appropriate, necessary and proportionate means of achieving a legitimate aim in a situation where there were substantiated suspicions of theft. Nor was there any other equally effective means of protecting the employer's rights which would have interfered less with the workers' right to respect for their private lives.

The ECHR disagreed, however. Spanish law requires that individuals be informed about the processing and storage of their personal data and the workers in this case had not been told. Furthermore, the employer's rights could have been protected in a less intrusive manner. In the ECHR's view, the domestic courts had failed to achieve a fair balance between the respective rights of those concerned, and the workers' treatment had been a breach of Article 8.

If you use CCTV cameras to monitor employee activity, we can advise you to ensure your data protection procedures comply with stricter requirements that apply now that the European General Data Protection Regulation and the Data Protection Act 2018 are in force.