13 Sep The ECHR clarified the limits of corporate email snooping by employers
Background information
On September 5th, 2017, the Grand Chamber of the European Court of Human Rights (hereinafter, “GC ECHR” or “the Court”) declared that employees must be aware in advance of the monitoring of their corporate email account.
The case brought by a Romanian worker, Bogdan Barbulescu, dates back ten years to when he used an online chat service, Yahoo Messenger, to answer customer inquiries. During that period, the company secretly monitored his corporate email account and accused him of having used it to exchange private messages with his family. He was subsequently fired. He appealed the decision of his employer in the Romanian Court which ruled against him.
The employee claimed that a violation of Article 8 of the European Convention of Human Rights (hereinafter, “Art. 8”) had taken place and therefore decided to bring his case before the Court of Strasbourg whose Chamber of first instance initially confirmed the statement. Eventually, the GC ECHR overturned the previous judgement, giving priority to the employee’s right to private life and correspondence.
Legal framework and main issues
In a previous case, Copland v. United Kingdom, the Court found a violation of Art. 8 because there was no domestic law at that time to regulate the monitoring of the employees. In the decision at stake, the GC ECHR provides further protection for employees by requiring companies to inform workers of their monitoring policies.
The Court recalled the importance of Art. 8 and highlighted that, in the case of Mr. Barbulescu, the employee had not been informed in advance of his employer’s monitoring or the possibility that it might permit access to the contents of his messages.
The GC ECHR declared that the Romanian Court failed to apply a fair balance between the employer’s right to engage in monitoring, on the one hand, and the employee’s right to respect his private life and correspondence on the other hand. There had not been sufficient reasons to justify the monitoring of the employee’s communications because there was no suggestion he had exposed his company to risk in the case of illegal activities online. In addition, as regards the principle of proportionality, the employer could have used less intrusive means.
Practical implications
The present decision does not mean that employers cannot monitor the communications of employees under any circumstances. Instead it clarifies that in order to monitor employee communications, employers must:
- provide a clear, prior information notice declaring the monitoring purposes;
- define the legitimate legal grounds allowing the monitoring;
- assess the proportionality and subsidiarity of the intended monitoring as defined in Article 29 Working Party Opinion 2/2017 in order see whether less intrusive means may achieve the same aim. This can form part of a Data Protection Impact Assessment (DPIA).
