The employee in question, Mr Bărbulescu, was tasked with setting up an instant messaging account in Yahoo Messenger to allow the company to handle customer complaints. B regularly used the account to message his fiancée and brother. The company’s IT policy expressly forbade employees from using its IT systems for personal purposes. When B’s misuse of the instant messaging account came to light, he was dismissed. He disputed the fairness of the dismissal, arguing that the company had breached his right to privacy by accessing and making use of his personal messages. The case made its way through the local courts and eventually ended up in the ECtHR.

Following the initial judgment of the ECtHR in January 2016, B appealed to the Grand Chamber of the ECtHR. His case was considered by 17 judges who overturned the earlier ruling. Their decision was based on a finding that the domestic courts had mishandled the hearing of B’s complaints and had therefore failed to protect his right to privacy.

The question for the ECtHR to decide was whether a fair balance had been struck between B’s right to respect for privacy and the employer’s right to monitor communications to ensure the smooth running of the company. The majority of the Grand Chamber decided that the domestic courts had (1) failed to establish the relevant facts and (2) failed to perform the requisite balancing exercise between B’s right to privacy and the employer’s interests.

In particular, the Grand Chamber noted that the domestic courts had failed to consider the following factors which were key to determining fairness:

The win was bittersweet for B as the ECtHR chose not to award him any compensation because it felt he had not suffered any monetary loss and the ruling that his right to privacy had been breached was sufficient reward for any non-monetary loss. The ECtHR permitted him to recover only part of his legal fees.

The case is of limited impact for the UK as we already have in place guidance on workplace monitoring for employers that largely reflects the Grand Chamber’s recommendations. Many of the principles in the Employment Practices Code, which was devised by the Information Commissioner’s Office, cover the same ground.

CASE Bărbulescu v Romania, European Court of Human Rights (Grand Chamber), 5 September 2017

Wrong, as an employee in Romania learnt to his detriment.

The employee in question, Mr Bărbulescu, was tasked with setting up an instant messaging account in Yahoo Messenger to allow the company to handle customer complaints. Mr B regularly used the account to message his fiancée and brother despite this being expressly forbidden by the company’s workplace policy. When Mr B’s misuse of the instant messaging account came to light, he was dismissed. Mr B disputed the fairness of the dismissal, arguing that the company had breached his right to privacy by accessing and making use of his personal messages. The case made its way through the local courts and eventually ended up in the European Court of Human Rights.

The Court decided that the employer acted fairly. It acknowledged there was a balance between an individual’s right to privacy and an employer’s right to ensure its IT systems were being used for professional purposes only. In Mr B’s case, a fair balance had been struck. The employer had accessed Mr B’s personal messages only so far as was necessary to establish that Mr B had been using its instant messaging account for his own personal ends.

The case is a warning to employees that they cannot blithely use their company’s email and instant messaging systems for personal reasons in the assumption that their right to privacy is preserved at all costs. If their employer has a policy that clearly says such use is forbidden and they have been made aware of this restriction, then privacy law will not protect their correspondence from their employer’s prying eyes.

CASE Bărbulescu v Romania, 12 January 2016

  Tax Increase the tax-free personal allowance to £12,500. Equal pay Introduce private sector equal pay reporting by requiring companies with more than 250 employees to publish the difference between the average pay of their male and female employees. Public sector termination payments Introduce new legislation to cap enhanced redundancy payments in the public sector at £95,000. Require repayment of public sector exit payments in certain circumstances. Long-term absence Reduce benefits of those suffering from long-term, treatable conditions if they refuse to follow treatment recommended for them. Volunteering Allow employees working in large companies (employers with more than 250 employees) or the public sector to receive three days’ paid volunteering leave. Pensions Introduce a single-tier pension system.

Photograph: “Houses of Parliament” /© Davoud D.

Most employers have systems that maintain daily records of Internet activity, which are logged at various times during the day. These can be searched to identify unusual or illicit activity. However, an employer is not free to undertake any monitoring of an employee’s computer usage it wishes merely because such usage is taking place at work. Monitoring must be done in a way that is consistent with a myriad of legislation, including laws relating to data protection, human rights and telecommunications. There is also a duty of trust and confidence implied into each employee’s contract of employment which may be breached by an employer’s monitoring activities.

A general principle is that any monitoring must be proportionate so that the adverse impact of monitoring an individual is justified by the benefit of such monitoring to the business. The usual purpose of monitoring is to uncover any activities that might expose the company to risk of suit, such as the transmission of confidential information, infringement of copyright, or inappropriate use of company computers.

First, employees must have notice that monitoring will be carried out. The company should have a policy on the use of electronic communications which describes the sort of Internet material that employees are prohibited from viewing. An effective electronic communications policy would contain an express prohibition on visiting sites that contain obscence content (in case any employees are under the misguided notion that it is appropriate to do so while at work). The policy should also warn employees that any inappropriate use of the Internet will be dealt with under the disciplinary procedure.

If any suspicious activity is uncovered during monitoring, it should be investigated. Employers should avoid a knee-jerk reaction when taking disciplinary action. The employee should be given an opportunity to explain their behaviour or challenge the disciplinary findings. This is an important step as there are rare cases of employees successfully justifying their behaviour on the grounds of disability or ignorance of company rules. Finally, any punishment for breach of the electronic communications policy should be applied consistently and fairly.