In 2016, in the case of Barbulescu v Romania, the European Court of Human Rights ruled that an employer was lawful in monitoring an employee’s messenger account. The ruling reinforced the UK Government’s current policy, which says that employers can monitor emails, or look at which websites workers visit, as long as they explain this clearly in the staff handbook or contract.
In this case, the employee had used a Yahoo messenger account to communicate with his brother and his partner. The news was welcomed by employers across the UK, and seemed to align with the expectation that an employee should devote their full time and attention to their job when at work.
However, the decision was then appealed to the Grand Chamber, which is the final tier. This summer, in an 11 to 6 judgment, the Chamber overturned the ECHR decision and gave judgment in favour of Bogdan Barbulescu, and the right to respect for privacy under Article 8 of the European Convention on Human Rights. Mr Barbulescu was therefore entitled to compensation for the breach of his human rights.
Notwithstanding the employer-employee relationship, workers have a right to privacy in the workplace. The decision sets out that, if an employer is looking to monitor private emails and communications, the employer needs to make the employee aware that their messages may be monitored. In Barbulescu, the employee has not been informed of this possibility, although they had been told that it was forbidden to use work computers for personal purposes.
Practically, this judgment highlights the need for employers to have clear policies on communication and online activities. It will be used as guidance across European Courts, and will remain influential in the UK after Brexit.
Employees should be informed that their email access may be monitored, and ideally should be requested to consent to this (for instance, by way of signed contract, separate signed consent or signed acceptance of company policies). Employers should be aware that this surveillance may cause distrust and resentment from workers, so it is essential to be fully transparent and set out why this monitoring is essential. There should be a specific aim or legitimate interest to justify the surveillance, and the surveillance should go no more than necessary to achieve this. Data protection legislation should be borne in mind when processing any personal information. For best practice, reminders should be given of the business’ do’s and don’ts and the extent of monitoring/processing, which should be accepted as seen and agreed to by employees.