Spying at work: Has the European Court of Human Rights really struck a blow for employees?
To misquote Mark Twain, reports that the right to privacy in the workplace is dead have been greatly exaggerated. However, media speculation that employers can no longer monitor the communications of their employees is inaccurate. Siân McKinley comments on the recent judgment of Barbulescu v Romania and provides some practical points on how to avoid breaches of Article 8 in the workplace.
Overview
In January last year British newspapers speculated that ‘Europe’ had given employers free rein to monitor private communications of employees. At the time Schona Jolly QC explained why the furore over the judgment of the European Court of Human Rights in Barbulescu v Romania was misplaced (available here). The Chamber of the ECHR dismissed the employee’s claim but at no point did the Court suggest that there is no right of privacy in the workplace.
Today the Grand Chamber of the European Court of Human Rights has overruled the earlier decision. In its judgment, it held that the employee’s right to private life and correspondence, which is contained in Article 8, had been breached. Predictably this has caused excitement in the press as heralding the “end of snooping bosses spying on workers' emails and instant chats”.[1] Again the European Court has said no such thing.
Facts
The case involved a company policy which expressly prohibited personal use of company computers. The employee was asked by his employer to create an instant messaging account using Yahoo Messenger, which he did. He also had a personal Yahoo Messenger account.
On 3 July 2007 the employer circulated an information notice which reminded employees that personal use of the internet was prohibited and informed employees that work would be monitored. The employee saw this information notice at some point between 3 and 13 July 2007.
Between 5 and 13 July 2007 the employer recorded the employee’s Yahoo Messenger communications in real time. On 13 July 2007 the employee was told that his communications had been monitored and shown evidence that his internet activity was greater than that of his colleagues. The employee informed his employer that he had used Yahoo Messenger for work-related purposes only. An hour later the employee was shown 45 pages of messages he had exchanged with his brother and his fiancée. The messages related to personal matters and some were of an intimate nature. There were also 5 messages the employee had exchanged with his fiancée using his personal account.
On 1 August 2007 the employer dismissed the employee. The employee challenged his dismissal in the Romanian domestic courts, but the domestic courts dismissed his claim.
Before the Chamber and the Grand Chamber of the European Court, the employee alleged that his telephone and email communications from this workplace were protected by his right to private life and correspondence under Article 8 of the European Convention on Human Rights. He claimed that his dismissal had been based on a breach of his right to respect for his private life and correspondence, and that the domestic courts had failed to protect his right accordingly.
Article 8
The Court stated that “an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.” It is most likely this comment which has led to the media speculation that monitoring is no longer allowed.
When considering whether Article 8 applies, it has always been relevant, although not determinative, whether individuals had a reasonable expectation that their privacy would be respected and protected. Normally the employer’s actions, in informing an employee as to the limits of his personal space, are crucial when determining whether there is a reasonable expectation of privacy and what that expectation looks like.
Indeed, it appears that the actions of an employer can even remove an expectation of privacy in respect of certain aspects of the workplace. For example, in Simpkin v The Berkeley Group Holdings plc [2017] EWHC 1472, the claimant had no reasonable expectation of privacy in a document produced on his employer’s computer system and sent using his work email system. This was because of, inter alia, the existence of an IT policy which made clear that emails sent and received on the system were the property of the employer, constant access to the claimant’s email account by the IT department and the claimant’s personal assistant, and the document was stored on one drive of the employer’s central servers.
However, the most recent judgment in Barbulescu v Romania suggests that employers, by their actions or policies, cannot remove entirely any expectation of privacy in all areas of the workplace. In this sense, the Court has said something new. We are not aware of any prior case in which the Court has said there is an irreducible minimum right to private social life in the workplace.
Legally this is interesting. However, this does not mean there will be a practical difference for employers. Even if Article 8 is engaged, there must be a balance between the employee’s right to private life and the employer’s interests. The proportionality test is key in order to decide where the fair balance must be struck between these competing interests.
Striking a balance
It is important to remember that the Court did not consider whether the private employer acted correctly, but rather whether the domestic courts adequately protected the employee’s right to private life when considering his challenge against his dismissal.
Nevertheless, there are a number of practical useful points for employers which arise from the judgment.
Firstly, the Court acknowledged that employers have a legitimate interest in ensuring the smooth running of the organisation and a “right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.” This should not be mistaken for an unqualified right for employers to monitor the private communications of employees. However, the acknowledgement of a qualified right to engage in monitoring is itself significant.
Secondly, the Court set out what the domestic courts should look for when weighing the employee’s right to respect for his private life and correspondence against the employer’s right to engage in monitoring. This part of the Court’s judgment provides useful guidance for employers wishing to monitor correspondence and other communications. Taking the following steps will make it easier for employers to defend such measures against challenges:
1.Employees should be notified of the possibility that the employer might take measures to monitor correspondence and other communications, and of the way in which such measures will be implemented. Notification should be clear about the nature of monitoring and should be given in advance. If employers wish to monitor the actual content of communications, employees must be notified in advance of this.
2.Employers should assess, before monitoring begins, the extent of the monitoring they wish to carry out and the degree of intrusion into the employee’s privacy. Factors they should consider includes:
Whether monitoring can be limited to the flow of communications, or whether it must include the content as well;
Whether all communications have to be monitored, or whether monitoring only some communications would suffice;
Whether monitoring can be limited in time;Whether there can be spatial limits to monitoring (i.e. if CCTV monitoring is required, whether it can be limited to only some areas);
Whether any restrictions can be placed on the number of people who have access to the results.
Employers should identify legitimate reasons to justify monitoring the communications. If the employer wishes to monitor the content of communications, more cogent reasons are required to justify this more invasive method.
3.Employers should assess whether it would have been possible to establish a monitoring system based on less intrusive methods and measures. If the employer wishes to monitor the content of communications, the employer must assessment whether the legitimate reasons identified above could be achieved without directly accessing the full contents of the employee’s communications.Employers should review the use of the result of the monitoring operation, the consequences for employees and the whether the results achieve the reasons identified. If the measures are challenged, domestic courts must consider the consequences of the monitoring for the employee subjected to it and weight this against the consequences for the employer.
In coming to its decision, the Court identified a number of issues which the Romanian domestic courts failed to consider. The domestic courts failed to determine whether the employee had in fact received prior notice of monitoring, nor did they have regard to the fact that he had not been informed of the nature and extent of monitoring. In addition they failed to determine the specific reasons justifying the introduction of monitoring measures and whether the employer could have used measure entailing less intrusion. As a result, the Court held, the domestic courts failed to strike a fair balance between the interests at stake.
At first blush this guidance appears onerous for employers who wish to carry out monitoring of employees. However, the Information Commissioner’s Office already recommends that before any monitoring is carried out, an impact assessment is conducted in which employers identified the purpose of the monitoring, its benefit, the adverse impact on the employees and whether there are less invasive means of achieving the employer’s aim (The Employment Practices Code, 2011).
The most important point for employers is to be aware that there needs to be a case-by-case balancing act. More invasive monitoring will require more cogent justification and, in most cases, a greater degree of warnings.
Conclusion
Reasonableness and proportionality remain the most important factors in the balancing act between the competing interests of employers and employees. Contrary to some reporting, employers can still access private communications but only where there has been an element of pre-warning and the premise of the intrusion is a legitimate one.
5 September 2017
[1]http://www.telegraph.co.uk/news/2017/09/05/landmark-eu-ruling-heralds-end-snooping-bosses-spying-workers/