Privacy in the Workplace
A panel of 17 judges heard the appeal of Bărbulescu v Romania in The Grand Chamber of the European Court of Human Rights (the “GCECHR”). In the first instance, the European Court of Human Rights (the “ECHR”) held that an employer had not violated its employee’s right to privacy and respect for his private messages by printing off 45 pages of personal correspondence which the employee had sent from the What’s App account which was installed on his work computer for the purpose of responding to customer queries. The ECHR accepted that the employer needed to access the personal correspondence in order to enforce a company policy which prohibited employees from using the company computer system for personal affairs. The ECHR noted that printing the messages was a proportionate way of demonstrating that the employee was not telling the truth because he had specifically denied sending personal messages.
On appeal, the GCECHR decided that the employer had in fact breached its employee’s right to privacy. Whilst the GCECHR did not actually rule that the employer had been wrong to access and print out the messages, it said that the Romanian Courts had failed to conduct a proper balancing exercise between the rights of the employer to protect its business interests on the one hand, and the rights of the employee to protect the privacy of his or her communications on the other. In particular, the Romanian Courts had not asked whether Mr Bărbulescu had been informed that his correspondence was being monitored. The Romanian Courts also failed to identify how many people had read the correspondence and over what time period. The GCECHR held that it is not sufficient for an employer to simply inform its employees that nothing they do while using the company computer system is private. Where an employer monitors correspondence, it must ensure that this is limited and proportionate in relation to the specific purpose for which it is being conducted.
The case provides employers in the UK with useful guidance on how to ensure that employees’ privacy is properly protected. It demonstrates that employers must check their policies and procedures carefully. If an employer wishes to monitor an employee’s personal communications at work, it needs to implement a policy which clearly sets out how and why the employer seeks to achieve that.